Conversation
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #21 +/- ##
=======================================
Coverage 88.50% 88.50%
=======================================
Files 11 11
Lines 200 200
Branches 8 8
=======================================
Hits 177 177
Misses 23 23 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
There was a problem hiding this comment.
Pull request overview
This pull request introduces automated workflows for managing service updates across the codebeltnet organization's repositories. The primary focus is on automating NuGet package version bumps when dependencies are released, along with automatic CHANGELOG and release notes updates. A secondary change adds a Context7 widget to the DocFX documentation template.
Changes:
- Added automated service update workflow that bumps Codebelt/Cuemon package versions, updates release notes, and creates PRs when triggered by upstream releases
- Added downstream triggering workflow that dispatches service update events to dependent repositories upon release publication
- Added Python script for targeted NuGet package version management in Directory.Packages.props
- Integrated Context7 widget into documentation site for analytics/engagement features
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 17 comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/trigger-downstream.yml | Workflow that triggers repository dispatch events to downstream repos on release publication |
| .github/workflows/service-update.yml | Workflow that automates service update PRs including package bumps, changelog, and release notes updates |
| .github/scripts/bump-nuget.py | Python script for selective NuGet package version updates based on source repository |
| .github/dispatch-targets.json | Configuration file listing downstream repositories (currently empty) |
| .docfx/templates/shared-kernel/layout/_master.tmpl | Documentation template with added Context7 widget script |
| NEW="${{ steps.newver.outputs.new }}" | ||
| for f in .nuget/*/PackageReleaseNotes.txt; do | ||
| [ -f "$f" ] || continue | ||
| TFM=$(grep -m1 "^Availability:" "$f" | sed 's/Availability: //' || echo ".NET 10, .NET 9 and .NET Standard 2.0") |
There was a problem hiding this comment.
The TFM (Target Framework Moniker) extraction using grep relies on the "Availability:" line being present and correctly formatted in the existing PackageReleaseNotes.txt file. If this line is missing or malformed, the sed command will fail silently and TFM will be set to the fallback value, potentially using incorrect framework information for new releases. Consider adding validation or error handling to ensure the extracted TFM value is reasonable before using it.
| TFM=$(grep -m1 "^Availability:" "$f" | sed 's/Availability: //' || echo ".NET 10, .NET 9 and .NET Standard 2.0") | |
| RAW_AVAIL_LINE=$(grep -m1 "^Availability:" "$f" || true) | |
| if [ -n "$RAW_AVAIL_LINE" ]; then | |
| TFM=${RAW_AVAIL_LINE#Availability:} | |
| TFM=$(echo "$TFM" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//') | |
| else | |
| TFM="" | |
| fi | |
| if [ -z "$TFM" ]; then | |
| echo "Warning: Using fallback TFM for $f because Availability line is missing or malformed." | |
| TFM=".NET 10, .NET 9 and .NET Standard 2.0" | |
| fi |
| id: newver | ||
| run: | | ||
| CURRENT=$(grep -oP '(?<=## \[)[\d.]+(?=\])' CHANGELOG.md | head -1) | ||
| NEW=$(echo "$CURRENT" | awk -F. '{printf "%s.%s.%d", $1, $2, $3+1}') |
There was a problem hiding this comment.
The version determination logic using grep and awk assumes the CHANGELOG.md format is consistent and that the first match is always a valid semantic version. If the CHANGELOG.md is empty, malformed, or doesn't contain a version in the expected format, this step will fail or produce incorrect results. Consider adding validation to ensure CURRENT contains a valid version before attempting the awk transformation, and handle the case where no version is found.
| NEW=$(echo "$CURRENT" | awk -F. '{printf "%s.%s.%d", $1, $2, $3+1}') | |
| if ! echo "$CURRENT" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then | |
| echo "ERROR: Unable to determine current semantic version from CHANGELOG.md (got: '$CURRENT')." >&2 | |
| echo "Ensure CHANGELOG.md contains a heading like '## [1.2.3]'." >&2 | |
| exit 1 | |
| fi | |
| NEW=$(awk -F. '{printf "%s.%s.%d", $1, $2, $3+1}' <<< "$CURRENT") |
| </div> | ||
| </div> | ||
| </footer> | ||
| <script async src="https://context7.com/widget.js" data-library="/codebeltnet/shared-kernel"></script> |
There was a problem hiding this comment.
A third-party JavaScript widget from context7.com is being loaded without any documentation, security review notes, or explanation of its purpose in the PR description. Loading external scripts can introduce security and privacy risks, including potential XSS vulnerabilities, data leakage, or dependency on external service availability. Consider documenting the purpose of this widget, conducting a security review, implementing a Content Security Policy (CSP), and adding a Subresource Integrity (SRI) hash to ensure the script hasn't been tampered with.
| <script async src="https://context7.com/widget.js" data-library="/codebeltnet/shared-kernel"></script> | |
| <!-- Context7 widget script removed pending security and privacy review. --> |
| VERSION="${{ github.event.client_payload.source_version || github.event.inputs.source_version }}" | ||
| echo "source=$SOURCE" >> $GITHUB_OUTPUT | ||
| echo "version=$VERSION" >> $GITHUB_OUTPUT | ||
|
|
There was a problem hiding this comment.
The workflow does not validate that TRIGGER_SOURCE and TRIGGER_VERSION are set before proceeding with subsequent steps. When triggered via repository_dispatch or workflow_dispatch without inputs, these could be empty strings, causing the workflow to run but perform no meaningful updates. The bump-nuget.py script will fail with a sys.exit(1), but other steps will continue. Consider adding early validation in the workflow to check if these values are set and skip the workflow run or fail fast if they're missing.
| - name: Validate trigger inputs | |
| run: | | |
| SOURCE="${{ steps.trigger.outputs.source }}" | |
| VERSION="${{ steps.trigger.outputs.version }}" | |
| if [ -z "$SOURCE" ] || [ -z "$VERSION" ]; then | |
| echo "Error: TRIGGER_SOURCE and TRIGGER_VERSION must be set. Got SOURCE='$SOURCE', VERSION='$VERSION'." | |
| echo "Ensure repository_dispatch or workflow_dispatch provides non-empty 'source_repo' and 'source_version'." | |
| exit 1 | |
| fi |
| @@ -0,0 +1,139 @@ | |||
| name: Service Update | |||
There was a problem hiding this comment.
The PR title "Docfx/context7 chat" does not accurately reflect the primary changes in this pull request. The majority of the changes introduce service update automation workflows and NuGet package version management, while the context7 widget is a minor addition to a documentation template. The title should be more descriptive of the main functionality being added, such as "Add service update automation and downstream triggering workflows" or similar. The current title may confuse reviewers about the scope and purpose of these changes.
| - name: Create branch and open PR | ||
| if: ${{ github.event.inputs.dry_run != 'true' }} | ||
| env: | ||
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | ||
| run: | | ||
| NEW="${{ steps.newver.outputs.new }}" | ||
| BRANCH="${{ steps.newver.outputs.branch }}" | ||
| SOURCE="${{ steps.trigger.outputs.source }}" | ||
| SRC_VER="${{ steps.trigger.outputs.version }}" | ||
|
|
||
| git config user.name "codebelt-aicia[bot]" | ||
| git config user.email "codebelt-aicia[bot]@users.noreply.github.com" | ||
| git checkout -b "$BRANCH" | ||
| git add -A | ||
| git diff --cached --quiet && echo "Nothing changed - skipping PR." && exit 0 | ||
| git commit -m "V${NEW}/service update" | ||
| git push origin "$BRANCH" | ||
|
|
||
| echo "This is a service update that focuses on package dependencies." > pr_body.txt | ||
| echo "" >> pr_body.txt | ||
| echo "Automated changes:" >> pr_body.txt | ||
| echo "- Codebelt/Cuemon package versions bumped to latest compatible" >> pr_body.txt | ||
| echo "- PackageReleaseNotes.txt updated for v${NEW}" >> pr_body.txt | ||
| echo "- CHANGELOG.md entry added for v${NEW}" >> pr_body.txt | ||
| echo "" >> pr_body.txt | ||
| echo "Note: Third-party packages (Microsoft.Extensions.*, BenchmarkDotNet, etc.) are not auto-updated." >> pr_body.txt | ||
| echo "Use Dependabot or manual updates for those." >> pr_body.txt | ||
| echo "" >> pr_body.txt | ||
| echo "Generated by codebelt-aicia" >> pr_body.txt | ||
| if [ -n "$SOURCE" ] && [ -n "$SRC_VER" ]; then | ||
| echo "Triggered by: ${SOURCE} @ ${SRC_VER}" >> pr_body.txt | ||
| else | ||
| echo "Triggered by: manual workflow dispatch" >> pr_body.txt | ||
| fi | ||
|
|
||
| gh pr create --title "V${NEW}/service update" --body-file pr_body.txt --base main --head "$BRANCH" --assignee gimlichael |
There was a problem hiding this comment.
The workflow creates a branch and attempts to create a PR but does not check if a PR or branch with the same name already exists. If the workflow runs multiple times (e.g., due to multiple releases or manual triggers), it will fail with 'git push' or 'gh pr create' errors when trying to create duplicate branches or PRs. Consider adding logic to check for existing branches/PRs and either skip creation, update the existing branch, or use unique identifiers in the branch name.
|
|
||
| def is_triggered_package(package_name: str) -> bool: | ||
| """Check if package is published by the triggering source repo.""" | ||
| if not TRIGGER_SOURCE: |
There was a problem hiding this comment.
The is_triggered_package function has a type annotation indicating it returns bool, but when TRIGGER_SOURCE is not set, the function returns False without logging or warning about this condition. This is a silent failure mode that could make debugging difficult when the script unexpectedly skips all packages. Consider adding a debug print statement or logging when TRIGGER_SOURCE is empty to help diagnose configuration issues.
| if not TRIGGER_SOURCE: | |
| if not TRIGGER_SOURCE: | |
| print( | |
| "Debug: TRIGGER_SOURCE is not set; is_triggered_package will always return False." | |
| ) |
| python3 - <<'EOF' | ||
| import json, urllib.request, os, sys | ||
| targets = json.load(open('.github/dispatch-targets.json')) |
There was a problem hiding this comment.
The inline Python script uses json.load with open() but doesn't use a context manager (with statement) to ensure the file is properly closed. While this works in a short-lived script context, it's not following Python best practices. Consider using 'with open('.github/dispatch-targets.json') as f: targets = json.load(f)' for proper resource management and to follow idiomatic Python patterns.
| id: newver | ||
| run: | | ||
| CURRENT=$(grep -oP '(?<=## \[)[\d.]+(?=\])' CHANGELOG.md | head -1) | ||
| NEW=$(echo "$CURRENT" | awk -F. '{printf "%s.%s.%d", $1, $2, $3+1}') |
There was a problem hiding this comment.
The awk command for version bumping only increments the patch version (third component). This means the workflow always creates patch releases (e.g., 0.5.2 → 0.5.3) and cannot handle minor or major version bumps. For service updates this might be intentional, but it's inflexible and will cause issues if a major or minor version bump is needed for breaking changes or significant updates. Consider adding workflow inputs or logic to support different version bump strategies (major, minor, patch).
| with urllib.request.urlopen(req) as r: | ||
| print(f'✓ Dispatched to {repo}: HTTP {r.status}') |
There was a problem hiding this comment.
The urllib.request.urlopen call does not handle potential HTTP errors. If the API request fails with a 4xx or 5xx status code, it will raise an HTTPError exception, causing the workflow to fail without attempting to dispatch to remaining repositories. Consider adding error handling to catch HTTPError exceptions, log the failure, and continue with the next repository in the list.
1 participant
This pull request introduces a new automated workflow for service updates and downstream dependency management, focusing on simplifying package version bumps and improving release coordination. The main changes include adding GitHub Actions workflows for service updates and downstream triggers, a script for targeted NuGet package version bumps, and supporting files for dispatching updates.
Service update automation and downstream triggering:
.github/workflows/service-update.ymlto automate service update PRs, including bumping Codebelt/Cuemon package versions, updatingPackageReleaseNotes.txt, andCHANGELOG.md. The workflow supports both repository dispatch and manual triggers, and skips third-party package updates..github/scripts/bump-nuget.py, a Python script that bumps NuGet package versions only for packages published by the triggering source repo, ignoring Microsoft.Extensions.*, BenchmarkDotNet, and other third-party dependencies..github/workflows/trigger-downstream.yml, a workflow that triggers downstream service updates in other repos upon a new release, using repository dispatch events and a generated GitHub App token for authentication..github/dispatch-targets.jsonas a list of downstream repositories to receive service update dispatches.Other changes:
.docfx/templates/shared-kernel/layout/_master.tmplfor analytics or context features.