fix(release): develop to main

[bedatty]

GitHub Actions Shared Workflows

---

Description

Type of Change

• feat: New workflow or new input/output/step in an existing workflow
• fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
• perf: Performance improvement (e.g. caching, parallelism, reduced steps)
• refactor: Internal restructuring with no behavior change
• docs: Documentation only (README, docs/, inline comments)
• ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
• chore: Dependency bumps, config updates, maintenance
• test: Adding or updating tests
• BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None.

Testing

• YAML syntax validated locally
• Triggered a real workflow run on a caller repository using @this-branch or the beta tag
• Verified all existing inputs still work with default values
• Confirmed no secrets or tokens are printed in logs
• Checked that unrelated workflows are not affected

Caller repo / workflow run:

Related Issues

Closes #

Summary by CodeRabbit

• Bug Fixes

  • Increased the wait time for GitOps syncs, reducing the chance of premature timeout during longer deployments.
  • Updated changelog generation to refresh tags more reliably, helping ensure newly created releases are included correctly.

• Chores

  • Added a configurable sync timeout for GitOps workflow runs, with a higher default value.

[coderabbitai]

Walkthrough

The GitOps update workflow now accepts a configurable ArgoCD sync timeout and uses it for argocd app wait. The changelog composite action now force-refreshes tags before both the stable-tag check and app changelog generation.

Changes

GitOps update timeout

Layer / File(s)	Summary
ArgoCD sync timeout wiring .github/workflows/gitops-update.yml	Adds the argocd_sync_timeout workflow input, exports it as ARGOCD_SYNC_TIMEOUT, and uses it in argocd app wait --timeout while leaving argocd app sync retries unchanged.

Changelog tag refresh

Layer / File(s)	Summary
Forced tag refresh before changelog steps src/changelog/gptchangelog/action.yml	Both tag-fetch steps now use git fetch --tags --force before resolving stable tags and generating per-app changelogs.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related issues

• LerianStudio/github-actions-shared-workflows issue 508 — describes the ArgoCD sync-timeout workflow change added here.
• LerianStudio/github-actions-shared-workflows issue 381 — describes the hard-coded argocd app wait timeout addressed by this workflow update.

Possibly related PRs

• LerianStudio/github-actions-shared-workflows#510 — implements the same argocd_sync_timeout input and argocd app wait --timeout wiring.

Suggested labels

workflow, changelog, composite, size/XS

Suggested reviewers

• gandalf-at-lerian

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The template is present, but the Description, Testing, and Related Issues sections are effectively unfilled.	Add a real change summary, list the affected workflows and behavior changes, and complete the testing and related issue sections.
Title check	❓ Inconclusive	The title is related to the PR, but it is too vague to describe the actual workflow changes.	Rename it to mention the workflow fix, e.g. ArgoCD sync timeout and forced tag fetch updates.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch develop

---

_{Comment @coderabbitai help to get the list of available commands.}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}

[lerian-studio]

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	2 file(s)	✅ success
Action Lint	1 file(s)	✅ success
Pinned Actions	2 file(s)	✅ success
Markdown Link Check	no changes	⏭️ skipped
Spelling Check	2 file(s)	✅ success
Shell Check	2 file(s)	✅ success
README Check	2 file(s)	✅ success
Composite Schema	1 file(s)	✅ success
Deployment Matrix	no changes	⏭️ skipped

---

_{🔍 View full scan logs}

[lerian-studio]

🛡️ CodeQL Analysis Results

Languages analyzed: actions

Found 2 issue(s): 2 Medium

Severity	Rule	File	Message
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/gitops-update.yml:144	Potential unsafe checkout of untrusted pull request on privileged workflow.
🟡 Medium	actions/untrusted-checkout/medium	.github/workflows/gitops-update.yml:152	Potential unsafe checkout of untrusted pull request on privileged workflow.

---

_{🔍 View full scan logs | 🛡️ Security tab}

[coderabbitai]

Warning

CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.

Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.

👉 Steps to fix this

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/gitops-update.yml:
- Around line 95-98: The GitOps workflow documentation is still describing a
fixed Argo CD wait timeout instead of the caller-configurable timeout now used
by argocd_sync_timeout. Update the docs entry that describes the GitOps update
workflow to match the workflow input in gitops-update.yml, reflecting that the
wait timeout is configurable and that its default is 480 seconds rather than
180.
- Around line 95-98: Validate the argocd_sync_timeout input before it is used to
build ArgoCD CLI flags, and fail fast with a clear error if it is missing, zero,
negative, or non-integer. Add the check in the workflow path that consumes
argocd_sync_timeout so the validation happens before any argocd app wait/sync
call is made, and mirror the same validation wherever this input is reused
elsewhere in the workflow.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: b38880eb-4dd4-45f2-a3bd-9afe7a5ea646

📥 Commits

Reviewing files that changed from the base of the PR and between 9ef9377 and feecdb5.

📒 Files selected for processing (2)

• .github/workflows/gitops-update.yml
• src/changelog/gptchangelog/action.yml