fix(release): develop to main by bedatty · Pull Request #625 · LerianStudio/github-actions-shared-workflows

bedatty · 2026-07-27T21:13:52Z

	GitHub Actions Shared Workflows

Description

Type of Change

feat: New workflow or new input/output/step in an existing workflow
fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
perf: Performance improvement (e.g. caching, parallelism, reduced steps)
refactor: Internal restructuring with no behavior change
docs: Documentation only (README, docs/, inline comments)
ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
chore: Dependency bumps, config updates, maintenance
test: Adding or updating tests
BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None.

Testing

YAML syntax validated locally
Triggered a real workflow run on a caller repository using @this-branch or the beta tag
Verified all existing inputs still work with default values
Confirmed no secrets or tokens are printed in logs
Checked that unrelated workflows are not affected

Caller repo / workflow run:

Related Issues

Closes #

coderabbitai · 2026-07-27T21:14:08Z

Walkthrough

The reusable Go workflows add configurable integration-test, determinism, and custom-check inputs; execute validated Make targets conditionally; include custom-check failures in Slack status reporting; handle edited pull request events; and document the updated workflow contract.

Changes

Go workflow validation

Layer / File(s)	Summary
Validation inputs and change detection `.github/workflows/go-pr-validation.yml`, `docs/go-pr-validation.md`	Adds integration-test, determinism, and custom-check inputs; forwards them to Go analysis, defaults integration tests, handles edited pull request events, and documents the inputs and gate behavior.
Conditional custom-check execution `.github/workflows/go-pr-analysis.yml`	Adds an opt-in job that validates and runs newline-separated Make targets, aggregating failures.
Aggregated notification status `.github/workflows/go-pr-analysis.yml`	Includes custom-check results in Slack notification dependencies, status, and failed-job reporting.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

LerianStudio/github-actions-shared-workflows#623: Adds the matching custom-check inputs, job, and Slack status integration.
LerianStudio/github-actions-shared-workflows#624: Updates change detection for edited pull request events.
LerianStudio/github-actions-shared-workflows#626: Adjusts empty custom-check handling and related workflow wiring.

Suggested labels: documentation, workflow, size/M, golang, validate

Suggested reviewers: ferr3ira-gabriel

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title refers to a release branch merge, but the PR actually changes GitHub workflow inputs and jobs.	Rename it to describe the workflow change, e.g. add custom checks and validation inputs to the Go PR workflows.
Description check	⚠️ Warning	The template is present, but the Description, Type of Change, Testing, and Related Issues sections are left empty or placeholder-only.	Fill in the PR summary, select the relevant change type, document validation performed, and add any related issue or link.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch develop

_{Comment @coderabbitai help to get the list of available commands.}

lerian-studio · 2026-07-27T21:14:34Z

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

_{🔍 View workflow run}

lerian-studio · 2026-07-27T21:15:13Z

🛡️ CodeQL Analysis Results

Languages analyzed: actions

✅ No security issues found.

5 finding(s) hidden (dismissed or fixed). See the Security tab for the full list.

_{🔍 View full scan logs | 🛡️ Security tab}

lerian-studio · 2026-07-27T21:15:19Z

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	2 file(s)	✅ success
Action Lint	2 file(s)	✅ success
Pinned Actions	2 file(s)	✅ success
Markdown Link Check	1 file(s)	✅ success
Spelling Check	3 file(s)	✅ success
Shell Check	2 file(s)	✅ success
README Check	2 file(s)	✅ success
Composite Schema	no changes	⏭️ skipped
Deployment Matrix	no changes	⏭️ skipped

_{🔍 View full scan logs}

coderabbitai

Warning

CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.

Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.

👉 Steps to fix this

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/go-pr-analysis.yml:
- Around line 918-1009: Update the custom-checks job gating around custom-checks
and the “Run custom checks” step so that enabling custom checks with an empty
custom_checks value produces a visible warning annotation instead of silently
skipping; preserve normal target validation and failure aggregation for
non-empty CUSTOM_CHECKS.

In @.github/workflows/go-pr-validation.yml:
- Around line 279-285: Remove the hardcoded fallback from
integration_test_command in the go-pr-validation workflow and pass
inputs.integration_test_command through unchanged, allowing go-pr-analysis to
apply its own default. Update the adjacent comment to accurately describe this
delegation while preserving the remaining workflow inputs.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 11220e17-1ed6-4990-82b7-23c2adfe9ba2

📥 Commits

Reviewing files that changed from the base of the PR and between 65c07ab and 198eaac.

📒 Files selected for processing (3)

.github/workflows/go-pr-analysis.yml
.github/workflows/go-pr-validation.yml
docs/go-pr-validation.md

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/go-pr-analysis.yml (1)
975-981: 🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy lift

Do not expose MANAGE_TOKEN to custom-check code.

This step writes a token-bearing URL to global Git configuration, then the job executes arbitrary make "$target" commands from the checked-out repository. A target can read ~/.gitconfig and exfiltrate the token; persist-credentials: false does not mitigate this. Run custom checks in a secretless job, or remove the credentialed configuration before any caller-supplied command executes. If private-module access is required, do not run untrusted Makefiles in the same privileged job.

As per coding guidelines, secrets must not be passed to steps that run fork code.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/go-pr-analysis.yml around lines 975 - 981, Remove
MANAGE_TOKEN exposure from the job that executes caller-supplied make "$target"
commands: do not configure a token-bearing global Git URL before custom checks
run. Keep private-module authentication isolated to a trusted, secret-bearing
job or remove the credentialed Git configuration before invoking the custom
target, ensuring fork-controlled Makefiles execute without any secret available.
Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/go-pr-analysis.yml:
- Around line 975-981: Remove MANAGE_TOKEN exposure from the job that executes
caller-supplied make "$target" commands: do not configure a token-bearing global
Git URL before custom checks run. Keep private-module authentication isolated to
a trusted, secret-bearing job or remove the credentialed Git configuration
before invoking the custom target, ensuring fork-controlled Makefiles execute
without any secret available.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 3e194b3c-240a-4d9a-83a5-d62e94222115

📥 Commits

Reviewing files that changed from the base of the PR and between 198eaac and 9da1f0a.

📒 Files selected for processing (2)

.github/workflows/go-pr-analysis.yml
.github/workflows/go-pr-validation.yml

lerian-studio and others added 4 commits July 27, 2026 16:59

chore(release): backmerge main into develop [skip ci]

42d7669

fix(go-pr-validation): run the change detector on edited PRs

83ef941

fix(go-pr-validation): run the change detector on edited PRs (#624)

d0e9eb1

fix(go-pr-validation,go-pr-analysis): add custom_checks gate (#623)

198eaac

bedatty requested a review from a team as a code owner July 27, 2026 21:13

coderabbitai Bot reviewed Jul 27, 2026

View reviewed changes

Comment thread .github/workflows/go-pr-analysis.yml

Comment thread .github/workflows/go-pr-validation.yml Outdated

fix(go-pr-analysis): warn when custom_checks is enabled but empty

e1bd3dd

bedatty mentioned this pull request Jul 27, 2026

fix(go-pr-analysis): warn when custom_checks is enabled but empty #626

Merged

6 tasks

coderabbitai Bot previously approved these changes Jul 27, 2026

View reviewed changes

fix(go-pr-analysis): warn when custom_checks is enabled but empty (#626)

9da1f0a

bedatty dismissed coderabbitai[bot]’s stale review via 9da1f0a July 27, 2026 21:49

bedatty temporarily deployed to create_release July 27, 2026 21:49 — with GitHub Actions Inactive

bedatty changed the title ~~fix(release) develop to main~~ fix(release): develop to main Jul 27, 2026

lerian-studio assigned bedatty Jul 27, 2026

lerian-studio added size/S PR changes 50–199 lines documentation Improvements or additions to documentation workflow Changes to one or more reusable workflow files golang Changes to Go-related workflows validate Changes to PR validation composite actions (src/validate/) labels Jul 27, 2026

coderabbitai Bot reviewed Jul 27, 2026

View reviewed changes

coderabbitai Bot approved these changes Jul 27, 2026

View reviewed changes

bedatty merged commit 4294c51 into main Jul 27, 2026
44 of 45 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(release): develop to main - #625

fix(release): develop to main#625
bedatty merged 6 commits into
mainfrom
develop

bedatty commented Jul 27, 2026

GitHub Actions Shared Workflows

Uh oh!

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

❌ Failed checks (2 warnings)

Uh oh!

lerian-studio commented Jul 27, 2026 •

edited

Loading

Uh oh!

lerian-studio commented Jul 27, 2026 •

edited

Loading

Uh oh!

lerian-studio commented Jul 27, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

bedatty commented Jul 27, 2026

GitHub Actions Shared Workflows

Description

Type of Change

Breaking Changes

Testing

Related Issues

Uh oh!

coderabbitai Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (2 warnings)

Uh oh!

lerian-studio commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Uh oh!

lerian-studio commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛡️ CodeQL Analysis Results

Uh oh!

lerian-studio commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔍 Lint Analysis

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jul 27, 2026 •

edited

Loading

lerian-studio commented Jul 27, 2026 •

edited

Loading

lerian-studio commented Jul 27, 2026 •

edited

Loading

lerian-studio commented Jul 27, 2026 •

edited

Loading