feat(build): add build_context_from_working_dir for independent modules#165
Merged
feat(build): add build_context_from_working_dir for independent modules#165
Conversation
… modules Adds a new boolean input to build.yml and pr-security-scan.yml that uses the component working_dir as Docker build context instead of the repo root. This enables building tools/services with their own go.mod without conflicting with the main project dependencies.
github-actions
bot
added
workflow
WalkthroughAdds a boolean Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
🔍 Lint Analysis
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
🛡️ CodeQL Analysis ResultsLanguages analyzed: Found 23 issue(s): 23 Medium
🔍 View full scan logs | 🛡️ Security tab |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
GitOps updates only modify YAML files in the gitops repo and do not pull or push Docker images. Docker login is unnecessary by default and can be explicitly enabled when needed.
lerian-studio
added
size/XS
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/gitops-update.yml (2)
474-474:⚠️ Potential issue | 🟠 MajorReplace relative path with absolute external reference.
gitops-update.ymlis a reusable workflow (workflow_calltrigger) designed for external repository callers. The relative pathuses: ./.github/workflows/slack-notify.ymlwill resolve to the caller's workspace, breaking the reference.Change to:
uses: LerianStudio/github-actions-shared-workflows/.github/workflows/slack-notify.yml@<release-tag>(No internal self-* wrapper exists to protect this workflow, so external refs are required.)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/gitops-update.yml at line 474, Replace the relative workflow reference uses: ./.github/workflows/slack-notify.yml with an absolute external reusable-workflow reference so callers resolve correctly; update the uses value on that line to reference the external repo and release tag, e.g. LerianStudio/github-actions-shared-workflows/.github/workflows/slack-notify.yml@<release-tag>, ensuring the reusable workflow call uses the external repo and tag instead of a relative path.
461-461:⚠️ Potential issue | 🟠 MajorUse
@masterinstead of unpinned@mainref for external action.The
LerianStudio/github-actions-argocd-syncrepository does not publish semantic version releases. It uses branch references:@masterfor production and@developfor testing. The current@mainreference is incorrect; this repository does not use amainbranch. Update to@masterto match the action's production branch.Suggested change
- uses: LerianStudio/github-actions-argocd-sync@main + uses: LerianStudio/github-actions-argocd-sync@master🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/gitops-update.yml at line 461, The workflow references the external action with an incorrect branch ref; update the uses entry for LerianStudio/github-actions-argocd-sync from `@main` to `@master` so the workflow points at the repository's production branch; locate the line that contains "uses: LerianStudio/github-actions-argocd-sync@main" and change the ref to "@master".
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/gitops-update.yml:
- Around line 54-57: Update the documentation to reflect the changed default for
the workflow input enable_docker_login: its default is now false (disabled)
instead of true; find references to enable_docker_login in the docs and change
any text that states or implies the default is true to state the default is
false and note callers must set enable_docker_login: true to enable Docker Hub
login.
---
Outside diff comments:
In @.github/workflows/gitops-update.yml:
- Line 474: Replace the relative workflow reference uses:
./.github/workflows/slack-notify.yml with an absolute external reusable-workflow
reference so callers resolve correctly; update the uses value on that line to
reference the external repo and release tag, e.g.
LerianStudio/github-actions-shared-workflows/.github/workflows/slack-notify.yml@<release-tag>,
ensuring the reusable workflow call uses the external repo and tag instead of a
relative path.
- Line 461: The workflow references the external action with an incorrect branch
ref; update the uses entry for LerianStudio/github-actions-argocd-sync from
`@main` to `@master` so the workflow points at the repository's production branch;
locate the line that contains "uses:
LerianStudio/github-actions-argocd-sync@main" and change the ref to "@master".
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 8a427898-65cf-41f8-8465-ddf9e5967405
📒 Files selected for processing (1)
.github/workflows/gitops-update.yml
Fix pre-existing lint issues: - Remove trailing whitespace from 17 lines - Add || exit 1 to cd commands (SC2164)
lerian-studio
added
size/S
There was a problem hiding this comment.
♻️ Duplicate comments (1)
.github/workflows/gitops-update.yml (1)
54-57:⚠️ Potential issue | 🟠 MajorBreaking caller behavior: default flip for
enable_docker_loginneeds explicit migration handling.Line 57 changes the default to
false, so callers that relied on the implicit default now skip Docker login and may hit pull-rate/auth failures. Either revert the default or treat this as a breaking change with explicit migration notes and caller updates.Suggested minimal fix (preserve backward compatibility)
enable_docker_login: description: 'Enable Docker Hub login to avoid rate limits. Disabled by default since GitOps updates do not require Docker registry access.' type: boolean - default: false + default: true🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/gitops-update.yml around lines 54 - 57, The default for the GitHub Action input enable_docker_login was flipped to false which breaks callers that relied on the previous implicit true; either revert the default to true in the workflow to preserve backward compatibility (restore the original default for enable_docker_login) or, if you intend the breaking change, add explicit migration steps: update all calling workflows to set enable_docker_login: true where needed, add a prominent changelog/release note and version bump, and document the new required behavior in the action README so callers can update accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In @.github/workflows/gitops-update.yml:
- Around line 54-57: The default for the GitHub Action input enable_docker_login
was flipped to false which breaks callers that relied on the previous implicit
true; either revert the default to true in the workflow to preserve backward
compatibility (restore the original default for enable_docker_login) or, if you
intend the breaking change, add explicit migration steps: update all calling
workflows to set enable_docker_login: true where needed, add a prominent
changelog/release note and version bump, and document the new required behavior
in the action README so callers can update accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 01b4e4da-b1e2-4dc0-a51b-4a72aae378f3
📒 Files selected for processing (1)
.github/workflows/gitops-update.yml
bedatty
dismissed
coderabbitai[bot]’s stale review
All comments addressed. CodeQL findings are false positives (with: params, not shell). GitOps docker login default change is intentional.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Actions Shared Workflows
Description
Adds a
build_context_from_working_dirboolean input tobuild.ymlandpr-security-scan.yml. Whentrue, the Docker build context usesmatrix.app.working_dirinstead of the repo root.This enables building independent modules (e.g.,
tools/mock-btg-serverwith its owngo.mod) without conflicting with the main project's dependencies. Without this, the DockerCOPY go.mod go.sum ./step copies the root module files, causinggo mod downloadfailures.Type of Change
feat: New workflow or new input/output/step in an existing workflowfix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)perf: Performance improvement (e.g. caching, parallelism, reduced steps)refactor: Internal restructuring with no behavior changedocs: Documentation only (README, docs/, inline comments)ci: Changes to self-CI (workflows under.github/workflows/that run on this repo)chore: Dependency bumps, config updates, maintenancetest: Adding or updating testsBREAKING CHANGE: Callers must update their configuration after this PRBreaking Changes
None. Default is
false— no change for existing consumers.Testing
@developor the beta tagCaller repo / workflow run: https://github.com/LerianStudio/plugin-br-pix-indirect-btg/pull/473
Related Issues
Summary by CodeRabbit
New Features
Chores