chore(ci): normalize and align CD pipeline (#314)#315
Merged
nanotaboada merged 4 commits intomasterfrom Apr 11, 2026
Merged
Conversation
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughUpdates the Maven CD GitHub Actions workflow to enable build provenance attestation, adjust Docker image tagging to use Changes
Sequence DiagramsequenceDiagram
participant GHA as GitHub Actions
participant OIDC as OIDC Provider
participant GHCR as GHCR (Registry)
participant Attest as Attestation Service
GHA->>GHA: Build image (platforms: amd64, arm64) with provenance=mode=max
GHA->>OIDC: Request id-token (id-token: write)
OIDC-->>GHA: Return OIDC token
GHA->>GHCR: Push image (ghcr.io/${{ github.repository }})
GHCR-->>GHA: Return image digest
GHA->>Attest: Publish provenance attestation (subject: push digest)
Attest-->>GHA: Attestation recorded
GHA->>GHA: Create GitHub Release (generate_release_notes: true, draft:false, prerelease:false) with changelog
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Assessment against linked issues
Possibly related issues
Possibly related PRs
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #315 +/- ##
===========================================
Coverage 100.00% 100.00%
Complexity 30 30
===========================================
Files 2 2
Lines 88 88
Branches 8 8
===========================================
Hits 88 88 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/maven-cd.yml:
- Around line 118-125: The fallback message for an empty CHANGELOG currently
always says "No new changes since $PREVIOUS_TAG", which becomes "No new changes
since " on the first release; update the conditional that checks if [ -z
"$CHANGELOG" ] to branch on whether PREVIOUS_TAG is set: if PREVIOUS_TAG is
non-empty emit "No new changes since $PREVIOUS_TAG", otherwise emit a clear
first-release message like "No changes (first release)". Change the logic that
sets CHANGELOG (and the subsequent if [ -z "$CHANGELOG" ]) to use PREVIOUS_TAG
to select the appropriate fallback text.
- Around line 36-39: The release job's permissions block is missing
attestations: write which is required by the actions/attest-build-provenance@v2
step to persist build provenance; update the permissions mapping in the release
job to include attestations: write alongside contents: write, packages: write,
and id-token: write so the attestation step can succeed.
- Around line 106-110: The Attest build provenance step using
actions/attest-build-provenance@v2 is missing the push-to-registry input; update
the workflow step that defines subject-name and subject-digest to include
push-to-registry: true so the attestation is pushed to the GHCR registry (i.e.,
add the push-to-registry: true input alongside subject-name: ghcr.io/${{
github.repository }} and subject-digest: ${{ steps.push.outputs.digest }}).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 90b5f1ed-cb81-4da7-9380-90d2e2a35ce5
📒 Files selected for processing (1)
.github/workflows/maven-cd.yml
- Add attestations: write permission required by attest action - Add push-to-registry: true to push attestation to GHCR - Fix empty changelog fallback message when PREVIOUS_TAG is unset Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
- Drop Quick Start section from release body (belongs in README) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
nanotaboada
force-pushed
the
ci/normalize-cd-pipeline
branch
from
1b179bb to
5dc788e
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Improve the CD pipeline: add multi-platform image support (amd64 + arm64), enable build provenance attestation, and tighten changelog generation and release metadata.
Changes
id-token: writepermission added toreleasejob (required for attestation)Set image namestep dropped;${{ github.repository }}used directly throughoutprovenance: false→provenance: mode=maxAttest build provenancestep added after image push (actions/attest-build-provenance@v2)"- %s"→"- %s (%h)"(adds short hash)No new changes since $PREVIOUS_TAG)draft: false,prerelease: false,generate_release_notes: truemade explicitTest plan
testjob passes beforereleasejob startslinux/amd64andlinux/arm64Closes #314
🤖 Generated with Claude Code
This change is
Summary by CodeRabbit