👷 streamline pipeline #120
Conversation
|
""" WalkthroughThe workflow configuration was updated to use Ubuntu 24.04 runners instead of 22.04. Inline steps for sonarcloud, codecov, codeql, and deployment jobs were replaced with calls to centralized reusable workflows. Workflow-level permissions were added, job permissions were refined, and secrets inheritance was specified for relevant jobs. The build and test jobs were restructured to separate test project matrix generation from building, and new prepare_test and integration_test jobs were introduced. Changes
Possibly related PRs
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/pipelines.yml(5 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
.github/workflows/pipelines.yml
[warning] 237-237: too few spaces after comma
(commas)
[warning] 247-247: too few spaces after comma
(commas)
[warning] 255-255: too few spaces after comma
(commas)
[warning] 263-263: too few spaces after comma
(commas)
[warning] 263-263: too few spaces after comma
(commas)
[warning] 263-263: too few spaces after comma
(commas)
[warning] 263-263: too few spaces after comma
(commas)
[warning] 263-263: too few spaces after comma
(commas)
🔇 Additional comments (8)
.github/workflows/pipelines.yml (8)
21-23: Global permission scope set to least privilege
The addition of a top-levelpermissionsblock granting onlycontents: readfollows the principle of least privilege and simplifies permission management across jobs.
27-27: Upgrade Linux runner to Ubuntu 24.04
Updatingruns-onfromubuntu-22.04toubuntu-24.04forprepare_linuxensures compatibility with the latest features and security updates. Verify that all used GitHub Actions and any custom tooling remain supported on this runner.
69-69: Upgrade build runner to Ubuntu 24.04
Switching thebuildjob to Ubuntu 24.04 aligns with the modernization effort. Ensure all target frameworks (net9.0,net8.0, etc.) compile and run as expected on this environment.
162-162: Upgrade pack runner to Ubuntu 24.04
Migrating thepackjob to the new runner is consistent with other jobs. Confirm that packing and artifact uploads work correctly under Ubuntu 24.04.
191-191: Update test matrix to Ubuntu 24.04
The test matrix’soslist now usesubuntu-24.04. This maintains consistency across CI jobs—please validate that all tests pass in the updated Linux environment.
236-244: Replace inline SonarCloud steps with reusable workflow
Thesonarcloudjob now delegates tocodebeltnet/jobs-sonarcloudviauses, reducing duplication and centralizing maintenance. The providedwithinputs andsecrets: inheritlook correct.🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 237-237: too few spaces after comma
(commas)
246-252: Replace inline Codecov steps with reusable workflow
Thecodecovjob has been refactored to callcodebeltnet/jobs-codecov, passing therepositoryinput and inheriting secrets. This keeps the pipeline DRY and maintainable.🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 247-247: too few spaces after comma
(commas)
261-273: Replace inline deploy steps with reusable workflow
Thedeployjob now callscodebeltnet/jobs-nuget, explicitly setscontents: writeandpackages: write, and inherits secrets. Theif: github.event_name != 'pull_request'guard is properly in place. This streamlines deployment logic.🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 263-263: too few spaces after comma
(commas)
[warning] 263-263: too few spaces after comma
(commas)
[warning] 263-263: too few spaces after comma
(commas)
[warning] 263-263: too few spaces after comma
(commas)
[warning] 263-263: too few spaces after comma
(commas)
| codeql: | ||
| name: 🛡️ Security Analysis | ||
| needs: [prepare_linux, build, test] | ||
| runs-on: ubuntu-22.04 | ||
| timeout-minutes: 15 | ||
| steps: | ||
| - name: Checkout | ||
| uses: codebeltnet/git-checkout@v1 | ||
|
|
||
| - name: Install .NET | ||
| uses: codebeltnet/install-dotnet@v1 | ||
| with: | ||
| includePreview: true | ||
|
|
||
| - name: Restore Dependencies | ||
| uses: codebeltnet/dotnet-restore@v2 | ||
| with: | ||
| useRestoreCache: true | ||
| restoreCacheKey: ${{ needs.prepare_linux.outputs.restoreCacheKey }} | ||
|
|
||
| - name: Prepare CodeQL SAST Analysis | ||
| uses: codebeltnet/codeql-scan@v1 | ||
|
|
||
| - name: Download cuemon.snk file | ||
| uses: codebeltnet/gcp-download-file@v1 | ||
| with: | ||
| serviceAccountKey: ${{ secrets.GCP_TOKEN }} | ||
| bucketName: ${{ secrets.GCP_BUCKETNAME }} | ||
| objectName: cuemon.snk | ||
|
|
||
| - name: Build | ||
| uses: codebeltnet/dotnet-build@v2 | ||
| with: | ||
| uploadBuildArtifact: false | ||
|
|
||
| - name: Finalize CodeQL SAST Analysis | ||
| uses: codebeltnet/codeql-scan-finalize@v1 | ||
| name: call-codeql | ||
| needs: [build,test] | ||
| uses: codebeltnet/jobs-codeql/.github/workflows/default.yml@v1 | ||
| permissions: | ||
| security-events: write | ||
|
|
There was a problem hiding this comment.
Ensure CodeQL job retains read access
Currently, the codeql job’s permissions block lists only security-events: write. Because job-level permissions override the global ones, this removes the default contents: read, which CodeQL requires to scan the repository. Update it as follows:
codeql:
name: call-codeql
needs: [build,test]
uses: codebeltnet/jobs-codeql/.github/workflows/default.yml@v1
- permissions:
- security-events: write
+ permissions:
+ contents: read
+ security-events: write
+ secrets: inherit📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| codeql: | |
| name: 🛡️ Security Analysis | |
| needs: [prepare_linux, build, test] | |
| runs-on: ubuntu-22.04 | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: codebeltnet/git-checkout@v1 | |
| - name: Install .NET | |
| uses: codebeltnet/install-dotnet@v1 | |
| with: | |
| includePreview: true | |
| - name: Restore Dependencies | |
| uses: codebeltnet/dotnet-restore@v2 | |
| with: | |
| useRestoreCache: true | |
| restoreCacheKey: ${{ needs.prepare_linux.outputs.restoreCacheKey }} | |
| - name: Prepare CodeQL SAST Analysis | |
| uses: codebeltnet/codeql-scan@v1 | |
| - name: Download cuemon.snk file | |
| uses: codebeltnet/gcp-download-file@v1 | |
| with: | |
| serviceAccountKey: ${{ secrets.GCP_TOKEN }} | |
| bucketName: ${{ secrets.GCP_BUCKETNAME }} | |
| objectName: cuemon.snk | |
| - name: Build | |
| uses: codebeltnet/dotnet-build@v2 | |
| with: | |
| uploadBuildArtifact: false | |
| - name: Finalize CodeQL SAST Analysis | |
| uses: codebeltnet/codeql-scan-finalize@v1 | |
| name: call-codeql | |
| needs: [build,test] | |
| uses: codebeltnet/jobs-codeql/.github/workflows/default.yml@v1 | |
| permissions: | |
| security-events: write | |
| codeql: | |
| name: call-codeql | |
| needs: [build,test] | |
| uses: codebeltnet/jobs-codeql/.github/workflows/default.yml@v1 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| secrets: inherit |
🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 255-255: too few spaces after comma
(commas)
🤖 Prompt for AI Agents
In .github/workflows/pipelines.yml around lines 253 to 259, the codeql job's
permissions only specify 'security-events: write', which overrides and removes
the default 'contents: read' permission needed by CodeQL to scan the repository.
To fix this, add 'contents: read' alongside 'security-events: write' in the
permissions block to ensure CodeQL retains the necessary read access.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
.github/workflows/pipelines.yml (1)
256-260: Ensure CodeQL job retains required permissions and secrets
The current block overrides the globalcontents: read, leaving onlysecurity-events: write. CodeQL needs repository read access and generally requiressecrets: inherit. Please add:codeql: uses: codebeltnet/jobs-codeql/...@v1 - permissions: - security-events: write + permissions: + contents: read + security-events: write + secrets: inherit🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 257-257: too few spaces after comma
(commas)
🧹 Nitpick comments (2)
.github/workflows/pipelines.yml (2)
263-275: Simplifyconfigurationfallback logic in deploy job
Sinceconfigurationhas a default ofReleaseinworkflow_dispatch, the ternary check is redundant. You can simplify:- configuration: ${{ inputs.configuration == '' && 'Release' || inputs.configuration }} + configuration: ${{ inputs.configuration }}This reduces complexity without changing behavior.
🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 265-265: too few spaces after comma
(commas)
[warning] 265-265: too few spaces after comma
(commas)
[warning] 265-265: too few spaces after comma
(commas)
[warning] 265-265: too few spaces after comma
(commas)
[warning] 265-265: too few spaces after comma
(commas)
237-237: Add spaces after commas in list syntax
YAML lint warns about missing spaces after commas in inline lists. Please update for readability and lint compliance:-needs: [build,test] +needs: [build, test]-needs: [build,pack,test,sonarcloud,codecov,codeql] +needs: [build, pack, test, sonarcloud, codecov, codeql]Apply similarly at lines 248 and 257.
Also applies to: 248-248, 257-257, 265-265
🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 237-237: too few spaces after comma
(commas)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/pipelines.yml(5 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
.github/workflows/pipelines.yml
[warning] 237-237: too few spaces after comma
(commas)
[warning] 248-248: too few spaces after comma
(commas)
[warning] 257-257: too few spaces after comma
(commas)
[warning] 265-265: too few spaces after comma
(commas)
[warning] 265-265: too few spaces after comma
(commas)
[warning] 265-265: too few spaces after comma
(commas)
[warning] 265-265: too few spaces after comma
(commas)
[warning] 265-265: too few spaces after comma
(commas)
🔇 Additional comments (7)
.github/workflows/pipelines.yml (7)
21-23: Global permissions for repository contents
Adding a minimal globalcontents: readpermission aligns with the principle of least privilege and ensures jobs can access repository files as needed.
27-27: Upgrade Linux runner to Ubuntu 24.04
Updatingprepare_linuxto useubuntu-24.04ensures we’re on a more current, secure, and feature-complete runner.
69-69: Upgrade Build job runner to Ubuntu 24.04
Aligning thebuildjob’s runner with the latest LTS version helps maintain compatibility and security.
162-162: Upgrade Pack job runner to Ubuntu 24.04
Switching thepackjob toubuntu-24.04keeps the pipeline consistent and up-to-date.
191-191: Upgrade Test matrix to Ubuntu 24.04
Updating the test matrix OS to includeubuntu-24.04ensures tests run on the latest environment.
236-244: Verify SonarCloud reusable workflow configuration
You’ve correctly replaced inline steps withuses: codebeltnet/jobs-sonarcloud. Please confirm that theorganization: geekleandprojectKey: Cuemonvalues match your SonarCloud setup.🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 237-237: too few spaces after comma
(commas)
247-253: Verify Codecov reusable workflow inputs
The job now callscodebeltnet/jobs-codecovwithrepository: gimlichael/Cuemon. Ensure this identifier matches the Codecov project slug.🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 248-248: too few spaces after comma
(commas)
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #120 +/- ##
=======================================
Coverage 80.17% 80.17%
=======================================
Files 596 596
Lines 18513 18513
Branches 1902 1902
=======================================
Hits 14843 14843
Misses 3599 3599
Partials 71 71 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
.github/workflows/pipelines.yml (1)
193-199:⚠️ Potential issueMissing
contents: readin CodeQL job permissions
Settingpermissionsat the job level overrides the global workflow permissions, removingcontents: readwhich CodeQL requires to scan the repository. Please update as follows:codeql: name: call-codeql needs: [build,test] uses: codebeltnet/jobs-codeql/.github/workflows/default.yml@v1 - permissions: - security-events: write + permissions: + contents: read + security-events: write + secrets: inheritThis ensures CodeQL retains repository read access and inherits necessary secrets.
🧹 Nitpick comments (1)
.github/workflows/pipelines.yml (1)
202-214: Simplify configuration input fallback
The expression${{ inputs.configuration == '' && 'Release' || inputs.configuration }}is redundant because theconfigurationinput already defaults toRelease. You can simplify to:- configuration: ${{ inputs.configuration == '' && 'Release' || inputs.configuration }} + configuration: ${{ inputs.configuration }}This reduces complexity and improves readability.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/pipelines.yml(4 hunks)
🔇 Additional comments (10)
.github/workflows/pipelines.yml (10)
21-23: Global minimal permissions set
Good adoption of least privilege by granting onlycontents: readat the workflow level. This establishes a secure default for all jobs.
27-27: Runner updated for Linux preparation
Updatingprepare_linuxtoubuntu-24.04ensures you're on the latest LTS with security patches. Confirmed compatibility with your .NET installers.
67-73: Newprepare_testjob for test matrix generation
Separating test-project discovery into its own job is a solid move—improves clarity and reusability. Ensure thejsonoutput is consumed correctly downstream (you do fromneeds.prepare_test.outputs.json).
83-97: Build job now leverages a reusable workflow
Switching tocodebeltnet/jobs-dotnetcentralizes your .NET build logic. Verify that the external workflow supports therestore-cache-keyandstrong-name-key-filenameinputs and handles your GCP secrets as expected.
100-100: Runner updated for packaging
Changingpackto run onubuntu-24.04aligns it with other jobs—consistent environments reduce surprise issues.
125-125: Test job dependencies extended
Includingprepare_testalongside the existingbuild,prepare_linux, andprepare_windowsensures your test matrix is generated before execution.
129-129: Test matrix OS updated
Switching theosentries to includeubuntu-24.04standardizes the Linux runner across jobs.
131-131: Matrixprojectsource switched
Consuming${{ fromJson(needs.prepare_test.outputs.json) }}correctly ties your test projects to the generated matrix—great decoupling.
174-183: SonarCloud call consolidated via reusable workflow
Refactoring tocodebeltnet/jobs-sonarcloudcentralizes analysis steps. Inputs and token mapping look correct.
185-192: Codecov call consolidated via reusable workflow
Switching tocodebeltnet/jobs-codecovcleans up inline steps. TherepositoryandCODECOV_TOKENinputs are properly wired.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
.github/workflows/pipelines.yml (1)
181-187: Ensure CodeQL retains read access to repository
Job-level permissions override the global scope. Thecodeqljob currently only grantssecurity-events: write, which strips away the requiredcontents: read. Please update as follows:permissions: - security-events: write + contents: read + security-events: write + secrets: inherit
🧹 Nitpick comments (1)
.github/workflows/pipelines.yml (1)
67-72: Validate generated test project matrix
Consider adding a validation step to ensuresteps.test-projects.outputs.resultis a non-empty JSON array before it's consumed in thetestjob matrix. This will fail fast if no test projects are discovered.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/pipelines.yml(3 hunks)
🔇 Additional comments (8)
.github/workflows/pipelines.yml (8)
21-23: Global permissions added
The workflow now grantscontents: readat the global level, ensuring all jobs have repository read access by default.
83-97: Use reusable workflow for build
The shift tocodebeltnet/jobs-dotnet-buildwith a streamlined matrix and explicit secrets is well done. It centralizes build logic and reduces inline duplication.
98-110: Use reusable workflow for packaging
Replacing inline pack steps withcodebeltnet/jobs-dotnet-packenhances maintainability and keeps versioning/artefact logic consistent across projects.
113-120: Consume test matrix from prepare_test
Thetestjob correctly references${{ fromJson(needs.prepare_test.outputs.json) }}for itsprojectmatrix. The updated dependency chain and matrix restructuring align well with the new prepare phase.
162-170: Use reusable workflow for SonarCloud analysis
Leveragingcodebeltnet/jobs-sonarcloudensures consistency in static analysis and reduces maintenance overhead in this repository.
173-180: Use reusable workflow for Codecov
The migration tocodebeltnet/jobs-codecovcorrectly encapsulates coverage reporting, making the workflow more concise.
190-202: Use reusable workflow for NuGet deployment
Switching tocodebeltnet/jobs-nuget-pushwith scoped permissions (contents: write,packages: write) and an explicit PR guard (if: github.event_name != 'pull_request') is a solid improvement.
27-27:Details
✅ Verification successful
Runner version upgrade: verify
ubuntu-24.04support
Multiple jobs now targetubuntu-24.04. Please confirm that GitHub Actions currently supportsubuntu-24.04as a hosted runner label before merging.Also applies to: 117-117
🌐 Web query:
Does GitHub Actions support the 'ubuntu-24.04' runner label?💡 Result:
GitHub Actions Support for
ubuntu-24.04Runner LabelYes, GitHub Actions supports the
ubuntu-24.04runner label.
- As of September 2024, the Ubuntu 24.04 image is generally available (GA) for all users on GitHub Actions. You can select it in your workflow by specifying
runs-on: ubuntu-24.04in your YAML file[2][4]."The Ubuntu 24.04 image for Actions is now generally available. To use Ubuntu 24 directly on your GitHub-hosted runners update runs-on: in your workflow file to ubuntu-24.04."[4]
- The
ubuntu-24.04label is fully supported and is no longer in preview. Using this label ensures that your job runs on a virtual machine provisioned with Ubuntu 24.04 LTS[2][4].- There are changes in the set of pre-installed software tools on this image compared to previous versions (such as Ubuntu 22.04), so you should review and test your workflows for compatibility, especially if you depend on certain pre-installed packages[2][5].
Upcoming Default:
- The
ubuntu-latestlabel will be migrating to use Ubuntu 24.04 as its default version between September and October 2024, and the rollout is expected to complete by January 2025[1][4][5].- Until that migration is complete, both
ubuntu-22.04andubuntu-24.04will be available as explicit image labels[1][5].How to Use:
jobs: build: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@v4 - name: Build run: make buildThis will ensure your job runs on an Ubuntu 24.04 VM[4].
Summary Table
Label Supported Notes ubuntu-24.04 Yes Generally available, use explicitly in workflows[2][4] ubuntu-latest Yes Will point to 24.04 by Jan 2025[1][4][5] ubuntu-22.04 Yes Still supported; maintained for two more years[1][5] Recommendation:
If you want to specify Ubuntu 24.04 explicitly for your workflows, you can safely useruns-on: ubuntu-24.04today[2][4]. If you useubuntu-latest, be aware it will soon point to Ubuntu 24.04 as the migration completes. Review your workflows for compatibility with the new image, as some pre-installed packages may differ or be missing compared to prior LTS images[5].Citations:
- 1: actions/runner-images#10636
- 2: actions/runner-images#9848
- 3: https://github.com/actions/actions-runner-controller/pull/3598/files
- 4: https://github.blog/changelog/2024-09-25-actions-new-images-and-ubuntu-latest-changes/
- 5: https://dev.to/siddhantkcode/critical-changes-coming-to-github-actions-ubuntu-24-migration-guide-oo8
- 6: https://github.blog/changelog/2022-11-09-github-actions-ubuntu-latest-workflows-will-use-ubuntu-22-04/
- 7: https://depot.dev/docs/github-actions/runner-types
- 8: https://discourse.ubuntu.com/t/psa-for-folks-using-python-in-github-action-runners-and-ubuntu-latest-label/48654
- 9: https://docs.github.com/en/actions/using-github-hosted-runners/using-github-hosted-runners/about-github-hosted-runners
- 10: https://github.com/actions/runner/discussions/3607
Runner version upgrade:
ubuntu-24.04support confirmed
GitHub Actions added GA support for theubuntu-24.04runner label in September 2024. You can safely useruns-on: ubuntu-24.04in your workflows. Please continue to review and test your jobs for any compatibility changes in the pre-installed toolchain.• Files and locations:
- .github/workflows/pipelines.yml, line 27
- .github/workflows/pipelines.yml, line 117
No further changes required.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/pipelines.yml (1)
193-199: Retain contents: read for CodeQL
Job-level permissions override global ones. You still needcontents: readalongsidesecurity-events: write(and ideallysecrets: inherit) for CodeQL to scan the repository.
🧹 Nitpick comments (3)
.github/workflows/pipelines.yml (3)
85-87: Debug JSON output step
Theechostep prints the JSON to logs but does not affect job outputs. If this is only for debugging, consider removing it once the matrix is validated to reduce noise.
145-147: Inconsistent .NET installer versions
Most jobs useinstall-dotnet@v1, but integration tests useinstall-dotnet@v2. Consider standardizing onv2for all to leverage the latest features and consistency.
202-208: Refactor deploy to reusable NuGet push job
Converting tocodebeltnet/jobs-nuget-pushclarifies deployment.The
configurationfallback expression is redundant—inputs.configurationalready defaults toRelease. You can simplify to:configuration: ${{ inputs.configuration }}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/pipelines.yml(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: call-build (Debug) / 🛠️ Build
- GitHub Check: call-build (Release) / 🛠️ Build
🔇 Additional comments (14)
.github/workflows/pipelines.yml (14)
21-23: Global read permissions added
Grantingcontents: readat the workflow level is a solid security improvement and provides the default access needed by most jobs.
27-27: Upgrade Linux runner to ubuntu-24.04
This aligns with the objective to modernize the CI environment. Ensure any OS-specific steps are compatible with the new runner.
67-73: Introduce Prepare Test job for matrix generation
The newprepare_testjob cleanly separates test discovery by emitting a JSON matrix of project paths. Ensure thejsonoutput is consumed correctly by downstream jobs.
81-83: Exclude specific test project in pattern
Using!test/**/Cuemon.Data.SqlClient.Tests.csprojcorrectly filters out the undesired project. Confirm the globbing action supports exclusion patterns as shown.
88-94: Refactor build to reusable workflow
Switching tocodebeltnet/jobs-dotnet-buildand reducing the matrix to onlyconfigurationsimplifies maintenance. Ensure the reusable workflow uses the intended runner version under the hood or document any difference.
95-101: Pass restore cache key and GCP secrets to build
Supplyingrestore-cache-key,GCP_TOKEN, andGCP_BUCKETNAMEcorrectly wires up caching and artifact staging. Double-check that the secret names match those in the repo settings.
103-109: Refactor pack to reusable workflow
Offloading packaging tocodebeltnet/jobs-dotnet-packmakes the job definition much cleaner. Verify thatupload-packed-artifact: truehas the desired effect in your release pipeline.
110-114: Ensure version and cache inputs for pack
Passingversionfrom build output and reusing the cache key is correct. Confirm thatversionaligns with your NuGet package versioning strategy.
117-125: Use test matrix with prepare_test output
Matrixing overfromJson(needs.prepare_test.outputs.json)dynamically drives test coverage. The OS and configuration axes look good, but read on regarding cache resolution.
131-139: Add integration_test job for SQL-backed tests
Introducingintegration_testprovides valuable end-to-end coverage against a live SQL Server container. Ensure your Docker-Compose and connection strings align with the test schema.
164-164: Verify action input name for cache key
Thedotnet-test@v3step usesrestoreCacheKey:as its input. Confirm this matches the action’srestore-cache-keyparameter naming exactly; otherwise, caching may silently fail.
174-181: Replace SonarCloud inline steps with reusable workflow
Delegating tocodebeltnet/jobs-sonarcloudstreamlines CI. Ensure theorganizationandprojectKeymatch your SonarCloud setup.
185-191: Replace Codecov inline steps with reusable workflow
Usingcodebeltnet/jobs-codecovreduces duplication. Verify thatgimlichael/Cuemonis the correct Codecov project slug.
209-213: Grant write permissions for deployment
Assigningcontents: writeandpackages: writealigns with NuGet push requirements. EnsureNUGET_TOKENhas the necessary scope.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/pipelines.yml (1)
194-199:⚠️ Potential issueRestore CodeQL
contents: readpermission
Job-levelpermissionsoverride the global defaults, so the CodeQL job currently lackscontents: read—required for repository scanning. Please update to:codeql: uses: codebeltnet/jobs-codeql/...@v1 - permissions: - security-events: write + permissions: + contents: read + security-events: write + secrets: inheritThis will restore read access and inherit necessary secrets.
🧹 Nitpick comments (2)
.github/workflows/pipelines.yml (2)
85-86: Optional: Remove debugging echo or clarify its purpose
TheJSON outputstep simply echoes the matrix payload. If this is for debugging, consider removing it in production or renaming it (e.g., “Debug: show test projects”) to avoid confusion.
202-213: Simplify configuration input expression
Sinceinputs.configurationalready has a default (Release), the conditional inconfiguration: ${{ inputs.configuration == '' && 'Release' || inputs.configuration }}is redundant. You can simplify to:
configuration: ${{ inputs.configuration }}This makes the pipeline more readable.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Cache: Disabled due to data retention organization setting
Knowledge Base: Disabled due to data retention organization setting
📒 Files selected for processing (1)
.github/workflows/pipelines.yml(3 hunks)
🔇 Additional comments (10)
.github/workflows/pipelines.yml (10)
21-23: Add workflow-level minimal permissions
Globalpermissionsblock now restricts default access tocontents: read, which is a good security measure to enforce least privilege.
27-27: Update runner to Ubuntu 24.04
Changing theprepare_linuxjob toruns-on: ubuntu-24.04aligns with our goal to use the latest LTS environment.
67-73: Introduceprepare_testjob to generate test matrix
The newprepare_testjob cleanly produces a JSON list of test projects viashell-globbing, outputs it, and runs on Ubuntu 24.04. The step IDs and outputs appear correctly wired (steps.test-projects.outputs.result→outputs.json).
79-84: Validate glob pattern for test project discovery
You’re usingcodebeltnet/shell-globbing@v2with an include/exclude pattern. Please verify that:
- The action supports multi-line
patternwith!exclusions.- The resulting JSON array excludes
Cuemon.Data.SqlClient.Tests.csprojas intended.
Can you run a dry-run to confirm the output matches expectations?
88-101: Review build job matrix on reusable workflow
Switching to thecodebeltnet/jobs-dotnet-buildreusable workflow simplifies maintenance. Ensure that GH Actions supports astrategy.matrixwhen calling a reusable workflow job, and that thestrong-name-key-filename,restore-cache-key, andsecretsinputs map correctly. Consider validating matrix expansion locally or via a dry-run.
103-115: Review pack job with reusable workflow and artifact upload
Refactoringpackto usejobs-dotnet-packis consistent. Please verify that:
- The
upload-packed-artifact: trueflag triggers the expected artifact behavior.- The
versioninput fromneeds.build.outputs.versionflows correctly.- The matrix execution works as expected on both Debug and Release.
[Test a CI pipeline run to confirm.]
146-146: Upgrade .NET installer action to v2
Updatingcodebeltnet/install-dotnetto v2 in the integration tests is a good modernization—ensure v2 supports the same inputs (includePreviewusage).
164-164: VerifyrestoreCacheKeykey naming consistency
In integration tests you passrestoreCacheKey, whereas other jobs userestore-cache-key. Please confirm the reusablejobs-dotnet-testworkflow expects the camelCase input in this context, or harmonize the property name.
174-182: Use reusable SonarCloud workflow
Refactoring tocodebeltnet/jobs-sonarcloudwith explicitorganization,projectKey, andversioninputs is clean and DRY.
185-191: Use reusable Codecov workflow
The switch tocodebeltnet/jobs-codecovwith therepositoryinput and token secret appropriately scoped enhances maintainability.
| name: call-test | ||
| needs: [build, prepare_test, prepare_linux, prepare_windows] | ||
| strategy: | ||
| fail-fast: false | ||
| matrix: | ||
| os: [ubuntu-24.04, windows-2022] | ||
| configuration: [Debug, Release] | ||
| project: ${{ fromJson(needs.prepare_test.outputs.json) }} | ||
| uses: codebeltnet/jobs-dotnet-test/.github/workflows/default.yml@v1 | ||
| with: | ||
| configuration: ${{ matrix.configuration }} | ||
| projects: ${{ matrix.project }} | ||
| restore-cache-key: ${{ matrix.os == 'Linux' && needs.prepare_linux.outputs.restoreCacheKey || needs.prepare_windows.outputs.restoreCacheKey }} | ||
|
|
There was a problem hiding this comment.
Fix OS-based cache key resolution
The expression
restore-cache-key: ${{ matrix.os == 'Linux' && needs.prepare_linux.outputs.restoreCacheKey || needs.prepare_windows.outputs.restoreCacheKey }}will never match (matrix.os is ubuntu-24.04 or windows-2022). As a result, Linux runs use the Windows cache.
Apply this diff:
- restore-cache-key: ${{ matrix.os == 'Linux' && needs.prepare_linux.outputs.restoreCacheKey || needs.prepare_windows.outputs.restoreCacheKey }}
+ restore-cache-key: ${{ (startsWith(matrix.os, 'ubuntu') && needs.prepare_linux.outputs.restoreCacheKey) || needs.prepare_windows.outputs.restoreCacheKey }}This ensures the correct cache key is selected per OS.
🤖 Prompt for AI Agents
In .github/workflows/pipelines.yml around lines 117 to 130, the
restore-cache-key expression incorrectly compares matrix.os to 'Linux', which
never matches since matrix.os values are 'ubuntu-24.04' or 'windows-2022'.
Update the condition to check if matrix.os starts with 'ubuntu' or equals
'ubuntu-24.04' to correctly select the Linux cache key; otherwise, use the
Windows cache key. This will ensure the proper cache key is used based on the
actual OS in the matrix.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (2)
.github/workflows/pipelines.yml (2)
197-199: Ensure CodeQL retains read access
Definingpermissionsat the job scope overrides the global defaults—currently onlysecurity-events: writeis set, which strips away the requiredcontents: read.Please update to:
permissions: + contents: read security-events: write secrets: inherit
130-130:⚠️ Potential issueFix OS-based cache-key resolution
The expression still checksmatrix.os == 'Linux', but the matrix values are nowubuntu-24.04andwindows-2022. This logic will never select the Linux cache key.Apply one of the following diffs to correct the condition:
- restore-cache-key: ${{ matrix.os == 'Linux' && needs.prepare_linux.outputs.restoreCacheKey || needs.prepare_windows.outputs.restoreCacheKey }} + restore-cache-key: ${{ (startsWith(matrix.os, 'ubuntu') && needs.prepare_linux.outputs.restoreCacheKey) || needs.prepare_windows.outputs.restoreCacheKey }}
🧹 Nitpick comments (1)
.github/workflows/pipelines.yml (1)
146-146: Aligninstall-dotnetaction versions
You're usinginstall-dotnet@v2inintegration_testwhileprepare_linuxuses@v1. For consistency and reproducible environments, consider standardizing on one version (or document the need for v2 here).
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/pipelines.yml(3 hunks)
🔇 Additional comments (7)
.github/workflows/pipelines.yml (7)
21-23: Global workflow permissions set appropriately
Adding a workflow-levelpermissions: contents: readensures all jobs retain minimal read access unless overridden downstream. This aligns with least-privilege security best practices.
27-27: Upgrade Linux runner to Ubuntu 24.04
Bumpingruns-ontoubuntu-24.04inprepare_linuxkeeps the environment current and secure.
67-73: Decouple test discovery into a dedicated job
Introducingprepare_testto glob and output test projects is a good separation of concerns. ExcludingCuemon.Data.SqlClient.Tests.csprojat glob-time simplifies downstream matrix logic.
89-99: Leverage reusable workflow for build
Replacing the inline multi-framework build withjobs-dotnet-buildreduces duplication and centralizes versioning, caching, and signing logic in a single, shareable workflow.
103-114: Leverage reusable workflow for packing artifacts
Thejobs-dotnet-packcall streamlines packaging logic and ensures consistency across projects. Passingversion,restore-cache-key, andupload-packed-artifactflags is clear and complete.
174-182: Use reusable workflow for SonarCloud analysis
Switching tojobs-sonarcloudwith explicitorganization,projectKey, andversioninputs cleans up the pipeline and centralizes SonarCloud configuration.
185-192: Use reusable workflow for Codecov reporting
Invokingjobs-codecovwith the repository input and token secret reduces inline scripting and promotes consistency in coverage reporting.
There was a problem hiding this comment.
Actionable comments posted: 0
🔭 Outside diff range comments (1)
.github/workflows/pipelines.yml (1)
132-166:⚠️ Potential issueCorrect integration_test restore-cache-key input
Theintegration_teststep usesrestoreCacheKey(camelCase) but the reusable test action expectsrestore-cache-key(kebab-case) for cache restoration:- restoreCacheKey: ${{ needs.prepare_linux.outputs.restoreCacheKey }} + restore-cache-key: ${{ needs.prepare_linux.outputs.restoreCacheKey }}This ensures the cache key is passed correctly to the
dotnet-testaction.
♻️ Duplicate comments (2)
.github/workflows/pipelines.yml (2)
198-199: Restore contents: read for CodeQL job
Addingcontents: readalongsidesecurity-events: writeis necessary since job-level permissions override the global scope, and CodeQL needs read access:codeql: permissions: - security-events: write + contents: read + security-events: write
130-131:⚠️ Potential issueFix cache-key OS check
The expressionmatrix.os == 'Linux'will never match (matrix.osis'ubuntu-24.04'or'windows-2022'). Please update it, for example:- restore-cache-key: ${{ matrix.os == 'Linux' && needs.prepare_linux.outputs.restoreCacheKey || needs.prepare_windows.outputs.restoreCacheKey }} + restore-cache-key: ${{ (startsWith(matrix.os, 'ubuntu') && needs.prepare_linux.outputs.restoreCacheKey) || needs.prepare_windows.outputs.restoreCacheKey }}
🧹 Nitpick comments (1)
.github/workflows/pipelines.yml (1)
203-214: Simplify deploy configuration expression
The conditionalinputs.configuration == '' && 'Release' || inputs.configurationis redundant given the default is alreadyRelease. You can simplify to:- configuration: ${{ inputs.configuration == '' && 'Release' || inputs.configuration }} + configuration: ${{ inputs.configuration }}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/pipelines.yml(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: call-build (Debug) / 🛠️ Build
- GitHub Check: call-build (Release) / 🛠️ Build
🔇 Additional comments (8)
.github/workflows/pipelines.yml (8)
21-23: Approve global permissions addition
Addingcontents: readat the workflow level is a good baseline for repository access.
27-27: Upgrade Ubuntu runner for Linux preparation
Updating theruns-onfromubuntu-22.04toubuntu-24.04ensures compatibility with the latest OS features and security patches.
67-86: New prepare_test job for dynamic test matrix
Theprepare_testjob correctly discovers and outputs the CSProj test projects (excluding the SQL client tests) as JSON for downstream matrix usage.
88-102: Refactor build to reusable workflow
Switching the build job tocodebeltnet/jobs-dotnet-buildimproves maintainability and DRYness. Inputs and secrets look properly configured.
103-114: Refactor pack to reusable workflow
Thepackjob now calls the centralizedjobs-dotnet-packworkflow with the correct inputs for configuration, version, and cache key.
117-129: Restructure test job to reusable workflow
Good separation of concerns: thetestjob now leverages thejobs-dotnet-testworkflow with a matrix over OS, configuration, and dynamically generated projects.
175-183: Approve sonarcloud job refactor
Thesonarcloudjob is correctly replaced with thejobs-sonarcloudreusable workflow, passing the organization, project key, version, andSONAR_TOKEN.
185-192: Approve codecov job refactor
Thecodecovjob now uses the centralizedjobs-codecovworkflow with the proper repository and token inputs.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/pipelines.yml (1)
195-200:⚠️ Potential issueRestore
contents: readfor CodeQL job
Job-levelpermissionsoverride the global settings, so omittingcontents: readhere prevents CodeQL from scanning the repository. Please include it alongsidesecurity-events: write, and re-addsecrets: inheritif needed:codeql: name: call-codeql needs: [build,test,integration_test] uses: codebeltnet/jobs-codeql/.github/workflows/default.yml@v1 - permissions: - security-events: write + permissions: + contents: read + security-events: write + secrets: inherit
🧹 Nitpick comments (2)
.github/workflows/pipelines.yml (2)
130-130: Make OS check more resilient
Strictly comparingmatrix.os == 'ubuntu-24.04'will break if the runner name changes in future (e.g.,ubuntu-25.04). Consider using:restore-cache-key: ${{ (startsWith(matrix.os, 'ubuntu-') && needs.prepare_linux.outputs.restoreCacheKey) || needs.prepare_windows.outputs.restoreCacheKey }}
147-147: Align .NET installer versions across jobs
Integration tests useinstall-dotnet@v2while prep jobs use@v1. For consistency and to leverage bug fixes, consider upgrading all.NETinstall steps tov2.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/pipelines.yml(3 hunks)
🔇 Additional comments (11)
.github/workflows/pipelines.yml (11)
21-23: Global workflow-level permissions added correctly
Grantingcontents: readat the workflow root ensures all jobs retain default repository read access without needingactions/checkoutoverrides.
27-27: Runner upgraded for Prepare Linux job
Switching toubuntu-24.04keeps the build environment current with the latest security patches.
67-73: Newprepare_testjob for dynamic test matrix
Introducing a lightweight job to glob test projects and output JSON simplifies the test matrix generation. Outputs are correctly wired for downstream consumption.
79-83: Globbing step configured correctly
The include/exclude patterns incodebeltnet/shell-globbing@v2will yield all*.csprojundertest/except the SQL client tests, which matches the PR objectives.
85-87: Echo step for JSON debugging
Printing${{ steps.test-projects.outputs.result }}to logs is useful for validating the matrix payload.
94-101: Build job refactored to reusable workflow
Replacing multi-framework inline steps withcodebeltnet/jobs-dotnet-buildcentralizes logic and reduces duplication. Inputs and secrets are correctly mapped.
103-114: Pack job refactored to reusable workflow
Leveragingcodebeltnet/jobs-dotnet-packsimplifies packaging. Theupload-packed-artifactand cache-key inputs are correctly passed through.
117-124: Test job now calls reusable workflow with updated matrix
- Runs on
ubuntu-24.04andwindows-2022as intended.- Projects sourced from the new
prepare_testoutput.- Fail-fast disabled to collect all test results.
175-183: SonarCloud job refactored to reusable workflow
Switching tocodebeltnet/jobs-sonarcloudcentralizes your Sonar integration. Organization, project key, and version are correctly passed, andSONAR_TOKENis scoped undersecrets.
185-193: Codecov job refactored to reusable workflow
Usingcodebeltnet/jobs-codecovsimplifies coverage reporting. Therepositoryinput andCODECOV_TOKENsecret are correctly provided.
203-214: Deploy job refactored to reusable workflow
Callingcodebeltnet/jobs-nuget-pushwith the correct inputs (version,environment,configuration) and permissions (contents: write,packages: write) streamlines your NuGet publish process.
| restoreCacheKey: ${{ runner.os == 'Linux' && needs.prepare_linux.outputs.restoreCacheKey || needs.prepare_windows.outputs.restoreCacheKey }} | ||
| buildSwitches: ${{ contains(matrix.project, 'Cuemon.Extensions.Globalization.Tests') && '-p:SkipSignAssembly=false' || '-p:SkipSignAssembly=true' }} | ||
| testArguments: -- RunConfiguration.DisableAppDomain=true | ||
| restoreCacheKey: ${{ needs.prepare_linux.outputs.restoreCacheKey }} |
There was a problem hiding this comment.
Input name casing mismatch on restore key
The integration_test step uses restoreCacheKey, but all other reusable workflows expect restore-cache-key (hyphenated). This will likely cause a missing-input failure.
Please update it to:
- restoreCacheKey: ${{ needs.prepare_linux.outputs.restoreCacheKey }}
+ restore-cache-key: ${{ needs.prepare_linux.outputs.restoreCacheKey }}🤖 Prompt for AI Agents
In .github/workflows/pipelines.yml at line 165, the input name for the restore
cache key is incorrectly cased as restoreCacheKey, but it should be
restore-cache-key with hyphens to match the expected input name in other
reusable workflows. Change restoreCacheKey to restore-cache-key to fix the input
name casing mismatch and prevent missing-input failures.
|
This pull request updates the GitHub Actions workflow in
.github/workflows/pipelines.ymlto modernize the environment, streamline job definitions, and enhance maintainability by reusing shared workflows. The most significant changes include upgrading the Ubuntu runner version, replacing inline job definitions with reusable workflows, and introducing additional permissions for specific jobs.Environment Updates:
ubuntu-22.04toubuntu-24.04across all jobs to ensure compatibility with the latest features and security updates. ([[1]](https://github.com/codebeltnet/cuemon/pull/120/files#diff-c40697b077557a99813200fa892d01ac2d8c5201799193bc34320cd9526ee802R21-R27),[[2]](https://github.com/codebeltnet/cuemon/pull/120/files#diff-c40697b077557a99813200fa892d01ac2d8c5201799193bc34320cd9526ee802L66-R69),[[3]](https://github.com/codebeltnet/cuemon/pull/120/files#diff-c40697b077557a99813200fa892d01ac2d8c5201799193bc34320cd9526ee802L159-R162),[[4]](https://github.com/codebeltnet/cuemon/pull/120/files#diff-c40697b077557a99813200fa892d01ac2d8c5201799193bc34320cd9526ee802L188-R191))Workflow Simplification:
sonarcloud,codecov,codeql, anddeploywith reusable workflows (codebeltnet/jobs-sonarcloud,codebeltnet/jobs-codecov,codebeltnet/jobs-codeql, andcodebeltnet/jobs-nuget), reducing redundancy and improving maintainability. ([.github/workflows/pipelines.ymlL233-R272](https://github.com/codebeltnet/cuemon/pull/120/files#diff-c40697b077557a99813200fa892d01ac2d8c5201799193bc34320cd9526ee802L233-R272))Permissions Enhancements:
contents: readpermissions globally and specific permissions (e.g.,security-events: write,contents: write,packages: write) for jobs likecodeqlanddeployto align with their operational requirements. ([[1]](https://github.com/codebeltnet/cuemon/pull/120/files#diff-c40697b077557a99813200fa892d01ac2d8c5201799193bc34320cd9526ee802R21-R27),[[2]](https://github.com/codebeltnet/cuemon/pull/120/files#diff-c40697b077557a99813200fa892d01ac2d8c5201799193bc34320cd9526ee802L233-R272))Summary by CodeRabbit