chore: bump dependencies, migrate CI to Nix, and modernize build tooling#128
chore: bump dependencies, migrate CI to Nix, and modernize build tooling#128
Conversation
Update Go dependencies to latest versions (go-git v5.17.0, afero v1.15.0, cobra v1.10.2, testify v1.11.1). Migrate CI workflows from actions/setup-go to cachix/install-nix-action with all GitHub Actions SHA-pinned for supply-chain security. Upgrade goreleaser config to v2 format with dockers_v2 for simplified multi-platform Docker builds. Replace Makefile with Taskfile.yml (go-task) and add goreleaser, gosec, go-junit-report, and go-task to the Nix dev shell.
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (6)
WalkthroughThe repository migrates build and CI tooling to a Nix-based workflow: Makefile removed and replaced by Taskfile, GitHub Actions now run nix-driven commands, Goreleaser config moved to v2 layout, Go toolchain and dependencies bumped, Docker base and Helm versions updated, and README install instructions switched to Docker pulls. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Add #nosec annotations for legitimate uses: SSRF false positive on operator-configured GitLab URL (G704), and credential struct fields required for Helm registry auth (G117). Exclude .gomod and .go cache directories from gosec scanning in CI.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #128 +/- ##
==========================================
+ Coverage 75.87% 78.01% +2.14%
==========================================
Files 20 20
Lines 2006 1601 -405
==========================================
- Hits 1522 1249 -273
+ Misses 352 220 -132
Partials 132 132 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
Dockerfile (1)
5-13:⚠️ Potential issue | 🟠 MajorVerify the Helm tarball before extracting it.
Line 11 downloads an executable artifact without validating its integrity. Helm publishes SHA-256 checksums for all releases at
https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz.sha256. Download and verify the checksum before extracting the tarball on line 12 to prevent arbitrary code execution from a compromised artifact.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@Dockerfile` around lines 5 - 13, The Dockerfile currently downloads the Helm tarball using ENV HELM_VERSION and ENV TARGETARCH and extracts it immediately; update the RUN sequence that contains wget "https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz" and tar -xf to first download the corresponding .sha256 checksum file (https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz.sha256), verify the tarball against that checksum (e.g., using sha256sum -c or by comparing computed sha256sum to the downloaded value), fail the build if verification fails, and only then proceed to tar -xf and mv the extracted linux-${TARGETARCH}/helm to /usr/bin/helm; also ensure you remove the downloaded tar and checksum after successful install for cleanliness.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release.yml:
- Around line 16-17: The workflow currently sets up QEMU via the "Set up QEMU"
step using docker/setup-qemu-action but does not initialize Buildx; add a pinned
docker/setup-buildx-action step (run before invoking GoReleaser or the
dockers_v2 publishing step) so multi-arch builds for linux/amd64 and linux/arm64
succeed; ensure the added step is placed prior to the GoReleaser invocation and
uses a fixed action SHA or tag to avoid transient failures.
In @.goreleaser.yaml:
- Around line 5-8: The release hook currently runs both the "mocks" task and "go
mod tidy" which allows the release process to modify module files during
tagging; remove the "go mod tidy" entry from the hooks in .goreleaser.yaml so
the release remains read-only (keep only the "mocks" task), and move the module
tidy check into CI so the pipeline fails on a dirty tree instead of allowing
releases to rewrite go.mod/go.sum during publish.
In `@Taskfile.yml`:
- Around line 34-37: Update the Taskfile.yml "clean" task to remove all
artifacts emitted by the test targets: extend the clean cmds for the clean task
to delete coverage.out, coverage.html, report.xml and the .tmp directory (and
keep removing bin), so that running the clean task fully clears outputs produced
by test-coverage and test-coverage-html.
---
Outside diff comments:
In `@Dockerfile`:
- Around line 5-13: The Dockerfile currently downloads the Helm tarball using
ENV HELM_VERSION and ENV TARGETARCH and extracts it immediately; update the RUN
sequence that contains wget
"https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz" and tar
-xf to first download the corresponding .sha256 checksum file
(https://get.helm.sh/helm-v${HELM_VERSION}-linux-${TARGETARCH}.tar.gz.sha256),
verify the tarball against that checksum (e.g., using sha256sum -c or by
comparing computed sha256sum to the downloaded value), fail the build if
verification fails, and only then proceed to tar -xf and mv the extracted
linux-${TARGETARCH}/helm to /usr/bin/helm; also ensure you remove the downloaded
tar and checksum after successful install for cleanliness.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: bc7eedd6-adb7-4927-ad95-88ba9ba96ff2
⛔ Files ignored due to path filters (2)
flake.lockis excluded by!**/*.lockgo.sumis excluded by!**/*.sum
📒 Files selected for processing (9)
.github/workflows/release.yml.github/workflows/run-tests.yml.goreleaser.yamlDockerfileMakefileREADME.mdTaskfile.ymlflake.nixgo.mod
💤 Files with no reviewable changes (1)
- Makefile
Add docker/setup-buildx-action to release workflow for reliable multi-arch builds. Remove go mod tidy from goreleaser hooks to keep releases read-only and add a tidy check to CI instead. Extend Taskfile clean task to remove all test artifacts. Verify Helm tarball SHA-256 checksum during Docker image build.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/run-tests.yml:
- Around line 18-23: The workflow job currently sets explicit permissions but
omits repository read access, which breaks actions/checkout and the git fetch
step; update the job's permissions block to include "contents: read" (not write)
so actions/checkout@... and the "git fetch" run have repository read access —
add or merge a permissions: { contents: read } entry at the same job scope where
"permissions" is declared to ensure those steps succeed.
In `@internal/comment/gitlab/poster.go`:
- Line 130: Replace the incorrect gosec annotation on the HTTP call line so the
linter suppression matches the actual rule: change the comment attached to the
p.client.Do(req) call from "// `#nosec` G704 -- endpoint is built from
operator-configured BaseURL, not user input" to use "G107" instead; locate the
p.client.Do(req) invocation in poster.go (method using p.client.Do) and update
the rule id to G107 to properly suppress the SSRF/variable-URL warning.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: d37831fc-2dd6-4d59-9757-802158756b89
📒 Files selected for processing (4)
.github/workflows/run-tests.ymlinternal/comment/gitlab/poster.gointernal/models/repo.gointernal/ports/ports.go
The mocks package is generated at build time, so go mod tidy cannot resolve imports without running task mocks first. The pre-commit hook already enforces tidy modules during development.
Add missing contents:read to test workflow permissions so actions/checkout and git fetch have repository access. Fix gosec suppression from G704 to G107 (the actual SSRF/variable-URL rule).
G704 is a taint-analysis variant of the same SSRF check as G107. Both must be listed in the nosec annotation.
|
1 participant
Summary
Bump Go dependencies to latest versions, migrate CI workflows to Nix, upgrade goreleaser to v2 configuration format, and replace Makefile with Taskfile.
Changes
Go Dependency Updates
github.com/go-git/go-git/v5: v5.16.3 → v5.17.0 (security fixes, performance improvements)github.com/spf13/afero: v1.14.0 → v1.15.0 (bug fixes)github.com/spf13/cobra: v1.10.1 → v1.10.2 (internal yaml dependency migration)github.com/stretchr/testify: v1.10.0 → v1.11.1 (stringer argument matching fix)github.com/go-git/go-billy/v5: v5.6.2 → v5.8.0 (transitive, pulled in by go-git)CI/CD Migration to Nix
actions/setup-gowithcachix/install-nix-actionin both workflowsactions/checkout@de0fac2e...(v6.0.2)cachix/install-nix-action@19effe9f...(v31.10.0)docker/setup-qemu-action@ce360397...(v4.0.0)docker/login-action@b45d80f8...(v4.0.0)codecov/codecov-action@671740ac...(v5.5.2)securego/gosec@masteraction in favor of running gosec directly via Nixgoreleaser/goreleaser-actionin favor of running goreleaser directly via NixGoReleaser v2 Migration
version: 2configuration headerdockers+docker_manifests→dockers_v2(simplified multi-platform config)snapshot.name_template→snapshot.version_templateBuild System: Makefile → Taskfile
taskinstead ofmaketaskcommandsNix Development Environment
goreleaser,gosec,go-junit-report, andgo-tasktoflake.nixdev shellflake.lockto match Go 1.25 toolchainDocumentation
Summary by CodeRabbit
Documentation
Chores