fix(ci): modernize build pipeline, restore Dakota E2E, event-driven releases - #598
Conversation
|
Warning Review limit reached
More reviews will be available in 11 minutes and 33 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (6)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Fixes end-of-file-fixer pre-commit hook failure in PR #598. Assisted-by: Claude Sonnet 4.5 via pi Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…eleases - build.yml: fix artifact-based multi-arch digest passing (was using broken matrix job outputs), correct digests-json arch keys (amd64/arm64 not linux/*), pin composites to dc35eb2 (from stale e39c947), add setup-runner for podman upgrade (required for zstd:chunked push), add arm64 build matrix - e2e.yml: restore Dakota matrix entry with continue-on-error: true (image exists at ghcr.io/projectbluefin/dakota:testing; issue #497 is open but non-blocking) - release.yml: add workflow_run trigger on E2E success so releases fire automatically when quality is confirmed, not only on monthly cron - renovate.json: add explicit automerge rule for projectbluefin/actions SHA updates to prevent pin drift across org - .github/actionlint.yaml: suppress false positive for continue-on-error on reusable-workflow callers (GitHub supports it; actionlint does not yet) Assisted-by: Claude Sonnet 4.5 via pi Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
d0683ec to
25df47d
Compare
buildah-build stores the image in podman/buildah local storage but the podman socket is not started by setup-runner. Trivy cannot find the image via docker/containerd/podman sockets. Export to a docker-archive tarball with buildah push, then pass the docker-archive: URI to scan-image — Trivy natively supports this scheme. Assisted-by: Claude Sonnet 4.6 via GitHub Copilot Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
25df47d to
7cf648e
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Fix 3 stale references to lifecycle.yml being in projectbluefin/common (it moved to projectbluefin/actions in #574, issue #570 closed 2026-06-10). Fix bonedigger.md Integration Status to warn agents about stale callers. Fix release-promotion.md 'Known gap: dakota E2E disabled' — restored in #598. Distilled from 2-day session history per end-session skill. Assisted-by: Claude Sonnet 4.5 via pi Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2 participants
Summary
Automation audit follow-up for projectbluefin/common. Four independent improvements committed together as they all emerged from the same factory-wide audit.
build.yml — bug fixes + multi-arch
needs.job.outputs(which only surfaces one non-deterministic matrix run's output)digests-jsonkeys corrected fromlinux/amd64→amd64(create-manifestpasses the key directly topodman manifest add --arch)e39c947→dc35eb2for scan-image, sign-and-publish (2 releases behind rest of factory)setup-runnerstep for podman upgrade — required because build pushes with--compression-format=zstd:chunkedwhich needs podman ≥ 5.xcreate-manifestmanifest job to assemble multi-arch indexe2e.yml — restore Dakota
Dakota matrix entry was commented out.
ghcr.io/projectbluefin/dakota:testingimage exists and is pullable. Restored withcontinue-on-error: true— non-blocking until infra confidence is established (flip to false when ready, see issue #497).release.yml — event-driven releases
Added
workflow_runtrigger on E2E success. When E2E passes on main, release fires automatically if the last release was >20 days ago. Monthly cron remains as backstop. Eliminates the manualworkflow_dispatchneeded when tests were red on the 1st.renovate.json — accelerate actions SHA automerge
Added explicit rule to automerge
projectbluefin/actionsSHA updates. Existing broad rule already covered these in theory but lacked the labels and grouping needed for fast propagation.Part of org-wide automation audit — no ublue-os/* repos touched.