ci: add release-please-develop pre-release workflow - #303
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (69.93%) is below the target coverage (80.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #303 +/- ##
=======================================
Coverage 69.93% 69.93%
=======================================
Files 142 142
Lines 10774 10774
=======================================
Hits 7535 7535
Misses 3239 3239 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
Pull request overview
Adds a new GitHub Actions workflow to enable pre-release (alpha/beta/rc) automation from the develop branch by invoking the shared openfga/.github reusable workflow, mirroring the existing stable release-please flow on main.
Changes:
- Introduces
.github/workflows/release-please-develop.ymlto run pre-release automation ondevelop(push) or viaworkflow_dispatch. - Wires the workflow to the shared reusable
release-please-prerelease.ymlpinned by SHA, passingbase-branch/staging-branchand release inputs. - Aligns trigger/guard behavior (
startsWith(..., 'release:')) and permissions structure with the existingrelease-please.ymlworkflow.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
WalkthroughA new GitHub Actions workflow manages prerelease release-PR creation from ChangesDevelop prerelease workflow
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant GitHub as GitHub event
participant DevelopWorkflow as release-please-develop workflow
participant ReusableWorkflow as release-please-prerelease workflow
GitHub->>DevelopWorkflow: Push to develop or workflow_dispatch
DevelopWorkflow->>DevelopWorkflow: Check event and release version
DevelopWorkflow->>ReusableWorkflow: Invoke prerelease workflow with branches, inputs, and secrets
ReusableWorkflow->>GitHub: Create or publish prerelease release PR
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-please-develop.yml:
- Line 16: Update the trigger documentation comment on line 16 to state that
merging the release PR creates a signed tag and draft prerelease, while
publication is handled later by the publish workflow; remove the claim that this
trigger publishes the release.
- Line 44: Update the reusable workflow’s workflow_dispatch handling to pass
release-version through an env variable before any shell assignment, validate
that environment variable with the pre-release regex, and use it for validation
and commit operations. Then update the caller’s pinned reusable-workflow
reference in release-please-develop.yml so it points to the fixed revision.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: f6781bbb-faa0-43b4-b7cb-0be802b6c7c4
📒 Files selected for processing (1)
.github/workflows/release-please-develop.yml
| # | ||
| # Triggers: | ||
| # * workflow_dispatch → build a release PR for an explicit pre-release version | ||
| # * push to develop → when the `release:` PR merges, tag + draft + publish |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Correct the publish claim in the trigger documentation.
The reusable workflow creates a signed tag and a draft prerelease; publishing is explicitly delegated to a later publish workflow. Update Line 16 to avoid misleading release operators. (raw.githubusercontent.com)
Proposed wording
-# * push to develop → when the `release:` PR merges, tag + draft + publish
+# * push to develop → when the `release:` PR merges, tag + draft pre-release📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| # * push to develop → when the `release:` PR merges, tag + draft + publish | |
| # * push to develop → when the `release:` PR merges, tag + draft pre-release |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release-please-develop.yml at line 16, Update the trigger
documentation comment on line 16 to state that merging the release PR creates a
signed tag and draft prerelease, while publication is handled later by the
publish workflow; remove the claim that this trigger publishes the release.
Source: MCP tools
| uses: openfga/.github/.github/workflows/release-please-prerelease.yml@835baf31562809ad9eb884c73efc5b79318f700f # pin@main | ||
| with: | ||
| trigger-event: ${{ github.event_name }} | ||
| release-version: ${{ inputs.release-version || '' }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
curl -fsSL 'https://raw.githubusercontent.com/openfga/.github/835baf31562809ad9eb884c73efc5b79318f700f/.github/workflows/release-please-prerelease.yml' |
rg -n 'inputs\.release-version|VERSION='Repository: openfga/python-sdk
Length of output: 321
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Workflow files =="
fd -a 'release-please.*\.ya?ml|release.*\.ya?ml' .github/workflows 2>/dev/null | sed 's#^\./##' | sort
echo
echo "== Caller workflow excerpt =="
if [ -f .github/workflows/release-please-develop.yml ]; then
nl -ba .github/workflows/release-please-develop.yml | sed -n '1,90p'
fi
echo
echo "== Reusable workflow excerpts around release-version =="
curl -fsSL 'https://raw.githubusercontent.com/openfga/.github/835baf31562809ad9eb884c73efc5b79318f700f/.github/workflows/release-please-prerelease.yml' > /tmp/release-prerelease.yml
nl -ba /tmp/release-prerelease.yml | sed -n '45,75p'
echo "---"
nl -ba /tmp/release-prerelease.yml | sed -n '125,148p'
echo "---"
nl -ba /tmp/release-prerelease.yml | sed -n '250,275p'
echo
echo "== Search all local workflow uses =="
rg -n "release-version|release-please-prerelease|uses:" .github/workflows || trueRepository: openfga/python-sdk
Length of output: 369
🌐 Web query:
GitHub Actions reusable workflow inputs passed to shell steps injection security
💡 Result:
When passing inputs to a reusable workflow, direct interpolation of these inputs into shell commands via ${{ inputs.x }} expression syntax creates a critical risk of shell command injection [1][2][3]. Because the ${{ }} syntax is expanded by GitHub Actions before the shell interprets the command, an attacker can supply malicious characters (such as ;, &&, or |) to break out of the intended command context and execute arbitrary code on the runner [1][2][3]. To secure reusable workflows against this vulnerability, implement the following defensive strategies: Use Environment Variable Indirection (Primary Defense) Never use the ${{ inputs.x }} syntax directly inside a run step [4][5]. Instead, assign the input to an environment variable in the env block of the step and reference that variable within your shell command [6][2][4][3]. By using variable expansion within the shell (e.g., "$MY_VAR"), the input is treated as data rather than executable code [4][5]. Example of vulnerable code: - run:./deploy.sh ${{ inputs.environment }} Example of secure code: - name: Deploy env: ENVIRONMENT: ${{ inputs.environment }} run:./deploy.sh "$ENVIRONMENT" Implement Input Validation Treat all reusable workflow inputs as untrusted, especially if they originate from user-controlled triggers [6][4][5]. Implement validation steps—such as regex checks or allowlists—at the beginning of your workflow to ensure the input conforms to expected formats before it is used in any downstream logic [6][3]. Apply Principle of Least Privilege Reusable workflows inherit the GITHUB_TOKEN permissions of the caller [6]. If an injection occurs, an attacker may leverage these permissions to modify repository contents or exfiltrate secrets [6][2][5]. Always set explicit, minimal permissions for the workflow using the permissions key, and prefer explicit secret passing over the secrets: inherit keyword to limit the scope of accessible secrets [6][5][7]. Automate Security Checks Incorporate security scanning tools to detect unsafe input interpolation automatically [2][4]. Tools such as CodeQL, actionlint, and zizmor can identify potential injection points during development and prevent vulnerable workflows from being merged or executed [4][5][7].
Citations:
- 1: https://docs.github.com/en/actions/concepts/security/script-injections
- 2: https://github.blog/security/vulnerability-research/how-to-catch-github-actions-workflow-injections-before-attackers-do/
- 3: GHSA-3g6g-gq4r-xjm9
- 4: https://github.blog/security/supply-chain-security/four-tips-to-keep-your-github-actions-workflows-secure/
- 5: https://safeguard.sh/resources/blog/securing-github-actions-reusable-workflows-at-scale
- 6: https://adaptive-enforcement-lab.com/secure/github-actions-security/workflows/reusable/
- 7: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.md
🏁 Script executed:
#!/bin/bash
set -euo pipefail
IFS=$'\n'
echo "== Caller workflow excerpt =="
if [ -f .github/workflows/release-please-develop.yml ]; then
awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/release-please-develop.yml | sed -n '1,90p'
fi
echo
echo "== Reusable workflow excerpts around release-version =="
curl -fsSL 'https://raw.githubusercontent.com/openfga/.github/835baf31562809ad9eb884c73efc5b79318f700f/.github/workflows/release-please-prerelease.yml' > /tmp/release-prerelease.yml
awk '{printf "%6d\t%s\n", NR, $0}' /tmp/release-prerelease.yml | sed -n '55,70p'
echo "---"
awk '{printf "%6d\t%s\n", NR, $0}' /tmp/release-prerelease.yml | sed -n '125,148p'
echo "---"
awk '{printf "%6d\t%s\n", NR, $0}' /tmp/release-prerelease.yml | sed -n '250,275p'
echo
echo "== Search all local workflow uses =="
rg -n "release-version|release-please-prerelease|workflow_dispatch|on:" .github/workflows || trueRepository: openfga/python-sdk
Length of output: 8305
Use shell-safe input assignment in the reusable workflow before enabling this input.
This passes the workflow_dispatch.release-version input to a pinned reusable workflow whose workflow_dispatch branch interpolates ${{ inputs.release-version }} directly into shell assignments at the lines that validate and commit the requested version. A value containing shell metacharacters can execute before the pre-release regex check, so assign the input via env: first, validate the environment variable, and update the caller pin after the reusable workflow is fixed.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release-please-develop.yml at line 44, Update the reusable
workflow’s workflow_dispatch handling to pass release-version through an env
variable before any shell assignment, validate that environment variable with
the pre-release regex, and use it for validation and commit operations. Then
update the caller’s pinned reusable-workflow reference in
release-please-develop.yml so it points to the fixed revision.
Source: MCP tools
Adds a
release-please-developworkflow enabling pre-release (alpha/beta/rc) releases from thedevelopbranch, viaworkflow_dispatchor on merge of arelease:PR. It is a thin caller around the sharedopenfga/.githubreusablerelease-please-prerelease.yml, mirroring the existingrelease-pleasemain flow.Reference: https://github.com/openfga/js-sdk/blob/main/.github/workflows/release-please-develop.yml
Summary by CodeRabbit
developbranch.