Fixes: mosip/k8s-infra#373 - Select and Push Changes to Develop in kattu, thats universal for all caller workflows.- #392

[Mohanraj209]

No description provided.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 25e8e407-a0a5-4c4d-9081-f68dc52da3b0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Ivanmeneges]

1. Registry token dumped to CI logs (image-transfer.yml)
After writing token: into release/vidivi/config.yml, the workflow does cat config.yml. GitHub Actions logs will contain the registry credential.

Also on WireGuard failure it runs sudo head -5 /etc/wireguard/wg0.conf, which can print private keys.

Fix: Never print config.yml or WireGuard config. Mask the token. Keep username/token as secrets.

2. Keystore password moved from secret to input (android-build.yml)
DEBUG_KEYSTORE_PASSWORD was a required secret. The PR takes KEYSTORE_PASSWORD as a workflow input (visible in the Actions UI and logs) and feeds it into both debug and release env vars.

Even with default password, this is the wrong channel for credentials and it breaks callers that still pass secrets.DEBUG_KEYSTORE_PASSWORD.

3. npm-sonar-analysis.yml is a regression of current develop
Current develop (from #367 / #368 / #372) does:

Node 18.x
npm ci
npm run test:ci + lcov
npx sonar-scanner with sonar.token

The PR replaces that with:

Node 14 (EOL)
npm install (not npm ci)
NG/BOB build, no tests, no coverage
npm run sonar -- -Dsonar.login=... (deprecated; also fails if package.json has no sonar script)
That will break Sonar for repos that already use the develop workflow.

4. Docker NPM extract path no longer matches the zip (docker-build.yml)
npm-build.yml still zips dist for NG (env.ZIP_DIR: dist). The docker workflow was changed from dist/* to build/*. Angular/NG docker builds will unzip nothing useful.

The non-root mosip user Dockerfile checks were also removed, and the forbidden mosipdev/mosipqa/latest/develop check was moved to a parallel job (build-docker-warning). The image can still be built and pushed while that check fails.

5. CodeQL downgrade
develop uses github/codeql-action/*@V3 and sets up JDK 21. The PR:

switches init/analyze to v2 (deprecated)
removes JDK 21 setup
Keep v3 (or v4) and the Java setup. Dropping the duplicate analyze step on develop is fine; the downgrade is not.

6. post-release-changes.yml will create PRs with empty title/base
This is workflow_call, but the PR step uses github.event.inputs.COMMIT_MESSAGE and github.event.inputs.BASE. Those are empty on workflow_call. Use inputs.COMMIT_MESSAGE and inputs.BASE.

There is also the typo releas-branch.

7. update-gpg.yml cannot work on develop
Filename says GPG; the workflow updates the Slack user map.
It curls master user_map.json.gpg into cwd, then decrypts .github/git-user-map/user_map.json.gpg, which does not exist on this branch (git-user-map lives only on master).
git push uses GH_TOKEN but the remote is not configured to use that PAT, so the push will likely fail.