Version bumps#28
Conversation
|
Warning Review limit reached
More reviews will be available in 32 minutes and 37 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR bumps the Apache base image to httpd:2.4.67-alpine and modernizes the GitHub Actions workflow: explicit per-arch runners, upgraded actions (checkout/buildx/login/build-push), registry caching per-arch, disabled provenance/SBOM, and merged multi-arch test artifact validation. ChangesBase Image Upgrade
CI/CD Pipeline Modernization
🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/default.yaml (2)
51-77: 💤 Low valueConsider pinning actions to SHA hashes for supply chain security.
Static analysis flags all action references as unpinned. While version tags (e.g.,
@v6) are common practice, pinning to commit SHAs provides stronger protection against compromised action repositories.Example for checkout:
uses: actions/checkout@<full-sha-hash> # v6This is optional given the project's established pattern of using version tags.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/default.yaml around lines 51 - 77, The workflow currently uses floating tags for actions (e.g., actions/checkout@v6, docker/setup-buildx-action@v4, docker/login-action@v4, docker/build-push-action@v7); replace each `uses:` reference with the corresponding full commit SHA for that action repository (pin the commit hash for actions/checkout, docker/setup-buildx-action, docker/login-action, docker/build-push-action) so the job uses an immutable reference — locate the four `uses:` lines in the checkout, setup-buildx, login, and build-push steps and update them to the approved full-sha values.
131-132: 💤 Low valueConsider disabling credential persistence.
Static analysis flags that
persist-credentialsis not set tofalse. While unlikely to be exploited in this context, setting it explicitly prevents Git credentials from persisting in the runner workspace.name: Checkout uses: actions/checkout@v6 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/default.yaml around lines 131 - 132, The Checkout step using actions/checkout@v6 leaves Git credentials persisted; update the Checkout step (the step named "Checkout" that uses actions/checkout@v6) to explicitly set persist-credentials: false so credentials are not stored in the runner workspace (add the persist-credentials: false input under that step).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@Dockerfile`:
- Line 1: The Dockerfile's ARG UPSTREAM_IMAGE currently uses the floating tag
"httpd:2.4-alpine"; change it to the pinned patch version "httpd:2.4.67-alpine"
so builds match the Makefile/docs and are reproducible and easier to track for
vulnerabilities—update the ARG UPSTREAM_IMAGE value and any related references
or README/docs to use the same pinned tag to keep consistency.
In `@README.md`:
- Line 7: README currently documents the base image as "httpd:2.4.67-alpine" but
the CI/workflow uses "httpd:2.4-alpine"; pick one and make them consistent by
either updating README.md to "httpd:2.4-alpine" or updating the workflow input
to "httpd:2.4.67-alpine"; search for the strings "httpd:2.4.67-alpine" and
"httpd:2.4-alpine" and change the mismatched occurrence(s) (e.g., the README
entry or the workflow IMAGE/BASE_IMAGE variable) so both sources match exactly.
---
Nitpick comments:
In @.github/workflows/default.yaml:
- Around line 51-77: The workflow currently uses floating tags for actions
(e.g., actions/checkout@v6, docker/setup-buildx-action@v4,
docker/login-action@v4, docker/build-push-action@v7); replace each `uses:`
reference with the corresponding full commit SHA for that action repository (pin
the commit hash for actions/checkout, docker/setup-buildx-action,
docker/login-action, docker/build-push-action) so the job uses an immutable
reference — locate the four `uses:` lines in the checkout, setup-buildx, login,
and build-push steps and update them to the approved full-sha values.
- Around line 131-132: The Checkout step using actions/checkout@v6 leaves Git
credentials persisted; update the Checkout step (the step named "Checkout" that
uses actions/checkout@v6) to explicitly set persist-credentials: false so
credentials are not stored in the runner workspace (add the persist-credentials:
false input under that step).
🪄 Autofix (Beta)
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: fd8a963b-8fd5-44ad-9506-67395aea503f
📒 Files selected for processing (4)
.github/workflows/default.yamlDockerfileMakefileREADME.md
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. Fixes Applied SuccessfullyFixed 1 file(s) based on 2 unresolved review comments. Files modified:
Commit: The changes have been pushed to the Time taken:
Lines 44–50 ARCH: ${{ matrix.arch }}
VERSION_PREFIX: ""
VERSION: ${{ matrix.version }}
- UPSTREAM_IMAGE: httpd:${{ matrix.version }}-alpine
+ UPSTREAM_IMAGE: httpd:2.4.67-alpine
BUILD_DIR: "."
steps: |
lmakarov
force-pushed
the
feature/version-bumps
branch
from
57f30e2 to
0c43695
Compare
1 participant
Resolves #26
Summary by CodeRabbit
Chores
Documentation