ci: harden PR pipeline (audit, MSRV, beta matrix, release + docker smoke)#57
ci: harden PR pipeline (audit, MSRV, beta matrix, release + docker smoke)#57beardthelion wants to merge 2 commits into
Conversation
…er smoke) Restructure the single stable-only fmt+clippy+test job into separate jobs: fmt+clippy (stable), a test matrix on stable+beta (beta non-blocking), build --release, cargo audit, an MSRV check pinned to Rust 1.91, and a Docker build smoke test mirroring the release workflow. Add concurrency cancellation for superseded PR runs and per-job timeouts. Declare rust-version = "1.91" in [workspace.package] and inherit it in every member crate so the stated MSRV is a real, CI-enforced contract.
|
Warning Review limit reached
More reviews will be available in 14 minutes and 39 seconds. Learn how PR review limits work. To continue reviewing without waiting, enable usage-based billing in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughRust 1.91 is declared as the workspace MSRV in the root ChangesMSRV Declaration and CI Expansion
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-checks.yml:
- Around line 27-28: The actions/checkout action in this workflow defaults to
persisting GitHub credentials in the git config, which creates a security risk
since untrusted PR code runs via cargo and docker build commands. Add a with
block containing persist-credentials: false to each of the six checkout steps in
the workflow (each uses
actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683) to prevent the GitHub
token from being stored in the local git configuration and exposed to executing
code.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: ce913bf5-8799-4665-9528-4c69c514e9d4
📒 Files selected for processing (7)
.github/workflows/pr-checks.ymlCargo.tomlcrates/git-remote-gitlawb/Cargo.tomlcrates/gitlawb-attest/Cargo.tomlcrates/gitlawb-core/Cargo.tomlcrates/gitlawb-node/Cargo.tomlcrates/gl/Cargo.toml
Set persist-credentials: false on all six actions/checkout steps. These jobs run untrusted PR code via cargo and docker build, and checkout's default leaves the GITHUB_TOKEN in the local git config where that code could read it. None of the jobs push or otherwise need git credentials.
1 participant
Splits the single stable-only
fmt + clippy + testjob inpr-checks.ymlinto focused jobs and adds the coverage the pipeline was missing.What runs on every PR now:
cargo fmt --all -- --check,cargo clippy --workspace --all-targets -- -D warningscargo test --workspace. Beta iscontinue-on-errorso an upstream beta regression warns instead of blocking merges; stable stays required.cargo build --release --workspace, so PRs get a release-profile signal (previously only the release workflow built release artifacts, and only on tags).cargo-auditwith--lockedand runs it against the committedCargo.lock.cargo check --workspace --all-targets. Backed by a realrust-version = "1.91"in[workspace.package], inherited by all five crates, so the README/Dockerfile's stated minimum is now enforced instead of aspirational.docker buildplus a--versionrun, mirroring the release workflow's entrypoint, so a Dockerfile regression can't reachmainand breakdocker compose up.Also added a concurrency group that cancels superseded PR runs (never cancels
main) and per-job timeouts. New actions follow the existing SHA-pinned convention.Heads up on branch protection: the required status check changes from
fmt + clippy + testto the new job names (fmt + clippy,test (stable),build --release,cargo audit,MSRV (Rust 1.91),Docker build smoke test). The required-checks list will need updating or PRs will wait on a check that no longer reports.test (beta)is intentionally non-blocking.Summary by CodeRabbit
Release Notes