Repository navigation
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📝 WalkthroughWalkthroughAdds a new GitHub Actions workflow that announces releases on Mastodon when CHANGELOG.md is modified on main with a release commit message, validates a required logo file, extracts release notes, and posts a message (with image) via a Mastodon action using a secret token. Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant GH as GitHub Actions
participant Repo as Repository
participant Action as Mastodon Post Action
participant Mastodon as Mastodon API
participant Secrets as GitHub Secrets
Dev->>Repo: Push to main (CHANGELOG.md modified, commit "chore(main): release")
Repo->>GH: Trigger workflow
GH->>Repo: Checkout code
GH->>Repo: Verify `pr_logo/long_logo_conda.png` exists
GH->>GH: Extract version & release notes from commit/CHANGELOG
GH->>Secrets: Read `MASTODONBOT` token
GH->>Action: Invoke mastodon-release-post-action (token, image, message)
Action->>Mastodon: POST announcement (media + text)
Mastodon-->>Action: 200 OK
Action-->>GH: Success / failure
GH-->>Repo: Workflow result (logs)
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/workflows/announce-release.yml (1)
34-34:github.event.head_commit.messageincludes the full commit body, not just the title.For release commits produced by release-please (e.g.
chore(main): release 1.2.3\n\n...body...), this field contains the multi-line full message. Passing it aspr-titlemay result in a garbled or unexpectedly long toot title. Consider extracting only the first line:💡 Suggested approach (if the action accepts it)
- pr-title: ${{ github.event.head_commit.message }} + pr-title: ${{ github.event.head_commit.message_head_line }}Or use an intermediate
run:step to exportecho "${MSG%%$'\n'*}" >> $GITHUB_ENVand reference the env var here, sincemessage_head_lineis not a standard context property.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/announce-release.yml at line 34, The workflow uses github.event.head_commit.message for pr-title which contains the full commit body; change it to only the first line by extracting the message head line and passing that instead: either update the pr-title expression to reference a first-line extraction (if the action supports an expression/split) or add an intermediate run step (e.g., set MSG_FIRST_LINE by trimming at the first newline and export it to GITHUB_ENV) and then use that env var for pr-title; target the pr-title key in the announce-release.yml and the head_commit.message usage to implement this change.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/announce-release.yml:
- Around line 10-11: The workflow's permissions block only grants pull-requests:
read, which implicitly sets all other scopes (including contents) to none and
breaks actions/checkout@v4; update the permissions mapping to include contents:
read alongside pull-requests: read (i.e., add a top-level permissions entry
"contents: read") so checkout and repository file access (logo verification)
succeed while keeping the existing pull-requests: read scope.
- Line 31: The workflow currently references the external action as
snakemake/mastodon-release-post-action@main (a mutable ref); replace that
floating tag with a specific commit SHA you have reviewed (e.g.,
snakemake/mastodon-release-post-action@<commit-sha>) so the CI runs a pinned
revision; locate the uses entry for snakemake/mastodon-release-post-action in
the announce-release.yml and update the ref to the chosen commit SHA, then
commit the change and (optionally) add a short comment noting why the SHA is
pinned.
- Around line 21-35: The verification step "Verify logo file exists" and the
Mastodon action "Post to Mastodon" reference different image names/paths; update
one so both match. Either change the verify check to look for
pr_logo/long_logo_conda.png if the Conda logo is intended, or change the
Mastodon input image to "pr_logo/long_logo_hpc.png" (include the pr_logo/
prefix) so the file the action uses is the same file the script validates;
ensure the string used in the Mastodon step's image: field exactly matches the
filename checked in the verification step.
- Line 50: The workflow references
steps.extract-release-notes.outputs.release_notes but no step with id
extract-release-notes exists, so add a step named id: extract-release-notes
before the "Post to Mastodon" step that produces an output release_notes;
implement it either by using an action like
google-github-actions/release-please-action or a run: step that reads
CHANGELOG.md (or git tag release notes) and sets the output (e.g., echo
"::set-output name=release_notes::$(...)" or the equivalent environment-output
syntax) so the Mastodon step can consume ${{
steps.extract-release-notes.outputs.release_notes }}.
---
Nitpick comments:
In @.github/workflows/announce-release.yml:
- Line 34: The workflow uses github.event.head_commit.message for pr-title which
contains the full commit body; change it to only the first line by extracting
the message head line and passing that instead: either update the pr-title
expression to reference a first-line extraction (if the action supports an
expression/split) or add an intermediate run step (e.g., set MSG_FIRST_LINE by
trimming at the first newline and export it to GITHUB_ENV) and then use that env
var for pr-title; target the pr-title key in the announce-release.yml and the
head_commit.message usage to implement this change.
| echo "Logo file found at: ${{ github.workspace }}/pr_logo/long_logo_hpc.png" | ||
|
|
||
| - name: Post to Mastodon | ||
| uses: snakemake/mastodon-release-post-action@main # == latest |
There was a problem hiding this comment.
Pin the external action to a commit SHA instead of @main.
snakemake/mastodon-release-post-action@main is a mutable floating reference. Any future force-push or compromised commit to that branch can silently change the code that runs in your CI and has access to secrets.MASTODONBOT.
Pin to the specific commit SHA of the revision you've validated, e.g.:
- uses: snakemake/mastodon-release-post-action@main # == latest
+ uses: snakemake/mastodon-release-post-action@<full-commit-sha> # main as of YYYY-MM-DD📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: snakemake/mastodon-release-post-action@main # == latest | |
| uses: snakemake/mastodon-release-post-action@abc123def456 # main as of 2024-01-15 |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/announce-release.yml at line 31, The workflow currently
references the external action as snakemake/mastodon-release-post-action@main (a
mutable ref); replace that floating tag with a specific commit SHA you have
reviewed (e.g., snakemake/mastodon-release-post-action@<commit-sha>) so the CI
runs a pinned revision; locate the uses entry for
snakemake/mastodon-release-post-action in the announce-release.yml and update
the ref to the chosen commit SHA, then commit the change and (optionally) add a
short comment noting why the SHA is pinned.
There was a problem hiding this comment.
@johanneskoester what do you think? As the mastodon announcement repo is under our control, I thought this approach the most convenient. It alleviates us from the need to constantly update all repos which use this workflow.
There was a problem hiding this comment.
Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!
There was a problem hiding this comment.
Pinning it a release tag is more reliable. One can pin to the major tag and use release-please to automatically create those from the specific release.
There was a problem hiding this comment.
fixed hashsum has been entered.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/announce-release.yml:
- Around line 22-23: The debug ls command "ls -la ${{ github.workspace
}}/pr_logo/" can cause the job to fail if pr_logo/ is missing; update the
workflow step to avoid failing on missing directory by either removing this ls
debugging line or making it non-fatal (e.g., append a fallback so the command
always succeeds), ensuring the subsequent explicit check/log message ("ERROR:
Logo file not found!") can run; locate the run block that contains the ls
invocation and apply the change.
---
Duplicate comments:
In @.github/workflows/announce-release.yml:
- Around line 35-36: Update the image path and description in the workflow:
change the image value used by the action (key "image") from
"long_logo_conda.png" to include the pr_logo/ prefix
("pr_logo/long_logo_conda.png") so it matches the verification step, and update
the "image-description" value from "Snakemake HPC logo for Mastodon" to
reference the Conda plugin (e.g., "Snakemake Conda logo for Mastodon"); adjust
the entries for image and image-description in the workflow YAML where those
keys appear.
- Around line 37-50: The workflow references an undefined step output and uses
incorrect template syntax: add or rename a step that produces release_notes (the
step referenced as steps.extract-release-notes and its output release_notes) or
update the message to use the correct existing step output variable (${ {
steps.<your-step>.outputs.release_notes }}), and verify how
mastodon-release-post-action handles inline placeholders; replace the
single-brace placeholders ({{ version }}, {{ issue_url }}, {{ changelog }}) with
either GitHub Actions expressions (${{ ... }}) that compute those values or pass
them explicitly via the mastodon-release-post-action inputs per its action.yml,
ensuring the message field uses the actual output/input names the action expects
and that steps.extract-release-notes (or the chosen step) is created to set the
release_notes output.
- Around line 10-11: The workflow's permissions block only grants pull-requests:
read but misses contents: read which is required by actions/checkout@v4 and the
logo verification step; update the permissions block to include contents: read
(alongside pull-requests: read) so the repository content is accessible to the
checkout action and the logo verification step.
- Line 31: The workflow currently uses a mutable action reference
"snakemake/mastodon-release-post-action@main" which can change silently and has
access to secrets.MASTODONBOT; replace the mutable ref with a fixed, reviewed
commit SHA for that action (e.g.,
"snakemake/mastodon-release-post-action@<commit-sha>") so the workflow always
runs a pinned version and update the workflow file to use that SHA instead of
"main".
johanneskoester
left a comment
johanneskoester
left a comment
There was a problem hiding this comment.
I don't like the logo. In particular since the plugin actually does not use conda but rattler. I think we should avoid plugin specific logos overall.
|
Yes, my design skill leaves something to wish for .... Then we need an update for the announcement script: We need to better highlight the kind of release. I think this can be done using formatting. Might be tricky. |
|
@johanneskoester ok, a merged update helped: now, the logo is changed and we have a hash, which carves the action in stone. |
This PR provides a basic mastodon announcement workflow.
Please check:
Summary by CodeRabbit