Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughWorkflow now checks out a configurable spec repo, imports a provided GPG private key to sign commits, uses a stable branch name, force-pushes updates, and either updates an existing PR or creates a new one after removing a stale branch. Changes
Sequence Diagram(s)sequenceDiagram
participant Runner as Workflow Runner
participant GH as GitHub API / gh
participant Repo as Spec Repo (git remote)
participant GPG as GPG
Runner->>GH: checkout main repo
Runner->>Repo: git clone using secrets.OPENAPI_SPEC_REPO
Runner->>GPG: import OPENAPI_SPEC_SYNC_GPG_PRIVATE_KEY
GPG-->>Runner: return signing key ID
Runner->>Runner: configure git (user, email, commit.gpgsign)
Runner->>Repo: create/update branch auto/update-eda-${SPEC_BRANCH}
Runner->>GH: search PR with head=auto/update-eda-${SPEC_BRANCH}&base=SPEC_BRANCH
alt PR found
GH-->>Runner: return PR id
Runner->>GH: gh pr edit (update body)
Runner->>Repo: git push --force to branch
else PR not found
GH-->>Runner: no matching PR
Runner->>Repo: delete stale remote branch (if present)
Runner->>Repo: git push --force to branch
Runner->>GH: gh pr create (open new PR)
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes 🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
ttuffin
force-pushed
the
chore/api-spec-key-signing
branch
from
f815451 to
e8f7ae0
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/sync-openapi-spec.yml:
- Around line 113-123: BRANCH_NAME is a stable branch that can be force-pushed
by concurrent runs (see BRANCH_NAME, EXISTING_PR and the later force-push), so
add a guard to prevent overlapping updates: either 1) make BRANCH_NAME unique
per run (append RUN_ID or timestamp) so you never clobber another run, or 2)
before creating/force-pushing BRANCH_NAME call the GitHub API to detect
in-progress workflow runs or recent PR updates for that BRANCH_NAME (use gh run
list / gh api or inspect EXISTING_PR and the PR's updatedAt) and exit/skip if a
newer run/PR is active; implement the chosen approach and ensure the force-push
step (the later push that currently overwrites the branch) honours this check to
avoid older runs overwriting newer PR updates.
- Line 52: The reusable workflow requires three secrets (OPENAPI_SPEC_REPO,
OPENAPI_SPEC_SYNC_GPG_PRIVATE_KEY, OPENAPI_SPEC_SYNC_TOKEN) but the caller only
passes OPENAPI_SPEC_SYNC_TOKEN; update the caller (ci.yaml invocation of the
reusable workflow) to either explicitly pass OPENAPI_SPEC_REPO and
OPENAPI_SPEC_SYNC_GPG_PRIVATE_KEY in addition to OPENAPI_SPEC_SYNC_TOKEN, or
replace the explicit secrets block with secrets: inherit so all required secrets
are forwarded to the reusable workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ccb6bb8c-ecbe-40e5-a159-45885b8100e3
📒 Files selected for processing (1)
.github/workflows/sync-openapi-spec.yml
ttuffin
force-pushed
the
chore/api-spec-key-signing
branch
from
e8f7ae0 to
406bc28
Compare
Contributor
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/sync-openapi-spec.yml (1)
102-112: Consider using machine-readable GPG output for more robust key ID extraction.The current parsing relies on the human-readable output format of
gpg --list-secret-keys, which can vary across GPG versions. The--with-colonsflag provides a stable, machine-parsable format.♻️ Optional: More robust GPG key ID extraction
- GPG_KEY_ID=$(gpg --list-secret-keys --keyid-format long 2>/dev/null | grep sec | head -1 | awk '{print $2}' | cut -d'/' -f2) + GPG_KEY_ID=$(gpg --list-secret-keys --with-colons --keyid-format long 2>/dev/null | awk -F: '/^sec:/ {print $5; exit}')🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/sync-openapi-spec.yml around lines 102 - 112, The GPG key extraction uses human-readable gpg output which is brittle; update the extraction to use machine-readable output by calling gpg --list-secret-keys --with-colons and parse the "sec" record to get the key ID (update the GPG_KEY_ID assignment) so it reliably extracts the long key ID for git signing; ensure the script still checks for an empty GPG_KEY_ID and then configures git (user.name, user.email, commit.gpgsign, user.signingkey) as before.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/sync-openapi-spec.yml:
- Around line 102-112: The GPG key extraction uses human-readable gpg output
which is brittle; update the extraction to use machine-readable output by
calling gpg --list-secret-keys --with-colons and parse the "sec" record to get
the key ID (update the GPG_KEY_ID assignment) so it reliably extracts the long
key ID for git signing; ensure the script still checks for an empty GPG_KEY_ID
and then configures git (user.name, user.email, commit.gpgsign, user.signingkey)
as before.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 27eeab2e-5476-4735-a4f6-1e2b267e18bf
📒 Files selected for processing (2)
.github/workflows/ci.yaml.github/workflows/sync-openapi-spec.yml
Codecov Report✅ All modified and coverable lines are covered by tests. @@ Coverage Diff @@
## main #1525 +/- ##
=======================================
Coverage 91.93% 91.93%
=======================================
Files 239 239
Lines 10810 10810
=======================================
Hits 9938 9938
Misses 872 872
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
kaiokmo
approved these changes
Apr 13, 2026
ttuffin
force-pushed
the
chore/api-spec-key-signing
branch
from
406bc28 to
2b538c3
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/sync-openapi-spec.yml (1)
103-105: Use machine-readable GPG output for key selection.This parses the human-readable
gpg --list-secret-keysoutput, which is brittle in automation and can pick the wrong key if the format changes or more than one secret key is present.Possible tweak
- GPG_KEY_ID=$(gpg --list-secret-keys --keyid-format long 2>/dev/null | grep sec | head -1 | awk '{print $2}' | cut -d'/' -f2) + GPG_KEY_ID=$(gpg --batch --with-colons --list-secret-keys 2>/dev/null | awk -F: '$1 == "sec" { print $5; exit }')🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/sync-openapi-spec.yml around lines 103 - 105, The current GPG_KEY_ID extraction parses human-readable gpg output and is brittle; replace the parsing to use machine-readable output by running gpg --list-secret-keys --with-colons and extract the first "sec" record's key ID into GPG_KEY_ID (e.g. use awk -F: '/^sec/ {print $5; exit}' on the --with-colons output), so update the variable assignment for GPG_KEY_ID accordingly to reliably select the first secret key.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/sync-openapi-spec.yml:
- Around line 121-135: The current PR lookup uses gh pr list with --state open
(EXISTING_PR) which misses closed PRs; change the call to use --state all and
return both number and state (e.g., EXISTING_PR_JSON), parse out PR_NUMBER and
PR_STATE, and if PR_STATE == "closed" call gh pr reopen "$PR_NUMBER" (using
BRANCH_NAME/SPEC_REPO/SPEC_BRANCH context) before proceeding; then update the
existing conditional that checks EXISTING_PR to use PR_NUMBER (and treat
reopened PRs as found) so the workflow edits the reopened PR instead of deleting
the branch and creating a new one.
---
Nitpick comments:
In @.github/workflows/sync-openapi-spec.yml:
- Around line 103-105: The current GPG_KEY_ID extraction parses human-readable
gpg output and is brittle; replace the parsing to use machine-readable output by
running gpg --list-secret-keys --with-colons and extract the first "sec"
record's key ID into GPG_KEY_ID (e.g. use awk -F: '/^sec/ {print $5; exit}' on
the --with-colons output), so update the variable assignment for GPG_KEY_ID
accordingly to reliably select the first secret key.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 3406a8fe-fec1-4149-bb93-4fd9b3c251bc
📒 Files selected for processing (2)
.github/workflows/ci.yaml.github/workflows/sync-openapi-spec.yml
✅ Files skipped from review due to trivial changes (1)
- .github/workflows/ci.yaml
|
AlexSCorey
approved these changes
Apr 13, 2026
- Add logic for git commit signing - Add logic to update existing PR's
ttuffin
force-pushed
the
chore/api-spec-key-signing
branch
from
2b538c3 to
59d2793
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit