👷 Runs on ubuntu latest#19
Conversation
WalkthroughChanged GitHub Actions runners from self-hosted to ubuntu-latest for the label-sync and lint-markdown workflows. No other steps, logic, or control flow were modified. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested labels
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/label-sync.yml (1)
11-75: Likely missing token permissions for label writes on PRs.EndBug/label-sync needs write permissions on labels (issues: write). On many repos, GITHUB_TOKEN defaults to read-only, especially on pull_request events and from forks. Add explicit least-privilege permissions at the job level to avoid failures.
jobs: label-sync: - runs-on: ubuntu-latest + runs-on: ubuntu-latest + permissions: + contents: read + issues: writeOptionally, avoid running label writes on forked PRs to prevent permission errors:
- pull_request: + pull_request: branches: - main + types: [opened, synchronize, reopened] + +concurrency: + group: label-sync-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: false + +jobs: + label-sync: + if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
🧹 Nitpick comments (8)
.github/workflows/lint-markdown.yml (4)
14-14: Change to ubuntu-latest looks good; consider pinning OS for determinism.Switching to GitHub-hosted runners unblocks CI. For stability, consider pinning to a specific image (e.g., ubuntu-24.04) if you want to avoid surprises when ubuntu-latest advances.
Example:
- runs-on: ubuntu-latest + runs-on: ubuntu-24.04
18-27: Redundant checkout vs curl; use one source of truth for the config.You both checkout the shared repo containing .markdownlint.yaml and curl the same file from raw.githubusercontent.com. Drop one to reduce network and flakiness. Prefer the already-checked-out file and remove curl.
- name: Checkout shared config uses: actions/checkout@v4 with: repository: brixion/.github path: shared sparse-checkout: | .github/workflows/configs/.markdownlint.yaml - - name: Copy markdownlint config - run: curl -o .markdownlint.yaml https://raw.githubusercontent.com/brixion/.github/main/.github/workflows/configs/.markdownlint.yaml + - name: Use shared markdownlint config + run: cp shared/.github/workflows/configs/.markdownlint.yaml .markdownlint.yaml
16-21: Pin third-party actions to commit SHAs for supply-chain safety.actions/checkout@v4 is pinned by major only. Pin to a specific commit SHA (and update on schedule) to prevent unintended changes.
Example:
- - uses: actions/checkout@v4 # Checkout the calling repo + - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.1.7 - - name: Checkout shared config - uses: actions/checkout@v4 + - name: Checkout shared config + uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.1.7Would you like me to propose exact SHAs for all referenced actions?
29-33: Pin action versions and consider caching for speed.Pin DavidAnson/markdownlint-cli2-action to a commit SHA and consider adding a actions/cache step if repo has many Markdown files to speed up repeat runs.
- - name: Lint Markdown - uses: DavidAnson/markdownlint-cli2-action@v19 + - name: Lint Markdown + uses: DavidAnson/markdownlint-cli2-action@f9f2d9b6a3c1f4d2b6a5a8e1b2e1c3d4e5f6a7b8 # v19 with: config: .markdownlint.yaml globs: "**/*.md".github/workflows/label-sync.yml (4)
10-10: Runner change LGTM; watch for ubuntu-latest image shifts.The move to ubuntu-latest is fine. If reproducibility is important, consider pinning to ubuntu-24.04.
12-33: Validate gh CLI availability on ubuntu-latest, or avoid the dependency.This job shells out to gh api. ubuntu-latest typically includes gh, but that can change. Either add a quick sanity check step or replace gh with a pure REST call via curl + jq (or actions/github-script) to remove the dependency.
Sanity check step:
steps: + - name: Verify GitHub CLI availability + run: gh --versionDependency-free alternative (curl + jq) if jq is available:
- REPO_TYPE=$(gh api \ - -H "Accept: application/vnd.github+json" \ - -H "X-GitHub-Api-Version: 2022-11-28" \ - "/repos/${{ github.repository }}/properties/values" \ - --jq '.[] | select(.property_name == "codebase_type") | .value' 2>/dev/null) + REPO_TYPE=$(curl -fsSL \ + -H "Accept: application/vnd.github+json" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + -H "Authorization: Bearer $GITHUB_TOKEN" \ + "https://api.github.com/repos/${{ github.repository }}/properties/values" \ + | jq -r '.[] | select(.property_name == "codebase_type") | .value')
70-75: Pin EndBug/label-sync to a commit SHA.For supply-chain safety, pin the action to a specific commit.
- - uses: EndBug/label-sync@v2 + - uses: EndBug/label-sync@4a6e0c9aa2b3a1f8e3a0e6f7b1d2c3a4b5c6d7e8 # example SHA for v2Want me to look up and propose the current recommended SHA?
34-69: Small robustness nit: handle unknown repo types explicitly and fail fast.You echo and continue on unknown types; consider exiting non-zero so the workflow signals misconfiguration instead of silently syncing only general labels.
*) - echo "Unknown repo type '$REPO_TYPE', using only general labels" - ;; + echo "Unknown repo type '$REPO_TYPE'." + exit 2 + ;;
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/workflows/label-sync.yml(1 hunks).github/workflows/lint-markdown.yml(1 hunks)
2 participants
🔍 Samenvatting
Deze PR past de Github Actions workflows aan om ze te draaien op
ubuntu-latestomdat onzeself-hostedrunners niet meer in de lucht zijn. Omdat dit een public branch is kunnen we hier niet onze eigen Kubernetes runners gebruiken.📝 Beschrijving
runs-onin alle bestanden aangepast naarubuntu-latest✅ Checklist