feat: add Go PR validation and service release umbrella workflows#406
Merged
Conversation
Introduce two umbrella reusable workflows so Go service repos reference a single workflow per concern, plus the shared composites they build on. - go-pr-validation.yml: orchestrates PR metadata, a non-doc change gate, go-pr-analysis and pr-security-scan behind opt-in flags, with stable aggregator status checks for branch protection. - go-release.yml: reworked from the GoReleaser binary flow into a service release umbrella (semantic-release on branch push; build + gitops-update on tag push), gated by non-doc change detection. - src/config/non-doc-changes: composite reporting whether a PR/push touches anything beyond docs/meta. - src/validate/result-gate: composite exposing one stable status check over a multi-job reusable pipeline. Docs, labeler and CONTRIBUTING updated. Additive on v1 - the previous GoReleaser go-release content remains in git history.
WalkthroughAdds a reusable Go PR validation workflow, refactors the Go release pipeline into an umbrella workflow, introduces composite actions for non-doc change detection and result gating, adjusts Lerian lib-version error handling, and updates docs and labeler mappings. ChangesGo Service CI/CD Workflow Orchestration
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related issues
Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
lerian-studio
added
size/XL
Contributor
🛡️ CodeQL Analysis ResultsLanguages analyzed: ✅ No security issues found. 🔍 View full scan logs | 🛡️ Security tab |
Contributor
🔍 Lint Analysis
|
Contributor
🔍 PR Validation Summary✅ PR Mergeable — no blocking failures
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/go-release.yml (1)
1-185:⚠️ Potential issue | 🟠 MajorBreaking change: Complete workflow interface refactoring.
The workflow input surface has been replaced entirely (removed prior GoReleaser-based inputs, added umbrella orchestration inputs). Per the PR objectives, this is intentional: callers pinned to a prior tag remain on the old behavior; the umbrella is additive on
v1.For callers upgrading, migrate to the new input contract:
- Branch pushes: configure
ignore_globs,semantic_version,enable_changelog,enable_major_tag- Tag pushes: configure
enable_dockerhub,enable_ghcr,app_name,docker_build_args,enable_cosign_sign,enable_gitops_update,gitops_repository, artifact/YAML mappings🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/go-release.yml around lines 1 - 185, The workflow interface was completely refactored and previous GoReleaser inputs removed; update any callers and docs to the new umbrella inputs by migrating branch-push callers to supply ignore_globs, semantic_version, enable_changelog, and enable_major_tag, and migrating tag-push callers to supply enable_dockerhub, enable_ghcr, app_name, docker_build_args, enable_cosign_sign, enable_gitops_update, gitops_repository and yaml/artifact mappings (gitops_artifact_pattern / gitops_yaml_key_mappings), and verify jobs release, build and update_gitops receive the mapped inputs and secrets inheritance expected by the new contract.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/go-pr-validation.md`:
- Line 60: The PR event types example currently includes the unnecessary
`edited` event in the YAML `types: [opened, edited, synchronize, reopened,
ready_for_review]`; remove `edited` so the list reads `types: [opened,
synchronize, reopened, ready_for_review]` to match repo convention and avoid
unwanted reruns—update the example in docs/go-pr-validation.md where the `types`
array is defined.
---
Outside diff comments:
In @.github/workflows/go-release.yml:
- Around line 1-185: The workflow interface was completely refactored and
previous GoReleaser inputs removed; update any callers and docs to the new
umbrella inputs by migrating branch-push callers to supply ignore_globs,
semantic_version, enable_changelog, and enable_major_tag, and migrating tag-push
callers to supply enable_dockerhub, enable_ghcr, app_name, docker_build_args,
enable_cosign_sign, enable_gitops_update, gitops_repository and yaml/artifact
mappings (gitops_artifact_pattern / gitops_yaml_key_mappings), and verify jobs
release, build and update_gitops receive the mapped inputs and secrets
inheritance expected by the new contract.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: cfd3c3f5-3acf-4636-b6f2-790ceae6ac83
📒 Files selected for processing (13)
.github/labeler.yml.github/workflows/go-pr-validation.yml.github/workflows/go-release.ymlCONTRIBUTING.mddocs/go-ci-workflow.mddocs/go-pr-validation.mddocs/go-release-workflow.mddocs/go-security-workflow.mddocs/typescript-release-workflow.mdsrc/config/non-doc-changes/README.mdsrc/config/non-doc-changes/action.ymlsrc/validate/result-gate/README.mdsrc/validate/result-gate/action.yml
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/go-pr-validation.yml (1)
149-149:⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy liftLocal workflow paths will break when called from external repos.
These
uses: ./.github/workflows/*.ymlreferences resolve to the caller's workspace, not this repository. When an external repo invokesgo-pr-validation.yml, GitHub will look forpr-validation.yml,go-pr-analysis.yml, andpr-security-scan.ymlin that external repo—they won't be found.Change to absolute external refs:
- uses: ./.github/workflows/pr-validation.yml + uses: LerianStudio/github-actions-shared-workflows/.github/workflows/pr-validation.yml@v1.x.xApply the same pattern to all three workflow references. Pin to an exact semver tag after this PR is released.
Based on learnings: "Local relative paths like ./path resolve to the caller's workspace and only work when the workflow is invoked via internal self-* wrappers within the same repo."
Also applies to: 186-186, 216-216
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/go-pr-validation.yml at line 149, The workflow uses local relative workflow calls (e.g., the uses: ./.github/workflows/pr-validation.yml, go-pr-analysis.yml, pr-security-scan.yml entries in go-pr-validation.yml) which will break when invoked from external repositories; replace each relative-path "uses:" with an absolute repo@tag reference (owner/repo/.github/workflows/pr-validation.yml@vX.Y.Z etc.), update all three referenced workflows (pr-validation.yml, go-pr-analysis.yml, pr-security-scan.yml) in go-pr-validation.yml, and pin to an exact semver tag (not branch) once this PR is published.Source: Learnings
.github/workflows/go-release.yml (1)
137-137:⚠️ Potential issue | 🔴 Critical | 🏗️ Heavy liftLocal workflow paths will break when called from external repos.
Same issue as
go-pr-validation.yml. Theseuses: ./.github/workflows/*.ymlreferences resolve to the caller's workspace.- uses: ./.github/workflows/release.yml + uses: LerianStudio/github-actions-shared-workflows/.github/workflows/release.yml@v1.x.xApply to all three workflow references (
release.yml,build.yml,gitops-update.yml). Pin to exact semver tag after this PR is released.Also applies to: 156-156, 178-178
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/go-release.yml at line 137, Replace the local workflow path usages that reference other workflow files via relative paths (the three "uses: ./.github/workflows/release.yml", "uses: ./.github/workflows/build.yml", and "uses: ./.github/workflows/gitops-update.yml" entries) with pinned external references to this repo at an exact semver tag (e.g. owner/repo/.github/workflows/<name>.yml@vX.Y.Z) once this PR is released; update all occurrences (the three uses lines) so they no longer point to ./.github/workflows/*.yml but instead reference the repo + exact tag.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/go-pr-validation.yml:
- Line 176: Update the composite action refs back to the stable v1 tag before
merging: replace any temporary branch refs like
"LerianStudio/github-actions-shared-workflows/src/config/non-doc-changes@feat/go-validation-release-umbrellas"
(and similar refs at the other occurrences) with the canonical
"LerianStudio/github-actions-shared-workflows/src/config/non-doc-changes@v1" so
the workflow uses the released composite action version.
In @.github/workflows/go-release.yml:
- Line 122: The workflow currently pins the composite action to the branch/ref
"feat/go-validation-release-umbrellas" in the uses statement; change that uses
entry to reference the stable tag "`@v1`" instead (replace
LerianStudio/github-actions-shared-workflows/src/config/non-doc-changes@feat/go-validation-release-umbrellas
with the same repository/path but ending in `@v1`) so the workflow uses the
released composite action version.
---
Outside diff comments:
In @.github/workflows/go-pr-validation.yml:
- Line 149: The workflow uses local relative workflow calls (e.g., the uses:
./.github/workflows/pr-validation.yml, go-pr-analysis.yml, pr-security-scan.yml
entries in go-pr-validation.yml) which will break when invoked from external
repositories; replace each relative-path "uses:" with an absolute repo@tag
reference (owner/repo/.github/workflows/pr-validation.yml@vX.Y.Z etc.), update
all three referenced workflows (pr-validation.yml, go-pr-analysis.yml,
pr-security-scan.yml) in go-pr-validation.yml, and pin to an exact semver tag
(not branch) once this PR is published.
In @.github/workflows/go-release.yml:
- Line 137: Replace the local workflow path usages that reference other workflow
files via relative paths (the three "uses: ./.github/workflows/release.yml",
"uses: ./.github/workflows/build.yml", and "uses:
./.github/workflows/gitops-update.yml" entries) with pinned external references
to this repo at an exact semver tag (e.g.
owner/repo/.github/workflows/<name>.yml@vX.Y.Z) once this PR is released; update
all occurrences (the three uses lines) so they no longer point to
./.github/workflows/*.yml but instead reference the repo + exact tag.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 8688c4d8-de17-4270-a707-d93e4f733fbd
📒 Files selected for processing (2)
.github/workflows/go-pr-validation.yml.github/workflows/go-release.yml
…-release-umbrellas
Wire lerian-lib-version-check.yml into the PR validation umbrella as a gated job (run_lib_version_check, default true), behind the non-doc change gate, with a stable 'Lib Version' aggregator check for branch protection. Expose go_mod_path / check_indirect / comment_on_pr inputs and the optional LERIAN_LIB_READ_TOKEN secret.
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/go-pr-validation.md (1)
79-79:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winPin the production workflow example to an exact stable tag.
The example currently uses
@v1; for production docs it must be an exact stable version (for example@v1.2.3).Suggested fix
- uses: LerianStudio/github-actions-shared-workflows/.github/workflows/go-pr-validation.yml@v1 + uses: LerianStudio/github-actions-shared-workflows/.github/workflows/go-pr-validation.yml@v1.2.3As per coding guidelines, docs examples must use
@develop/feature refs for testing and pinned stable@vX.Y.Zfor production examples.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/go-pr-validation.md` at line 79, Update the workflow reference string "LerianStudio/github-actions-shared-workflows/.github/workflows/go-pr-validation.yml@v1" to pin to an exact stable tag (e.g., replace "`@v1`" with a specific release like "`@v1.2.3`") so the production example is immutable; keep using branch/ref names like "`@develop`" only for testing examples and ensure the docs show the exact semantic version tag for production usage.Source: Coding guidelines
♻️ Duplicate comments (2)
.github/workflows/go-pr-validation.yml (1)
196-196:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winReplace temporary feature-branch composite refs before merge.
These
uses:entries still point to@feat/go-validation-release-umbrellas. That ref is test-only and brittle for consumers; switch them to the released floating major ref (@v1) before release.Suggested fix
- uses: LerianStudio/github-actions-shared-workflows/src/config/non-doc-changes@feat/go-validation-release-umbrellas + uses: LerianStudio/github-actions-shared-workflows/src/config/non-doc-changes@v1 ... - uses: LerianStudio/github-actions-shared-workflows/src/validate/result-gate@feat/go-validation-release-umbrellas + uses: LerianStudio/github-actions-shared-workflows/src/validate/result-gate@v1 ... - uses: LerianStudio/github-actions-shared-workflows/src/validate/result-gate@feat/go-validation-release-umbrellas + uses: LerianStudio/github-actions-shared-workflows/src/validate/result-gate@v1 ... - uses: LerianStudio/github-actions-shared-workflows/src/validate/result-gate@feat/go-validation-release-umbrellas + uses: LerianStudio/github-actions-shared-workflows/src/validate/result-gate@v1Also applies to: 226-226, 252-252, 278-278
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/go-pr-validation.yml at line 196, Update the temporary composite action refs that target the feature branch by replacing the ref suffix "`@feat/go-validation-release-umbrellas`" with the released floating major ref "`@v1`" for the `uses: LerianStudio/github-actions-shared-workflows/src/config/non-doc-changes` entries (and the other occurrences at the same pattern on the file). Locate the `uses:` lines that include `LerianStudio/github-actions-shared-workflows/src/config/non-doc-changes@feat/go-validation-release-umbrellas` and change them to `...@v1` so consumers use the stable released ref.Source: Linters/SAST tools
docs/go-pr-validation.md (1)
66-66:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winDrop
editedfrom the baseline PR trigger example.Keep the minimal default PR event types to avoid unnecessary reruns and label-feedback loops in copied caller workflows.
Suggested fix
- types: [opened, edited, synchronize, reopened, ready_for_review] + types: [opened, synchronize, reopened, ready_for_review]Based on learnings, the repo convention for PR-validation docs keeps the default
pull_request.typesminimal and excludeseditedunless a caller explicitly needs it.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/go-pr-validation.md` at line 66, The PR trigger example currently includes "edited" in the types list (types: [opened, edited, synchronize, reopened, ready_for_review]); remove "edited" so the baseline uses the minimal default event types (types: [opened, synchronize, reopened, ready_for_review]) to avoid unnecessary reruns and label-feedback loops—update the example in docs/go-pr-validation.md accordingly.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@docs/go-pr-validation.md`:
- Line 79: Update the workflow reference string
"LerianStudio/github-actions-shared-workflows/.github/workflows/go-pr-validation.yml@v1"
to pin to an exact stable tag (e.g., replace "`@v1`" with a specific release like
"`@v1.2.3`") so the production example is immutable; keep using branch/ref names
like "`@develop`" only for testing examples and ensure the docs show the exact
semantic version tag for production usage.
---
Duplicate comments:
In @.github/workflows/go-pr-validation.yml:
- Line 196: Update the temporary composite action refs that target the feature
branch by replacing the ref suffix "`@feat/go-validation-release-umbrellas`" with
the released floating major ref "`@v1`" for the `uses:
LerianStudio/github-actions-shared-workflows/src/config/non-doc-changes` entries
(and the other occurrences at the same pattern on the file). Locate the `uses:`
lines that include
`LerianStudio/github-actions-shared-workflows/src/config/non-doc-changes@feat/go-validation-release-umbrellas`
and change them to `...@v1` so consumers use the stable released ref.
In `@docs/go-pr-validation.md`:
- Line 66: The PR trigger example currently includes "edited" in the types list
(types: [opened, edited, synchronize, reopened, ready_for_review]); remove
"edited" so the baseline uses the minimal default event types (types: [opened,
synchronize, reopened, ready_for_review]) to avoid unnecessary reruns and
label-feedback loops—update the example in docs/go-pr-validation.md accordingly.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 633d644e-7bcb-436c-9290-939eaa837fa0
📒 Files selected for processing (2)
.github/workflows/go-pr-validation.ymldocs/go-pr-validation.md
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (4)
src/validate/lerian-lib-version/action.yml (1)
196-200:⚠️ Potential issue | 🟠 Major | ⚡ Quick winPinned ignore rules stop enforcing their target on API errors.
resolve_latest()now returns""for any non-200 response, but the loop checkslatestbefore it appliesIGNORE_PIN. A caller-providedlib-name/vN@vX.Y.Zpin therefore becomes_unknown_instead of being compared against the pinned version, so the action stops enforcing the explicit minimum exactly when the Releases API is degraded.Suggested fix
- latest=$(resolve_latest "${repo}" "${major_filter}") - - if [[ -z "${latest}" ]]; then - UNKNOWN=$((UNKNOWN+1)) - printf '| `%s` | `%s` | _unknown_ | Could not resolve latest release |\n' "${short_path}" "${current}" >> "${ROWS_FILE}" - log "::warning title=Could not resolve latest release::Failed to fetch latest stable release for LerianStudio/${repo}" - continue - fi - - # Pinned ignore: latest target becomes the pinned version - target="${latest}" - marker_suffix="" - if [[ -n "${IGNORE_PIN[${short_path}]:-}" ]]; then - target="${IGNORE_PIN[${short_path}]}" - marker_suffix=" (pinned)" - fi + marker_suffix="" + if [[ -n "${IGNORE_PIN[${short_path}]:-}" ]]; then + latest="${IGNORE_PIN[${short_path}]}" + target="${latest}" + marker_suffix=" (pinned)" + else + latest=$(resolve_latest "${repo}" "${major_filter}") + if [[ -z "${latest}" ]]; then + UNKNOWN=$((UNKNOWN+1)) + printf '| `%s` | `%s` | _unknown_ | Could not resolve latest release |\n' "${short_path}" "${current}" >> "${ROWS_FILE}" + log "::warning title=Could not resolve latest release::Failed to fetch latest stable release for LerianStudio/${repo}" + continue + fi + target="${latest}" + fiThe README contract already says ignore-pin entries are compared against the pin instead of latest.
Also applies to: 283-297
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/validate/lerian-lib-version/action.yml` around lines 196 - 200, resolve_latest() currently returns "" on non-200 responses which causes the caller loop to treat latest as empty before applying IGNORE_PIN, so pinned ignore rules stop matching; change resolve_latest() to return the sentinel "_unknown_" (and set LATEST_CACHE[cache_key]="_unknown_") when the Releases API returns a non-200 response so the calling loop (the code that uses the latest variable and IGNORE_PIN) will compare IGNORE_PIN entries against the pin as expected instead of skipping them due to an empty string..github/workflows/go-pr-validation.yml (3)
184-186:⚠️ Potential issue | 🟠 MajorAdd
ready_for_reviewto the non-doc change gate to prevent pipeline bypass
go-pr-validation.yml’schangesjob runs only foropened|synchronize|reopened, so when a caller triggersready_for_review,changesis skipped, which causesgo-analysis,security, andlib-versionto be skipped; the corresponding*-gatejobs still pass becausesrc/validate/result-gatetreatsskippedas success. This contradicts the documented caller behavior that includesready_for_review.Suggested fix
- if: contains(fromJSON('["opened","synchronize","reopened"]'), github.event.action) + if: contains(fromJSON('["opened","synchronize","reopened","ready_for_review"]'), github.event.action)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/go-pr-validation.yml around lines 184 - 186, The "changes" job's condition uses contains(fromJSON('["opened","synchronize","reopened"]'), github.event.action) which omits the ready_for_review event; update that contains(...) array to include "ready_for_review" so the job runs for opened, synchronize, reopened, and ready_for_review and thus prevents bypassing downstream gates (adjust the string in the if condition used by the changes job).
167-181:⚠️ Potential issue | 🔴 CriticalFix nested reusable workflow
uses: ./...paths for external callers
.github/workflows/go-pr-validation.ymlis documented as an umbrella reusable workflow for external repos, but it calls other reusable workflows via local relative refs (uses: ./.github/workflows/...). For external callers, those./paths resolve in the caller repo, so the nested workflows won’t be found and the run fails.Affected jobs:
metadata,go-analysis,security,lib-version.Suggested fix
- uses: ./.github/workflows/pr-validation.yml + uses: LerianStudio/github-actions-shared-workflows/.github/workflows/pr-validation.yml@<same-published-ref> - uses: ./.github/workflows/go-pr-analysis.yml + uses: LerianStudio/github-actions-shared-workflows/.github/workflows/go-pr-analysis.yml@<same-published-ref> - uses: ./.github/workflows/pr-security-scan.yml + uses: LerianStudio/github-actions-shared-workflows/.github/workflows/pr-security-scan.yml@<same-published-ref> - uses: ./.github/workflows/lerian-lib-version-check.yml + uses: LerianStudio/github-actions-shared-workflows/.github/workflows/lerian-lib-version-check.yml@<same-published-ref>🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/go-pr-validation.yml around lines 167 - 181, The reusable workflow uses local relative paths so external repos calling this umbrella workflow fail to resolve nested workflows; update the nested job `uses` entries (e.g., jobs named `metadata`, `go-analysis`, `security`, `lib-version`) to reference the full repository-qualified reusable workflow ref (owner/repo/.github/workflows/<workflow-file>.yml@<tag|sha|branch>) instead of `./.github/workflows/...`, and keep the existing `with:`/`secrets:` inputs intact so parameters pass through unchanged.Source: Learnings
219-229:⚠️ Potential issue | 🟠 MajorFix
*-gateto fail when thechangesprerequisite fails
result-gateexits successfully when the evaluated upstream result issuccessorskipped. In.github/workflows/go-pr-validation.yml,go-analysis-gate/security-gate/lib-version-gatedepend onchangesbut only passneeds.<pipeline>.result; whenchangesfails, the corresponding pipeline job is skipped, so the gate passes and masks the real failure.Suggested fix
- result: ${{ needs.go-analysis.result }} + result: ${{ needs.changes.result != 'success' && needs.changes.result || needs.go-analysis.result }}Apply the same pattern to
security-gateandlib-version-gate.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/go-pr-validation.yml around lines 219 - 229, The gate jobs (go-analysis-gate, security-gate, lib-version-gate) currently only pass the upstream pipeline result to the result-gate action, which lets a skipped job (due to a failed changes prerequisite) be treated as success; update each gate's with:result expression to also consider needs.changes.result so that if needs.changes.result == 'failure' the gate input becomes failure (i.e., propagate the changes failure into the result-gate input), applying this same change to go-analysis-gate, security-gate and lib-version-gate so the result-gate will fail when the changes job fails.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/go-pr-validation.yml:
- Around line 184-186: The "changes" job's condition uses
contains(fromJSON('["opened","synchronize","reopened"]'), github.event.action)
which omits the ready_for_review event; update that contains(...) array to
include "ready_for_review" so the job runs for opened, synchronize, reopened,
and ready_for_review and thus prevents bypassing downstream gates (adjust the
string in the if condition used by the changes job).
- Around line 167-181: The reusable workflow uses local relative paths so
external repos calling this umbrella workflow fail to resolve nested workflows;
update the nested job `uses` entries (e.g., jobs named `metadata`,
`go-analysis`, `security`, `lib-version`) to reference the full
repository-qualified reusable workflow ref
(owner/repo/.github/workflows/<workflow-file>.yml@<tag|sha|branch>) instead of
`./.github/workflows/...`, and keep the existing `with:`/`secrets:` inputs
intact so parameters pass through unchanged.
- Around line 219-229: The gate jobs (go-analysis-gate, security-gate,
lib-version-gate) currently only pass the upstream pipeline result to the
result-gate action, which lets a skipped job (due to a failed changes
prerequisite) be treated as success; update each gate's with:result expression
to also consider needs.changes.result so that if needs.changes.result ==
'failure' the gate input becomes failure (i.e., propagate the changes failure
into the result-gate input), applying this same change to go-analysis-gate,
security-gate and lib-version-gate so the result-gate will fail when the changes
job fails.
In `@src/validate/lerian-lib-version/action.yml`:
- Around line 196-200: resolve_latest() currently returns "" on non-200
responses which causes the caller loop to treat latest as empty before applying
IGNORE_PIN, so pinned ignore rules stop matching; change resolve_latest() to
return the sentinel "_unknown_" (and set LATEST_CACHE[cache_key]="_unknown_")
when the Releases API returns a non-200 response so the calling loop (the code
that uses the latest variable and IGNORE_PIN) will compare IGNORE_PIN entries
against the pin as expected instead of skipping them due to an empty string.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 743ab9bd-7f58-4a85-ae6f-605d24e9d44f
📒 Files selected for processing (3)
.github/workflows/go-pr-validation.yml.github/workflows/go-release.ymlsrc/validate/lerian-lib-version/action.yml
14 tasks
Contributor
Author
|
Outside-diff comments addressed:
|
12 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Actions Shared Workflows
Description
Adds two umbrella reusable workflows so a Go service repository references a single workflow per concern (PR validation, release) instead of wiring multiple reusables + gate/aggregator boilerplate in every caller. Both build on two new shared composites.
New workflow —
go-pr-validation.ymlorchestrates, in one place:pr-validation.yml)go-pr-analysis.yml), opt-in viarun_go_analysispr-security-scan.yml), opt-in viarun_securityGo Analysis,Security) for branch protectionReworked workflow —
go-release.ymlis repurposed from the GoReleaser binary flow into a service release umbrella:release.yml)build.yml) → GitOps update (gitops-update.yml)New composites
src/config/non-doc-changes— reports whether a PR/push touches anything beyond docs/meta (auto-detects PR vs push); replaces shell duplicated across callers.src/validate/result-gate— exposes a single stable status check over a multi-job reusable pipeline.Docs (
docs/go-pr-validation.md,docs/go-release-workflow.md, cross-links),.github/labeler.ymlandCONTRIBUTING.mdupdated accordingly.Type of Change
feat: New workflow or new input/output/step in an existing workflowfix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)perf: Performance improvement (e.g. caching, parallelism, reduced steps)refactor: Internal restructuring with no behavior changedocs: Documentation only (README, docs/, inline comments)ci: Changes to self-CI (workflows under.github/workflows/that run on this repo)chore: Dependency bumps, config updates, maintenancetest: Adding or updating testsBREAKING CHANGE: Callers must update their configuration after this PRBreaking Changes
go-release.ymlwas repurposed from the GoReleaser binary-release flow to the service-release umbrella. Consumers are pinned by tag (@v1.x.x), so existing callers are frozen on the prior content and are not affected at runtime; the GoReleaser flow remains recoverable in git history. No input contract is broken for the service-release use case. New behavior ingo-pr-validation.ymlis opt-in (run_go_analysis/run_securitydefault-gated by change detection). Released additively on v1.Testing
@this-branchor the beta tagValidated locally with
actionlint(workflows),yamllint, andshellcheck(composite shell) — all clean. Caller-repo validation (go-boilerplate-ddd) will follow in a separate PR once a tag is published.Caller repo / workflow run: pending — separate go-boilerplate-ddd PR after release
Related Issues
Closes #
Summary by CodeRabbit
New Features
Documentation
Chores