Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

.github/workflows/deploy-pr.yml (1)

133-134: Fix negative/invalid route priorities (duplicate of earlier review).

NEXT_PRIORITY can become negative when no rules or when min=0. Clamp to non‑negative as previously noted.

Apply one of these minimal fixes:

-          export MIN_PRIORITY=$(yq '[.pathMatchers[] | select(.name == "all-paths") | .routeRules[]?.priority] | min // 0' config.yml)
-          export NEXT_PRIORITY=$((MIN_PRIORITY - 1))
+          export MIN_PRIORITY=$(yq '[.pathMatchers[] | select(.name == "all-paths") | .routeRules[]?.priority] | min // 1' config.yml)
+          if [ "$MIN_PRIORITY" -le 0 ]; then
+            export NEXT_PRIORITY=0
+          else
+            export NEXT_PRIORITY=$((MIN_PRIORITY - 1))
+          fi

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

.github/workflows/deploy-pr.yml (1)

133-140: Fix priority math, avoid negative/duplicate priorities, remove brittle yq quoting, and stop assuming pathMatchers[0]

• NEXT_PRIORITY can be -1; also incrementing it per label can collide with existing min priority.
• Single-quoted yq with inline shell interpolation is brittle; pass vars via env and use yq env/strenv.
• Do not assume .pathMatchers[0] is "all-paths"; select by name.

Use label count to allocate unique priorities strictly below existing min, clamp at 0, update the matcher by name, and pass vars via env:

-          export MIN_PRIORITY=$(yq '[.pathMatchers[] | select(.name == "all-paths") | .routeRules[]?.priority] | min // 0' config.yml)
-          export NEXT_PRIORITY=$((MIN_PRIORITY - 1))
-          LABELS_JSON=$(echo "$LABELS" | jq -c '[.[] | select(.name | test("\\.ghost\\.is$")) | .name]')
-          for LABEL in $(echo "$LABELS_JSON" | jq -r '.[]'); do
-            echo "Adding route for label: $LABEL"
-            yq -i '.pathMatchers[0].routeRules = [{"priority": '${NEXT_PRIORITY}', "matchRules": [{"prefixMatch": "/", "headerMatches": [{"headerName": "X-Forwarded-Host", "exactMatch": "'"${LABEL}"'"}]}], "routeAction": {"weightedBackendServices": [{"backendService": "'"${PR_SERVICE}"'", "weight": 100}]}, "headerAction": {"requestHeadersToAdd": [{"headerName": "X-ActivityPub-PR", "headerValue": "${{ github.event.pull_request.number }}"}, {"headerName": "X-ActivityPub-Commit", "headerValue": "${{ github.event.pull_request.head.sha }}"}]}}] + .pathMatchers[0].routeRules' config.yml
-            export NEXT_PRIORITY=$((NEXT_PRIORITY + 1))
-          done
+          LABELS_JSON=$(echo "$LABELS" | jq -c '[.[] | select(.name | test("\\.ghost\\.is$")) | .name]')
+          LABEL_COUNT=$(echo "$LABELS_JSON" | jq 'length')
+          export MIN_PRIORITY=$(yq '[.pathMatchers[] | select(.name == "all-paths") | .routeRules[]?.priority] | min // 1' config.yml)
+          if [ "$MIN_PRIORITY" -le 0 ]; then
+            export BASE_PRIORITY=0
+          else
+            # Allocate a contiguous block below existing min to avoid collisions
+            if [ "$LABEL_COUNT" -gt 0 ]; then
+              export BASE_PRIORITY=$((MIN_PRIORITY - LABEL_COUNT))
+            else
+              export BASE_PRIORITY=$((MIN_PRIORITY - 1))
+            fi
+            if [ "$BASE_PRIORITY" -lt 0 ]; then
+              export BASE_PRIORITY=0
+            fi
+          fi
+          i=0
+          for LABEL in $(echo "$LABELS_JSON" | jq -r '.[]'); do
+            PRI=$((BASE_PRIORITY + i))
+            echo "Adding route for label: $LABEL with priority $PRI"
+            LABEL="$LABEL" PRI="$PRI" yq -i '
+              .pathMatchers |= map(
+                if .name == "all-paths" then
+                  .routeRules = ([{
+                    "priority": (env(PRI) | tonumber),
+                    "matchRules": [{
+                      "prefixMatch": "/",
+                      "headerMatches": [{
+                        "headerName": "X-Forwarded-Host",
+                        "exactMatch": strenv(LABEL)
+                      }]
+                    }],
+                    "routeAction": {
+                      "weightedBackendServices": [{
+                        "backendService": strenv(PR_SERVICE),
+                        "weight": 100
+                      }]
+                    },
+                    "headerAction": {
+                      "requestHeadersToAdd": [
+                        {"headerName": "X-ActivityPub-PR", "headerValue": "${{ github.event.pull_request.number }}"},
+                        {"headerName": "X-ActivityPub-Commit", "headerValue": "${{ github.event.pull_request.head.sha }}"}
+                      ]
+                    }
+                  }] + .routeRules)
+                else .
+                end
+              )' config.yml
+            i=$((i + 1))
+          done

Notes:

• min // 1 avoids negative when empty; BASE_PRIORITY block guarantees unique, non-negative priorities.
• strenv(...) and env(...) remove quoting pitfalls and ensure correct types.
• Selecting by name avoids relying on index order.

.github/workflows/deploy-pr.yml (1)

106-111: Harden loop over test DB names

Quote expansions to avoid word-splitting and handle empty sets safely.

Apply:

-          TEST_DATABASES=$(gcloud sql databases list --instance=stg-netherlands-activitypub --filter="name~pr_${{ github.event.pull_request.number }}_test*" --format="value(name)" --project ${GCP_PROJECT})
-          for TEST_DATABASE in ${TEST_DATABASES}; do
-            gcloud sql databases delete ${TEST_DATABASE} --instance=stg-netherlands-activitypub --quiet --project ${GCP_PROJECT}
-          done
+          TEST_DATABASES="$(gcloud sql databases list --instance=stg-netherlands-activitypub --filter="name~pr_${{ github.event.pull_request.number }}_test*" --format="value(name)" --project "${GCP_PROJECT}")"
+          if [ -n "$TEST_DATABASES" ]; then
+            while IFS= read -r TEST_DATABASE; do
+              [ -z "$TEST_DATABASE" ] && continue
+              gcloud sql databases delete "$TEST_DATABASE" --instance=stg-netherlands-activitypub --quiet --project "${GCP_PROJECT}"
+            done <<< "$TEST_DATABASES"
+          fi

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

.github/workflows/deploy-pr.yml (2)

133-134: Critical: Guard against negative route priorities.

When MIN_PRIORITY defaults to 0 (no existing rules), NEXT_PRIORITY becomes -1, which Cloud Load Balancer rejects (valid range: 0..2147483647). This will cause import failures.

Apply this diff to clamp the priority:

-          export MIN_PRIORITY=$(yq '[.pathMatchers[] | select(.name == "all-paths") | .routeRules[]?.priority] | min // 0' config.yml)
-          export NEXT_PRIORITY=$((MIN_PRIORITY - 1))
+          export MIN_PRIORITY=$(yq '[.pathMatchers[] | select(.name == "all-paths") | .routeRules[]?.priority] | min // 1' config.yml)
+          if [ "$MIN_PRIORITY" -le 0 ]; then
+            export NEXT_PRIORITY=0
+          else
+            export NEXT_PRIORITY=$((MIN_PRIORITY - 1))
+          fi

---

138-139: Fix inconsistent priority increment logic.

The loop starts with NEXT_PRIORITY = MIN_PRIORITY - 1 (higher priority) but then increments it. This means:

• 1st label: priority = MIN - 1 (highest)
• 2nd label: priority = MIN (conflicts with existing rules)
• 3rd+ labels: priority > MIN (lower priority than intended)

All labels for this PR should either share the same priority or decrement consistently.

Apply this diff to use consistent priority:

           for LABEL in $(echo "$LABELS_JSON" | jq -r '.[]'); do
             echo "Adding route for label: $LABEL"
             yq -i '.pathMatchers[0].routeRules = [{"priority": '${NEXT_PRIORITY}', "matchRules": [{"prefixMatch": "/", "headerMatches": [{"headerName": "X-Forwarded-Host", "exactMatch": "'"${LABEL}"'"}]}], "routeAction": {"weightedBackendServices": [{"backendService": "'"${PR_SERVICE}"'", "weight": 100}]}, "headerAction": {"requestHeadersToAdd": [{"headerName": "X-ActivityPub-PR", "headerValue": "${{ github.event.pull_request.number }}"}, {"headerName": "X-ActivityPub-Commit", "headerValue": "${{ github.event.pull_request.head.sha }}"}]}}] + .pathMatchers[0].routeRules' config.yml
-            export NEXT_PRIORITY=$((NEXT_PRIORITY + 1))
           done

.github/workflows/deploy-pr.yml (1)

138-138: Consider more robust variable interpolation.

While the current shell quoting pattern may work, using yq's env() and strenv() functions is more reliable and avoids YAML parsing edge cases.

Apply this diff for safer variable handling:

-            yq -i '.pathMatchers[0].routeRules = [{"priority": '${NEXT_PRIORITY}', "matchRules": [{"prefixMatch": "/", "headerMatches": [{"headerName": "X-Forwarded-Host", "exactMatch": "'"${LABEL}"'"}]}], "routeAction": {"weightedBackendServices": [{"backendService": "'"${PR_SERVICE}"'", "weight": 100}]}, "headerAction": {"requestHeadersToAdd": [{"headerName": "X-ActivityPub-PR", "headerValue": "${{ github.event.pull_request.number }}"}, {"headerName": "X-ActivityPub-Commit", "headerValue": "${{ github.event.pull_request.head.sha }}"}]}}] + .pathMatchers[0].routeRules' config.yml
+            NEXT_PRIORITY="$NEXT_PRIORITY" LABEL="$LABEL" PR_SERVICE="$PR_SERVICE" yq -i '
+              .pathMatchers[0].routeRules = [{
+                "priority": (env(NEXT_PRIORITY) | tonumber),
+                "matchRules": [{
+                  "prefixMatch": "/",
+                  "headerMatches": [{
+                    "headerName": "X-Forwarded-Host",
+                    "exactMatch": strenv(LABEL)
+                  }]
+                }],
+                "routeAction": {
+                  "weightedBackendServices": [{
+                    "backendService": strenv(PR_SERVICE),
+                    "weight": 100
+                  }]
+                },
+                "headerAction": {
+                  "requestHeadersToAdd": [
+                    {"headerName": "X-ActivityPub-PR", "headerValue": "${{ github.event.pull_request.number }}"},
+                    {"headerName": "X-ActivityPub-Commit", "headerValue": "${{ github.event.pull_request.head.sha }}"}
+                  ]
+                }
+              }] + .pathMatchers[0].routeRules
+            ' config.yml

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro