Conversation
Move the post-release backmerge (backmerge_source -> backmerge_target) out of the publish_release matrix job into a dedicated 'backmerge' job that depends on generate_changelog. Previously the backmerge ran inline in publish_release, which completes before the separate generate_changelog job commits CHANGELOG.md to main. As a result main->develop was backmerged without the changelog, leaving develop missing it. The backmerge-sync composite fetches origin/<source> fresh, so ordering the job after the changelog commit guarantees the changelog is carried into the target branch. Also wires the new job into the notify job's failed-job reporting.
When on_existing_tag: skip skips build/push because the tag already exists, the cosign steps were also skipped since they depended on steps.build-push.outputs.digest and should_build != 'false'. A transient cosign/Rekor failure on an already-pushed tag then had no retry path short of a full rebuild or a brand new release. Add a 'Resolve digest for existing tag' step that resolves the digest from the existing registry tag via docker buildx imagetools inspect when the build was skipped, and gate the cosign steps on enable_cosign_sign alone, feeding steps.build-push.outputs.digest || steps.existing-digest.outputs.digest. Closes #559
Address CodeRabbit finding on PR #603: when both DockerHub and GHCR are enabled, the existing-tag digest resolution always picked DockerHub (or GHCR alone) and reused that single digest for both registries' refs. If a tag existed in only one registry, this could construct a nonexistent ref for the other registry using the wrong digest. Resolve each enabled registry's digest independently and only emit a ref for a registry when its own digest was actually found.
…t digests Address CodeRabbit findings on PR #603: - Resolve digest for existing tag: distinguish a genuine 'tag not found' from an inspect/lookup failure (transient network error, auth issue) by emitting a ::warning:: with the actual error in the latter case, instead of silently treating both as 'no digest'. Kept fail-open (skip that registry, don't abort the job) to match this file's existing convention for the same tradeoff in the pre-flight tag-existence check just above. - Report cosign signing status: stop collapsing to a single DIGEST value that discarded one registry's digest when both were resolved; REFS already lists each registry's fully-qualified ref with its own digest, so the redundant/lossy single-digest line was removed instead of duplicating that same registry-qualified data.
…rding Address CodeRabbit findings on PR #603: - Resolve digest for existing tag: percent-encode the captured 'docker buildx imagetools inspect' output (%, CR, LF) before embedding it in a ::warning:: line, so it can't corrupt or spoof a workflow command annotation. - Report cosign signing status: cosign-sign signs refs one by one, so a failure partway through the list doesn't mean every ref is unsigned. Reworded the summary to reflect that signing didn't complete for every ref instead of asserting all refs are unsigned.
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: Path: .coderabbit.yml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughThe build workflow retries cosign signing for existing tags by resolving registry digests. The release workflow moves post-release backmerge after changelog generation and reports backmerge failures through notifications. ChangesBuild signing recovery
Release backmerge sequencing
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
lerian-studio
added
size/S
Contributor
🔍 PR Validation Summary✅ PR Mergeable — no blocking failures
|
Contributor
🔍 Lint Analysis
|
Contributor
🛡️ CodeQL Analysis ResultsLanguages analyzed: Found 1 issue(s): 1 Medium
🔍 View full scan logs | 🛡️ Security tab |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/build.yml (1)
531-561: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winSign step can run with empty
image-refswhen all digest resolution fails.The sign step's guard was relaxed to just
inputs.enable_cosign_sign(line 570), butsteps.cosign-refs.outputs.refscan be empty precisely in the new skip-mode path this PR adds: ifdocker buildx imagetools inspectfails or returns no digest for every enabled registry,DOCKERHUB_FINAL/GHCR_FINALare both empty,REFSstays"", and the sign step still invokes thecosign-signcomposite. That composite documentsimage-refsas a required input with no default, per its README: .Manifest: provides the manifest or manifest list confirms the digest-extraction approach is sound, but the composite's contract statesimage-refs| Newline-separated fully qualified image references to sign (e.g.,docker.io/org/app@sha256:abc...) | Yes | — — no defined behavior for an empty value. Before this change, the sign step only ran after a successful build, sorefswas always non-empty; now the exact "recover from a transient failure" scenario this PR targets can also be the one where the sign step fires with nothing to sign, likely hard-failing the job (continue_gitops_on_signing_failuredefaults false) even though the earlier per-registry::warning::messages already explained why no digest was found.Guard the sign step against an empty refs list; the existing per-registry warnings already cover user-facing diagnostics for that case.
🔧 Proposed fix
- name: Sign container images with cosign - if: inputs.enable_cosign_sign + if: inputs.enable_cosign_sign && steps.cosign-refs.outputs.refs != '' id: cosign-signAlso applies to: 569-578
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build.yml around lines 531 - 561, Update the cosign sign step guard near the cosign-refs output so it runs only when inputs.enable_cosign_sign is enabled and steps.cosign-refs.outputs.refs is non-empty. Preserve the existing signing behavior when valid image references are produced, while skipping the composite action when digest resolution leaves refs empty.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build.yml:
- Around line 507-529: Extract the duplicated registry digest inspection in the
DockerHub and GHCR sections into a shared helper that accepts the image
reference and output key, then invoke it for both registries. In that helper,
capture stdout separately from stderr so only valid JSON reaches jq; retain the
existing warnings for missing digests and inspection failures, using
escape_for_warning for failure details.
In @.github/workflows/release.yml:
- Around line 500-507: Add a successful publish_release result requirement to
the backmerge job’s if condition alongside the existing publish_release_status
check. Keep the current always(), input, branch, and downstream-job conditions
unchanged so backmerge only runs after the entire release matrix succeeds.
- Line 508: Update the reusable-workflow job’s runs-on setting to use the
mandated blacksmith-4vcpu-ubuntu-2404 runner instead of the inputs.runner_type
expression, while leaving the rest of the job unchanged.
---
Outside diff comments:
In @.github/workflows/build.yml:
- Around line 531-561: Update the cosign sign step guard near the cosign-refs
output so it runs only when inputs.enable_cosign_sign is enabled and
steps.cosign-refs.outputs.refs is non-empty. Preserve the existing signing
behavior when valid image references are produced, while skipping the composite
action when digest resolution leaves refs empty.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 491d194b-daf9-45b4-a037-83334ead5022
📒 Files selected for processing (3)
.github/workflows/build.yml.github/workflows/release.ymldocs/build-workflow.md
Address CodeRabbit finding on PR #604: 'docker buildx imagetools inspect ... 2>&1' merged stderr into the same variable later fed to jq on the success path. Any stderr chatter on an otherwise-successful call (deprecation notice, credential-helper output) would corrupt the JSON and produce a false 'no digest' warning. Extracted the duplicated DockerHub/GHCR inspect logic into a resolve_digest() helper that captures stdout and stderr separately (stderr to a temp file, consumed only for the warning message on failure), so a successful call is never at risk of stderr noise breaking the digest parse.
There was a problem hiding this comment.
Warning
CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.
Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build.yml:
- Around line 503-520: Update resolve_digest and its callers to propagate a
distinct lookup-failure status instead of treating failures as an empty digest.
Preserve empty-digest handling for genuinely absent tags, but ensure lines
554-563 detect any existing registry whose resolution failed, prevent partial
cosign success, and invoke the reporting/failure path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 62b03d2a-3e08-4dfc-b17f-e92887218e7d
📒 Files selected for processing (1)
.github/workflows/build.yml
Address CodeRabbit finding on PR #604: when on_existing_tag: skip retries signing across multiple registries, a genuine registry lookup failure (as opposed to a confirmed-absent tag) collapsed to an empty digest just like a normal 'not found', so that registry was silently excluded from signing. If the OTHER enabled registry resolved fine, cosign-sign succeeded for it, and the failure report step (gated only on cosign-sign's own outcome) never ran -- leaving one registry's already-published image unsigned with no visible failure signal beyond a log warning. resolve_digest() now also reports whether the lookup itself failed (vs. the tag being genuinely absent). Build cosign image references aggregates that into a has_lookup_error output, and Report cosign signing status now fires on either cosign-sign failing OR a lookup error, so a partially-unverified multi-registry signing run is always visibly reported instead of looking like a clean success.
bedatty
requested a deployment
to
create_release
July 22, 2026 16:29 — with 
GitHub Actions
In progress
GitHub Actions
In progress
lerian-studio
added
size/M
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GitHub Actions Shared Workflows
Description
Type of Change
feat: New workflow or new input/output/step in an existing workflowfix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)perf: Performance improvement (e.g. caching, parallelism, reduced steps)refactor: Internal restructuring with no behavior changedocs: Documentation only (README, docs/, inline comments)ci: Changes to self-CI (workflows under.github/workflows/that run on this repo)chore: Dependency bumps, config updates, maintenancetest: Adding or updating testsBREAKING CHANGE: Callers must update their configuration after this PRBreaking Changes
None.
Testing
@this-branchor the beta tagCaller repo / workflow run:
Related Issues
Closes #