fix(workflow): fix DCO check #3512
Conversation
WalkthroughThe pull request modifies the GitHub Actions workflow file for creating a pull request in the Longhorn repository. Two new steps are introduced to dynamically retrieve the head commit's author name and email. The "Create Pull Request" step is updated to use these dynamically obtained commit author details instead of hardcoded values, ensuring more accurate representation of the commit's authorship information. Changes
Assessment against linked issues
Possibly related PRs
Suggested reviewers
Tip 🌐 Web search-backed reviews and chat
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/create-crd-update-pr-in-longhorn-repo.yml(2 hunks)
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/create-crd-update-pr-in-longhorn-repo.yml
42-42: workflow command "set-output" was deprecated. use echo "{name}={value}" >> $GITHUB_OUTPUT instead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions
(deprecated-commands)
46-46: workflow command "set-output" was deprecated. use echo "{name}={value}" >> $GITHUB_OUTPUT instead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions
(deprecated-commands)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: Build binaries
- GitHub Check: Summary
🔇 Additional comments (2)
.github/workflows/create-crd-update-pr-in-longhorn-repo.yml (2)
57-58: LGTM! The changes correctly implement the DCO requirements.The implementation properly uses the commit author's details for both
authorandcommitterfields, which aligns with the PR objective to fix the DCO check. The combination withsign-commits: trueandsignoff: trueensures proper commit signing.
Line range hint
3-7: Verify the security implications of using pull_request_target.The workflow uses
pull_request_targetwhich runs with repository secrets. While this is necessary for creating PRs with tokens, please ensure that:
- The workflow doesn't execute any code from the PR
- The CRDs and manifests are fetched from the master branch of longhorn-manager, not the PR branch
✅ Verification successful
The workflow's security implementation for pull_request_target is correct
The workflow follows security best practices:
- Only runs after PR is merged to master
- Fetches CRDs directly from the master branch of longhorn-manager
- Executes only trusted scripts from the base branch
- Uses PR content only for metadata (PR number, title)
- Properly scopes repository secrets for creating update PRs
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify that the workflow only uses trusted sources # Check if the workflow fetches content from trusted sources rg -l 'curl.*\$\{.*\}' .github/workflows/ rg -l 'wget.*\$\{.*\}' .github/workflows/ # Check if the workflow executes any potentially untrusted code rg -l 'eval.*\$\{.*\}' .github/workflows/ rg -l 'source.*\$\{.*\}' .github/workflows/Length of output: 177
Script:
#!/bin/bash # Get the complete workflow content cat .github/workflows/create-crd-update-pr-in-longhorn-repo.yml # Search for actions/checkout usage in the workflow rg "uses: actions/checkout@" .github/workflows/create-crd-update-pr-in-longhorn-repo.yml -A 5 # Search for any references to PR context or SHA rg "github\.(event|sha|ref)" .github/workflows/create-crd-update-pr-in-longhorn-repo.ymlLength of output: 3570
🧰 Tools
🪛 actionlint (1.7.4)
42-42: workflow command "set-output" was deprecated. use
echo "{name}={value}" >> $GITHUB_OUTPUTinstead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions(deprecated-commands)
46-46: workflow command "set-output" was deprecated. use
echo "{name}={value}" >> $GITHUB_OUTPUTinstead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions(deprecated-commands)
| @@ -46,9 +54,8 @@ jobs: | |||
| delete-branch: true | |||
| sign-commits: true | |||
| signoff: true | |||
| author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com> | |||
| committer: Longhorn GitHub Bot <67932897+longhorn-io-github-bot@users.noreply.github.com> | |||
There was a problem hiding this comment.
Do we know why the bot account with sign is not valid for DCO check?
There was a problem hiding this comment.
I have no idea for now. Although I set the committer and author to Longhorn bot, the longhorn/longhorn PR will be created by the author of the longhorn/longhorn-manager PR rather than the Longhorn bot when triggering the workflow by pull_request_target. However, using the author of the longhorn/longhorn-manager PR might make sense.
derekbit
force-pushed
the
longhorn-10193
branch
from
947cd35 to
0427098
Compare
Longhorn 10193 Signed-off-by: Derek Su <derek.su@suse.com>
derekbit
force-pushed
the
longhorn-10193
branch
from
0427098 to
d74b713
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/create-crd-update-pr-in-longhorn-repo.yml(2 hunks)
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/create-crd-update-pr-in-longhorn-repo.yml
42-42: workflow command "set-output" was deprecated. use echo "{name}={value}" >> $GITHUB_OUTPUT instead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions
(deprecated-commands)
46-46: workflow command "set-output" was deprecated. use echo "{name}={value}" >> $GITHUB_OUTPUT instead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions
(deprecated-commands)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: Build binaries
- GitHub Check: Summary
🔇 Additional comments (1)
.github/workflows/create-crd-update-pr-in-longhorn-repo.yml (1)
57-58: Dynamic Author and Committer AssignmentThe "Create Pull Request" step now successfully uses the dynamic outputs (
commit_nameandcommit_email) for setting theauthorandcommitterfields. This aligns well with the PR’s objective to use the head commit’s metadata for DCO compliance. Ensure that once you update the output commands as suggested above, the output variable names remain consistent.
| - name: Get Head Commit Name | ||
| id: get_head_commit_name | ||
| run: echo "::set-output name=commit_name::$(git log -1 --pretty=format:'%an')" | ||
|
|
||
| - name: Get Head Commit Email | ||
| id: get_head_commit_email | ||
| run: echo "::set-output name=commit_email::$(git log -1 --pretty=format:'%ae')" | ||
|
|
There was a problem hiding this comment.
💡 Codebase verification
🛠️ Refactor suggestion
Deprecated set-output Usage Confirmed in Workflow
The search result confirms that the workflow file still uses the deprecated ::set-output command at the following lines:
- Line 42: Uses
::set-outputfor the commit name. - Line 46: Uses
::set-outputfor the commit email.
Please update these steps to use the $GITHUB_OUTPUT mechanism as detailed in the review comment to comply with the updated GitHub Actions guidelines.
🔗 Analysis chain
Update Deprecated set-output Commands
The steps "Get Head Commit Name" (line 42) and "Get Head Commit Email" (line 46) still use the deprecated ::set-output command. To comply with the current GitHub Actions guidelines, update these commands to use the $GITHUB_OUTPUT mechanism. For example, you could replace the current implementation with:
- run: echo "::set-output name=commit_name::$(git log -1 --pretty=format:'%an')"
+ run: |
+ if ! commit_name=$(git log -1 --pretty=format:'%an'); then
+ echo "Failed to get commit author name" >&2
+ exit 1
+ fi
+ echo "commit_name=$commit_name" >> $GITHUB_OUTPUTand similarly for the commit email:
- run: echo "::set-output name=commit_email::$(git log -1 --pretty=format:'%ae')"
+ run: |
+ if ! commit_email=$(git log -1 --pretty=format:'%ae'); then
+ echo "Failed to get commit author email" >&2
+ exit 1
+ fi
+ echo "commit_email=$commit_email" >> $GITHUB_OUTPUTThis change aligns with the updated GitHub Actions syntax and resolves warnings from static analysis tools.
🏁 Scripts executed
The following scripts were executed for the analysis:
Error: No shell scripts or web queries found
Script:
#!/bin/bash
# Verify deprecated set-output commands in the workflow file
rg --line-number "::set-output" .github/workflows/create-crd-update-pr-in-longhorn-repo.ymlLength of output: 268
🧰 Tools
🪛 actionlint (1.7.4)
42-42: workflow command "set-output" was deprecated. use echo "{name}={value}" >> $GITHUB_OUTPUT instead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions
(deprecated-commands)
46-46: workflow command "set-output" was deprecated. use echo "{name}={value}" >> $GITHUB_OUTPUT instead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions
(deprecated-commands)
Which issue(s) this PR fixes:
Issue longhorn/longhorn#10193
What this PR does / why we need it:
Use head commit's author name and email as committer's information.
Special notes for your reviewer:
Additional documentation or context