Add GitHub workflows #2
Conversation
|
My review is in progress 📖 - I will have feedback for you in a few minutes! |
👋 Hi there!
The description could be more helpful.
|
|
Warning Rate limit exceeded@guibranco has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 25 minutes and 58 seconds before requesting another review. How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
Potential issues, bugs, and flaws that can introduce unwanted behavior:
Code suggestions and improvements for better exception handling, logic, standardization, and consistency:
|
github-actions
bot
added
the
size/L
![senior-dev-bot[bot]](https://avatars.githubusercontent.com/in/282840?s=60&v=4){kind=small}
| name: Label based on PR size | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| pull_request: | ||
|
|
||
| jobs: | ||
| size-label: | ||
| permissions: write-all | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
|
|
||
| - name: size-label | ||
| uses: "pascalgn/size-label-action@v0.5.2" | ||
| env: | ||
| GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" |
There was a problem hiding this comment.
CODE REVIEW
- Use YAML indentation best practices.
- Add a job name for better readability.
- Remove unnecessary quotes around the
usesdirective.
name: Label based on PR size
on:
workflow_dispatch:
pull_request:
jobs:
size-label:
permissions: write-all
runs-on: ubuntu-latest
steps:
- name: Apply size label
uses: pascalgn/size-label-action@v0.5.2
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}| name: Build | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - '*' | ||
| - '*/*' | ||
| - '**' | ||
| - '!main' | ||
| workflow_dispatch: | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| build: | ||
| name: Build | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Setup .NET | ||
| uses: actions/setup-dotnet@v4 | ||
| with: | ||
| dotnet-version: '7.0.x' | ||
|
|
||
| - name: Build solution | ||
| run: dotnet build -c Debug | ||
|
|
||
| - name: Run tests | ||
| run: dotnet test -c Debug --no-build --no-restore |
There was a problem hiding this comment.
CODE REVIEW
- Branch Patterns: Simplify branch patterns to avoid redundancy.
- Version Lock: Specify exact versions for greater control over dependencies.
- Job Naming: Use more descriptive job names.
Revised code example:
name: Build
on:
push:
branches:
- '**'
- '!main'
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
build:
name: Build and Test on Ubuntu
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Setup .NET
uses: actions/setup-dotnet@v4
with:
dotnet-version: '7.0.400'
- name: Build solution
run: dotnet build -c Debug
- name: Run tests
run: dotnet test -c Debug --no-build --no-restore| name: Infisical secrets check | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| pull_request: | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
|
|
||
| secrets-scan: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
|
|
||
| - name: Checkout repo | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Set Infisical package source | ||
| shell: bash | ||
| run: curl -1sLf 'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | sudo -E bash | ||
|
|
||
| - name: Install Infisical | ||
| shell: bash | ||
| run: | | ||
| sudo apt-get update && sudo apt-get install -y infisical | ||
|
|
||
| - name: Run scan | ||
| shell: bash | ||
| run: infisical scan --redact -f csv -r secrets-result.csv 2>&1 | tee >(sed -r 's/\x1b\[[0-9;]*m//g' > secrets-result.log) | ||
|
|
||
| - name: Read secrets-result.log | ||
| uses: guibranco/github-file-reader-action-v2@v2.2.583 | ||
| if: always() | ||
| id: log | ||
| with: | ||
| path: secrets-result.log | ||
|
|
||
| - name: Read secrets-result.log | ||
| uses: guibranco/github-file-reader-action-v2@v2.2.583 | ||
| if: failure() | ||
| id: report | ||
| with: | ||
| path: secrets-result.csv | ||
|
|
||
| - name: Update PR with comment | ||
| uses: mshick/add-pr-comment@v2 | ||
| if: always() | ||
| with: | ||
| refresh-message-position: true | ||
| message-id: 'secrets-result' | ||
| message: | | ||
| **Infisical secrets check:** :white_check_mark: No secrets leaked! | ||
|
|
||
| **Scan results:** | ||
| ``` | ||
| ${{ steps.log.outputs.contents }} | ||
| ``` | ||
|
|
||
| message-failure: | | ||
| **Infisical secrets check:** :rotating_light: Secrets leaked! | ||
|
|
||
| **Scan results:** | ||
| ``` | ||
| ${{ steps.log.outputs.contents }} | ||
| ``` | ||
| **Scan report:** | ||
| ``` | ||
| ${{ steps.report.outputs.contents }} | ||
| ``` | ||
| message-cancelled: | | ||
| **Infisical secrets check:** :o: Secrets check cancelled! |
There was a problem hiding this comment.
CODE REVIEW
Feedback:
- Consolidate duplicated steps to reduce redundancy.
- Use a consistent indentation for better readability.
Improvements:
- Combine duplicate
Read secrets-result.logsteps. - Enhance message distinction using GitHub Actions condition variables.
- name: Read secrets-result.log
uses: guibranco/github-file-reader-action-v2@v2.2.583
if: always()
id: log
with:
path: secrets-result.log
- name: Read secrets-result.csv
uses: guibranco/github-file-reader-action-v2@v2.2.583
if: failure()
id: report
with:
path: secrets-result.csv| name: Linter check | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| pull_request: | ||
|
|
||
| jobs: | ||
| linter-check: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
|
|
||
| - name: Checkout repo | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup .NET | ||
| uses: actions/setup-dotnet@v4 | ||
|
|
||
| - name: Dotnet restore | ||
| run: dotnet tool restore | ||
|
|
||
| - name: CSharpier format check | ||
| run: | | ||
| dotnet csharpier . --check | ||
| echo "run 'dotnet build' to fix the formatting of the code automatically" |
There was a problem hiding this comment.
CODE REVIEW
-
Consistency in action versions: While
actions/checkoutuses versionv4,setup-dotnetshould use the same versioning format. Prefer@v2wherever possible. -
Fail-fast approach: The echo message should be displayed only when formatting check fails.
-
Naming consistency: Use consistent naming conventions for steps.
name: Linter check
on:
workflow_dispatch:
pull_request:
jobs:
linter-check:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup .NET environment
uses: actions/setup-dotnet@v2
- name: Restore .NET tools
run: dotnet tool restore
- name: Check CSharpier formatting
run: |
dotnet csharpier . --check || echo "Run 'dotnet build' to automatically fix the formatting of the code."| version: 2 | ||
|
|
||
| updates: | ||
| - package-ecosystem: "nuget" | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 50 | ||
| assignees: | ||
| - "guibranco" | ||
| reviewers: | ||
| - "guibranco" | ||
| labels: | ||
| - "nuget" | ||
| - ".NET" | ||
| - "packages" | ||
| - "dependencies" | ||
|
|
||
| - package-ecosystem: "github-actions" | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 50 | ||
| assignees: | ||
| - "guibranco" | ||
| reviewers: | ||
| - "guibranco" | ||
| labels: | ||
| - "github-actions" | ||
| - "dependencies" |
There was a problem hiding this comment.
CODE REVIEW
-
Open Pull Requests Limit: 50 might be excessive and could overwhelm. Consider reducing the limit.
-
Assignees and Reviewers: Ensure redundancy; having only one person might delay responses.
-
YAML Formatting: Consistent indentation enhances readability.
Example improvements:
version: 2
updates:
- package-ecosystem: "nuget"
directory: "/"
schedule:
interval: weekly
open-pull-requests-limit: 10
assignees:
- "guibranco"
- "alternateReviewer"
reviewers:
- "guibranco"
- "alternateReviewer"
labels:
- "nuget"
- ".NET"
- "packages"
- "dependencies"
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: weekly
open-pull-requests-limit: 10
assignees:
- "guibranco"
- "alternateReviewer"
reviewers:
- "guibranco"
- "alternateReviewer"
labels:
- "github-actions"
- "dependencies"| name: Deep Source | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| pull_request: | ||
| types: [opened, synchronize, reopened] | ||
|
|
||
| jobs: | ||
| DeepSource: | ||
| name: Deep Source Coverage report | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
|
|
||
| - name: Install DeepSource scanner | ||
| run: curl https://deepsource.io/cli | sh | ||
|
|
||
| - name: Setup .NET | ||
| uses: actions/setup-dotnet@v4 | ||
| with: | ||
| dotnet-version: '7.0.x' | ||
|
|
||
| - name: Build and analyze | ||
| env: | ||
| DEEPSOURCE_DSN: ${{ secrets.DEEPSOURCE_DSN }} | ||
| run: | | ||
| dotnet build -c Debug --verbosity minimal | ||
| dotnet test -c Debug --verbosity minimal --no-build --no-restore /p:CollectCoverage=true /p:CoverletOutputFormat="cobertura" | ||
| ./bin/deepsource report --analyzer test-coverage --key csharp --value-file ./Tests/POCYamlHandling.Tests/coverage.cobertura.xml |
There was a problem hiding this comment.
CODE REVIEW
Overall, this workflow looks solid. Here are some minor improvements for better readability and consistency:
- Define the DeepSource scanner installation as a versioned action.
- Use
dotnetinstead of deprecated custom scripts for coverage.
name: Deep Source
on:
push:
branches:
- main
pull_request:
types: [opened, synchronize, reopened]
jobs:
DeepSource:
name: Deep Source Coverage report
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.sha }}
- name: Install DeepSource scanner
run: curl https://deepsource.io/cli | sh -s -- --version 1.6.0
- name: Setup .NET
uses: actions/setup-dotnet@v4
with:
dotnet-version: '7.0.x'
- name: Build and analyze
env:
DEEPSOURCE_DSN: ${{ secrets.DEEPSOURCE_DSN }}
run: |
dotnet build -c Debug --verbosity minimal
dotnet test -c Debug --verbosity minimal --no-build --no-restore /p:CollectCoverage=true /p:CoverletOutputFormat="cobertura"
deepsource report --analyzer test-coverage --key csharp --value-file ./Tests/POCYamlHandling.Tests/coverage.cobertura.xmlThis enhances readability and maintains version consistency for the DeepSource scanner.
Please double-check what I found in the pull request:
Summary of Proposed Changes
Identified Issues
Issue 1: Hardcoded GitHub token in
|
![korbit-ai[bot]](https://avatars.githubusercontent.com/in/322216?s=60&v=4){kind=small}
gstraccini
bot
added
the
☑️ auto-merge
![gstraccini[bot]](https://avatars.githubusercontent.com/in/480132?s=60&v=4){kind=small}
|
Infisical secrets check: ✅ No secrets leaked! Scan results: |
No description provided.