fix(release): develop to main by bedatty · Pull Request #632 · LerianStudio/github-actions-shared-workflows

bedatty · 2026-07-29T18:41:29Z

	GitHub Actions Shared Workflows

Description

Type of Change

feat: New workflow or new input/output/step in an existing workflow
fix: Bug fix in a workflow (incorrect behavior, broken step, wrong condition)
perf: Performance improvement (e.g. caching, parallelism, reduced steps)
refactor: Internal restructuring with no behavior change
docs: Documentation only (README, docs/, inline comments)
ci: Changes to self-CI (workflows under .github/workflows/ that run on this repo)
chore: Dependency bumps, config updates, maintenance
test: Adding or updating tests
BREAKING CHANGE: Callers must update their configuration after this PR

Breaking Changes

None.

Testing

YAML syntax validated locally
Triggered a real workflow run on a caller repository using @this-branch or the beta tag
Verified all existing inputs still work with default values
Confirmed no secrets or tokens are printed in logs
Checked that unrelated workflows are not affected

Caller repo / workflow run:

Related Issues

Closes #

Bumps the security-scanners group with 1 update: [trufflesecurity/trufflehog](https://github.com/trufflesecurity/trufflehog). Updates `trufflesecurity/trufflehog` from 3.95.9 to 3.96.0 - [Release notes](https://github.com/trufflesecurity/trufflehog/releases) - [Commits](trufflesecurity/trufflehog@27b0417...6f3c981) --- updated-dependencies: - dependency-name: trufflesecurity/trufflehog dependency-version: 3.96.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: security-scanners ... Signed-off-by: dependabot[bot] <support@github.com>

Add an announce_release job to release.yml that calls release-notification.yml after a successful release, routing the announcement per repository: channel from announcement_slack_channel or the RELEASE_SLACK_CHANNEL variable, webhook from the RELEASE_WEBHOOK_URL secret (RELEASE_WEBHOOK_NOTIFICATION_URL kept as fallback). The job is skipped when no channel is configured and the notification step is skipped when the webhook secret is absent. release-notification.yml gains an optional release_tag input so the umbrella announces the tag actually published by the run instead of the newest release in the repository, which was wrong for monorepo matrix legs. go-release.yml and js-release.yml expose the three new inputs and pass them through to release.yml. Discord is not wired into the umbrella job: SethCohen/github-releases-to-discord reads the release event payload, absent on the push event that drives release.yml. Discord announcements stay on a dedicated on: release caller.

@vn

The Discord and Slack release composites were pinned to @v1.18.0, which the pinned-actions lint flags: internal composites must use the floating major tag (@vn) while internal reusable workflows use an exact version. Aligns both refs with the rest of the repository.

CodeQL flagged the dry-run summary step for interpolating product_name, slack_channel and the resolved release tag straight into the run block. Every value now reaches bash as an environment variable, and the discord/slack enable flags are computed in shell instead of via expression interpolation.

…629)

… the security-scanners group (#616) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

coderabbitai · 2026-07-29T18:41:47Z

Summary by CodeRabbit

New Features
- Added configurable Slack release announcements, including enablement, product name, and channel settings.
- Added release tag overrides for notification workflows.
- Added multi-image Kustomize mappings with fallback handling for unmapped artifacts.
- Updated release notifications to use current channel integrations.
Bug Fixes
- Improved validation and routing of Kustomize image references.
Documentation
- Expanded workflow documentation with announcement configuration and multi-image Kustomize examples.
Chores
- Updated the secret-scanning action version.

Walkthrough

Changes

The reusable release workflows now support configurable Slack announcements and release-tag overrides. GitOps Kustomize tagging supports per-artifact image mappings with fallback behavior. Related documentation and the TruffleHog action version are also updated.

Kustomize image routing

Layer / File(s)	Summary
Kustomize contract and workflow wiring `.github/workflows/gitops-update.yml`, `.github/workflows/go-release.yml`	Adds, validates, and forwards `kustomize_image_mappings` alongside the fallback image name.
Per-artifact image application `.github/workflows/gitops-update.yml`, `docs/gitops-update-workflow.md`, `docs/go-release-workflow.md`	Maps artifact-derived app names to Kustomize image references, falls back when configured, and skips unresolved artifacts with warnings.

Release announcements

Layer / File(s)	Summary
Announcement input propagation `.github/workflows/go-release.yml`, `.github/workflows/js-release.yml`, `docs/go-release-workflow.md`, `docs/js-release.md`	Adds announcement configuration inputs and passes them through reusable workflows.
Announcement job and tag resolution `.github/workflows/release.yml`, `.github/workflows/release-notification.yml`	Adds a conditional announcement job and resolves tags from the input, release event, or latest release.
Notification delivery and documentation `.github/workflows/release-notification.yml`, `docs/release-notification.md`, `docs/release-workflow.md`	Updates dry-run state reporting, notification action references, and announcement documentation.

Security action update

Layer / File(s)	Summary
TruffleHog action version `.github/workflows/go-security.yml`	Updates the pinned TruffleHog action from v3.95.9 to v3.96.0.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

LerianStudio/github-actions-shared-workflows#631 — Implements the same per-artifact Kustomize image mapping behavior.
LerianStudio/github-actions-shared-workflows#629 — Overlaps with the release-announcement workflow changes.
LerianStudio/github-actions-shared-workflows#609 — Related to forwarding Kustomize inputs through the Go release workflow.

Suggested labels: documentation, workflow, golang, security, notify, validate

Suggested reviewers: ferr3ira-gabriel

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title describes a branch merge, but the PR changes workflows and docs around release announcements, GitOps kustomize, and security updates.	Rename it to reflect the main user-facing change, e.g. "feat(release): add Slack announcements and kustomize image mappings".
Description check	⚠️ Warning	The description is still the repository template with no filled summary, type selection, testing details, or related-issue links.	Fill in the Description, Type of Change, Testing, and Related Issues sections, and note any breaking-change impact if applicable.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch develop

_{Comment @coderabbitai help to get the list of available commands.}

lerian-studio · 2026-07-29T18:42:42Z

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

_{🔍 View workflow run}

lerian-studio · 2026-07-29T18:42:54Z

🔍 Lint Analysis

Check	Files Scanned	Status
YAML Lint	6 file(s)	✅ success
Action Lint	6 file(s)	✅ success
Pinned Actions	6 file(s)	✅ success
Markdown Link Check	5 file(s)	✅ success
Spelling Check	11 file(s)	✅ success
Shell Check	6 file(s)	✅ success
README Check	6 file(s)	✅ success
Composite Schema	no changes	⏭️ skipped
Deployment Matrix	no changes	⏭️ skipped

_{🔍 View full scan logs}

lerian-studio · 2026-07-29T18:44:05Z

🛡️ CodeQL Analysis Results

Languages analyzed: actions

Found 2 issue(s): 2 Medium

Severity	Rule	File	Message
🟡 Medium	`actions/untrusted-checkout/medium`	`.github/workflows/gitops-update.yml:168`	Potential unsafe checkout of untrusted pull request on non-privileged workflow.
🟡 Medium	`actions/untrusted-checkout/medium`	`.github/workflows/gitops-update.yml:186`	Potential unsafe checkout of untrusted pull request on non-privileged workflow.

_{🔍 View full scan logs | 🛡️ Security tab}

coderabbitai

Warning

CodeRabbit couldn't request changes on this pull request because it doesn't have sufficient GitHub permissions.

Please grant CodeRabbit Pull requests: Read and write permission and re-run the review.

👉 Steps to fix this

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/gitops-update-workflow.md`:
- Around line 118-121: Update the notes describing artifact resolution so they
only state the fallback for artifacts absent from the mapping when
kustomize_image_name is empty. Remove the claim that empty mapping entries are
skipped with a warning, since workflow validation rejects those values.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: ASSERTIVE

Plan: Pro

Run ID: ae1697b9-419b-4241-b4e4-4299b64cb0d4

📥 Commits

Reviewing files that changed from the base of the PR and between 6a2dfc0 and 65ffb8f.

📒 Files selected for processing (11)

.github/workflows/gitops-update.yml
.github/workflows/go-release.yml
.github/workflows/go-security.yml
.github/workflows/js-release.yml
.github/workflows/release-notification.yml
.github/workflows/release.yml
docs/gitops-update-workflow.md
docs/go-release-workflow.md
docs/js-release.md
docs/release-notification.md
docs/release-workflow.md

dependabot Bot and others added 8 commits July 27, 2026 11:16

chore(release): backmerge main into develop [skip ci]

898be5f

feat(release): announce releases from the release umbrella workflow (#…

0acdda6

…629)

fix(gitops): resolve kustomize image per gitops tag artifact (#631)

a4e5845

chore(deps): bump trufflesecurity/trufflehog from 3.95.9 to 3.96.0 in…

65ffb8f

… the security-scanners group (#616) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

bedatty requested a review from a team as a code owner July 29, 2026 18:41

lerian-studio assigned bedatty Jul 29, 2026

coderabbitai Bot reviewed Jul 29, 2026

View reviewed changes

Comment thread docs/gitops-update-workflow.md

bedatty merged commit 29551c8 into main Jul 29, 2026
30 checks passed

coderabbitai Bot approved these changes Jul 29, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(release): develop to main - #632

fix(release): develop to main#632
bedatty merged 8 commits into
mainfrom
develop

bedatty commented Jul 29, 2026

GitHub Actions Shared Workflows

Uh oh!

coderabbitai Bot commented Jul 29, 2026 •

edited

Loading

❌ Failed checks (2 warnings)

Uh oh!

lerian-studio commented Jul 29, 2026

Uh oh!

lerian-studio commented Jul 29, 2026

Uh oh!

lerian-studio commented Jul 29, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

bedatty commented Jul 29, 2026

GitHub Actions Shared Workflows

Description

Type of Change

Breaking Changes

Testing

Related Issues

Uh oh!

coderabbitai Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Walkthrough

Changes

❌ Failed checks (2 warnings)

Uh oh!

lerian-studio commented Jul 29, 2026

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Uh oh!

lerian-studio commented Jul 29, 2026

🔍 Lint Analysis

Uh oh!

lerian-studio commented Jul 29, 2026

🛡️ CodeQL Analysis Results

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Jul 29, 2026 •

edited

Loading