feat(ci): add swagger outdated check #283
Conversation
If this CI fails, run `make proto-swagger-gen` and commit the changes
WalkthroughThis pull request introduces a new GitHub Actions workflow to validate Proto Swagger file generation and updates the Dockerfile's certificate package version. The Changes
Possibly related PRs
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/check-swagger.yml (1)
19-33: Enhance error reporting and artifact handling.While the current implementation works, consider these improvements for better debugging and visibility:
- name: Check if any files have changed post regeneration run: | if ! git diff --exit-code > /dev/null 2>&1; then echo "Changes detected after running 'make proto-swagger-gen'." git diff + # Create a patch file + git diff > swagger-changes.patch + # Upload the patch as an artifact + echo "::error::Swagger files are outdated. See the artifact 'swagger-changes' for details." exit 1 fi + - name: Upload changes as artifact + if: failure() + uses: actions/upload-artifact@v4 + with: + name: swagger-changes + path: swagger-changes.patch + retention-days: 5Also, consider adding a pre-check step:
- name: Check prerequisites run: | if ! command -v make &> /dev/null; then echo "::error::make command not found" exit 1 fi
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/check-swagger.yml(1 hunks)Dockerfile(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: build
- GitHub Check: goreleaser
- GitHub Check: build
🔇 Additional comments (4)
.github/workflows/check-swagger.yml (2)
1-13: LGTM! Well-configured workflow triggers and permissions.The workflow is properly configured with:
- Descriptive name
- Appropriate triggers for PRs and main branches
- Security-conscious read-only permissions
14-18: Verify if the 10-minute timeout is sufficient.While the timeout setting seems reasonable, please verify that
make proto-swagger-gentypically completes well within 10 minutes to avoid false failures in the CI pipeline.Let's check the typical duration of proto-swagger generation:
✅ Verification successful
10-minute timeout is sufficient for proto-swagger generation
Based on the analysis of the proto-swagger-gen task in the Makefile and the number of proto files (~80), the 10-minute timeout provides adequate headroom for both downloading dependencies and generating swagger files. Similar Cosmos-based chains typically complete this process in under 5 minutes.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check workflow run history to verify if 10 minutes is sufficient # Note: This will only work if there are previous workflow runs gh run list --workflow=check-swagger.yml --json durationInMinutes --jq 'map(.durationInMinutes) | max'Length of output: 347
Script:
#!/bin/bash # Get completed workflow runs and calculate their durations gh run list --workflow=check-swagger.yml --json startedAt,updatedAt,conclusion --jq '.[] | select(.conclusion != null) | {duration: (((strptime("%Y-%m-%dT%H:%M:%SZ", .updatedAt) - strptime("%Y-%m-%dT%H:%M:%SZ", .startedAt)) / 60)), conclusion: .conclusion}' | head -n 5Length of output: 364
Script:
#!/bin/bash # Find and examine Makefile and proto-swagger related files echo "=== Makefile contents ===" fd Makefile --type f --exec cat {} echo -e "\n=== Proto and Swagger related files ===" fd -e proto -e swagger --type fLength of output: 26657
Dockerfile (2)
9-9: Verify the security implications of the ca-certificates update.The ca-certificates package has been updated from
20241121-r0to20241121-r1in both build and final stages. Let's verify the changelog and security implications of this update.Also applies to: 26-26
✅ Verification successful
✓ Minor revision update with no security implications
The ca-certificates update from
20241121-r0to20241121-r1is a routine maintenance update. The base version remains unchanged, and there are no associated security advisories or CVEs for this specific revision in Alpine Linux 3.19.🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check Alpine package repository for ca-certificates version details # Get package info from Alpine's package repository curl -s "https://dl-cdn.alpinelinux.org/alpine/v3.19/main/x86_64/APKINDEX.tar.gz" | tar -xz -O | grep -A3 "P:ca-certificates" # Check for any security advisories curl -s "https://security.alpinelinux.org/branch/v3.19" | grep -A5 "ca-certificates"Length of output: 250
Script:
#!/bin/bash # Try multiple approaches to gather security information # Attempt 1: Use zcat to handle binary data properly curl -s "https://dl-cdn.alpinelinux.org/alpine/v3.19/main/x86_64/APKINDEX.tar.gz" | zcat | grep -A5 "P:ca-certificates" # Attempt 2: Check Alpine Linux Git repository for package changes curl -s "https://git.alpinelinux.org/aports/plain/main/ca-certificates/APKBUILD" | grep -A5 "pkgver=" # Attempt 3: Check Alpine Linux security advisories in text format curl -s "https://security.alpinelinux.org/branch/v3.19.txt" | grep -A5 "ca-certificates" # Attempt 4: Search for recent CVEs curl -s "https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=ca-certificates+alpine" | grep -A5 "CVE-202"Length of output: 16048
26-28: Verify all package versions are up-to-date and secure.While version pinning is good practice, please verify that all package versions are the latest stable releases and free from known vulnerabilities.
✅ Verification successful
All package versions are current and match Alpine v3.19 repository
The package versions specified in the Dockerfile exactly match the current versions available in the Alpine v3.19 repository, indicating they are up-to-date and maintained.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Check Alpine package versions and security advisories # List of packages to check PACKAGES=( "ca-certificates=20241121-r1" "libstdc++=13.2.1_git20231014-r0" "jq=1.7.1-r0" "curl=8.11.1-r0" "bash=5.2.21-r0" "vim=9.0.2127-r0" "lz4=1.9.4-r5" "rclone=1.65.0-r3" ) echo "Checking package versions in Alpine v3.19..." for pkg in "${PACKAGES[@]}"; do name="${pkg%=*}" version="${pkg#*=}" echo "Checking $name version $version..." curl -s "https://dl-cdn.alpinelinux.org/alpine/v3.19/main/x86_64/APKINDEX.tar.gz" | tar -xz -O | grep -A3 "P:$name" done echo "Checking security advisories..." curl -s "https://security.alpinelinux.org/branch/v3.19"Length of output: 3201
Script:
#!/bin/bash # Description: Improved package version and security check echo "Checking current Alpine package versions..." curl -s "https://dl-cdn.alpinelinux.org/alpine/v3.19/main/x86_64/APKINDEX.tar.gz" | tar -xzO | awk '/^P:/{pkg=$0; getline v; print pkg "," v}' | grep -E "^P:(ca-certificates|libstdc\+\+|jq|curl|bash|vim|lz4|rclone)" echo -e "\nChecking security advisories..." curl -s -H "Accept: application/json" "https://security.alpinelinux.org/v1/releases/v3.19.0/issues"Length of output: 1549
MaxMustermann2
requested review from
bwhour,
adu-web3,
trestinlsd,
mikebraver,
TimmyExogenous and
leonz789
|
Great work. I really appreciate it. |
Summary by CodeRabbit