Conversation
📝 WalkthroughWalkthroughThe project updates Scala and SBT versions, compiler and formatting settings, dependencies, build aliases, source typing, tests, and GitHub Actions workflows. Serial execution behavior remains unchanged according to the summaries. ChangesScala build modernization
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Coverage Report for CI Build 31589794388Warning No base build found for commit Coverage: 92.742%Details
Uncovered ChangesNo uncovered changes found. Coverage RegressionsRequires a base build to compare against. How to fix this → Coverage Stats
💛 - Coveralls |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 10-11: Update the release workflow reference to the verified
commit b4557d9a82c03596dc2425e19b3cb9a6280a473 instead of the mutable v5 tag. In
the release workflow’s workflow_call.secrets declaration, expose
JFROG_ACCESS_TOKEN and map only that secret to the called workflow; remove any
explicit GITHUB_TOKEN mapping because it is provided automatically.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 47d87c50-af18-4b57-ba58-f8022d063705
📒 Files selected for processing (15)
.github/workflows/ci.yml.github/workflows/release.yml.scalafmt.confbuild.sbtproject/build.propertiesproject/plugins.sbtsrc/main/scala/com/evolutiongaming/concurrent/serially/AsyncVar.scalasrc/main/scala/com/evolutiongaming/concurrent/serially/Serially.scalasrc/main/scala/com/evolutiongaming/concurrent/serially/SeriallyAsync.scalasrc/main/scala/com/evolutiongaming/concurrent/serially/StateVar.scalasrc/test/scala/com/evolutiongaming/concurrent/serially/AsyncVarSpec.scalasrc/test/scala/com/evolutiongaming/concurrent/serially/SeriallyAsyncSpec.scalasrc/test/scala/com/evolutiongaming/concurrent/serially/SeriallySpec.scalasrc/test/scala/com/evolutiongaming/concurrent/serially/StateVarSpec.scalaversion.sbt
💤 Files with no reviewable changes (1)
- version.sbt
| uses: evolution-gaming/scala-github-actions/.github/workflows/release.yml@v5 | ||
| secrets: inherit |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
repo="evolution-gaming/scala-github-actions"
sha="$(gh api "repos/${repo}/commits/v5" --jq '.sha')"
echo "Resolved v5 SHA: ${sha}"
gh api "repos/${repo}/contents/.github/workflows/release.yml?ref=${sha}" \
--jq '.content' | tr -d '\n' | base64 --decode |
grep -nE 'workflow_call|secrets:|secrets\.'Repository: evolution-gaming/serially
Length of output: 386
🏁 Script executed:
#!/bin/bash
set -euo pipefail
repo="evolution-gaming/scala-github-actions"
sha="b4557d9a82c03596dc2425e19b3cb9a6280a4739"
echo "Pinned commit:"
gh api "repos/${repo}/commits/${sha}" --jq '.sha'
echo
echo "Reusable workflow:"
gh api "repos/${repo}/contents/.github/workflows/release.yml?ref=${sha}" \
--jq '.content' | tr -d '\n' | base64 --decode | nl -ba | sed -n '1,90p'
echo
echo "Declared tags and current tag target:"
gh api "repos/${repo}/git/ref/tags/v5" --jq '{type: .object.type, sha: .object.sha}'
gh api "repos/${repo}/commits/v5" --jq '.sha'Repository: evolution-gaming/serially
Length of output: 280
🏁 Script executed:
#!/bin/bash
set -euo pipefail
repo="evolution-gaming/scala-github-actions"
sha="b4557d9a82c03596dc2425e19b3cb9a6280a4739"
echo "Reusable workflow:"
gh api "repos/${repo}/contents/.github/workflows/release.yml?ref=${sha}" \
--jq '.content' | tr -d '\n' | base64 --decode | sed -n '1,90p'
echo
echo "Tag ref:"
gh api "repos/${repo}/git/ref/tags/v5" --jq '{type: .object.type, sha: .object.sha}'
echo
echo "Tag commit resolution:"
gh api "repos/${repo}/commits/v5" --jq '.sha'Repository: evolution-gaming/serially
Length of output: 2352
🌐 Web query:
GitHub Actions reusable workflow workflow_call secrets inherit explicit secret not declared called workflow secrets context GITHUB_TOKEN
💡 Result:
In GitHub Actions, reusable workflows require explicit configuration to access secrets [1][2]. They do not automatically inherit secrets from the calling workflow, including the GITHUB_TOKEN [1][2][3]. When using secrets: inherit in the calling workflow, the reusable workflow gains access to all secrets available to the caller (including organization, repository, and environment secrets) without requiring each to be individually declared in the caller [4][5][6]. Regarding the specific points raised: 1. Secrets Not Declared: If you do not use secrets: inherit, any secret passed explicitly must be declared in the reusable workflow's on.workflow_call.secrets block [7][2]. If a workflow attempts to reference a secret that has not been declared or inherited, it will be unavailable (resolving to an empty string) [1][2]. 2. Explicit Secret Not Declared: If a caller attempts to pass a secret that the reusable workflow has not declared in its on.workflow_call.secrets, it may cause a parsing or runtime error depending on the configuration [7]. A reusable workflow must explicitly define any secrets it expects to receive unless the inherit keyword is used to pass the entire set [7][1][2]. 3. GITHUB_TOKEN Behavior: The GITHUB_TOKEN is a special, automatically generated token provided by GitHub Actions for each job [3]. Unlike repository or environment secrets, it is not passed via the secrets: inherit or explicit secrets: mapping [3]. It is automatically available to every job in every workflow (including reusable workflows) by default, provided the job has sufficient permissions [3]. You do not need to (and should not) pass it as a secret to a reusable workflow; it is already present in the execution context of the called workflow's jobs [3]. In summary, secrets: inherit provides a blanket way to pass all available secrets to a reusable workflow, while named secrets must be declared in the on.workflow_call block of the called workflow to be accessible [7][1]. The GITHUB_TOKEN is handled independently by the runner and is available without manual secret passing [3].
Citations:
- 1: https://latchkey.dev/learn/github-actions/github-actions-reusable-workflow-secret-not-inherited
- 2: https://latchkey.dev/learn/github-actions/reusable-workflow-secrets-inherit-not-passed-in-ci
- 3: https://qaskills.sh/blog/ci-workflow-reusable-inputs-secrets
- 4: https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
- 5: https://github.blog/changelog/2022-05-03-github-actions-simplify-using-secrets-with-reusable-workflows/
- 6: [BUG] Environment-scoped secrets unreachable from reusable workflow without secrets: inherit, despite called job declaring environment actions/runner#4453
- 7: https://latchkey.dev/learn/github-actions/gha-reusable-secret-not-defined-called-in-ci
Pin the release workflow and pass only JFROG_ACCESS_TOKEN.
Replace @v5 with the verified commit @b4557d9a82c03596dc2425e19b3cb9a6280a4739. Declare JFROG_ACCESS_TOKEN in the called workflow's workflow_call.secrets, then map only that secret. GITHUB_TOKEN is provided automatically.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 10-10: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 10 - 11, Update the release
workflow reference to the verified commit
b4557d9a82c03596dc2425e19b3cb9a6280a473 instead of the mutable v5 tag. In the
release workflow’s workflow_call.secrets declaration, expose JFROG_ACCESS_TOKEN
and map only that secret to the called workflow; remove any explicit
GITHUB_TOKEN mapping because it is provided automatically.
Source: Linters/SAST tools
|
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 11-13: Update the CI workflow’s version_policy_check configuration
to track Scala 3 support explicitly: add a linked tracking issue to the TODO and
document that re-enabling the check is a prerequisite for the first Scala
3-supported release, then set version_policy_check to true once that release
condition is met.
- Around line 9-13: Update the reusable CI job declaration under test to grant
the least-privilege GitHub token permission contents: read, with no broader
permissions enabled. Keep the existing uses and with configuration unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 5e72da30-36cd-4012-abff-d123baf3b98c
📒 Files selected for processing (2)
.github/workflows/ci.ymlbuild.sbt
🚧 Files skipped from review as they are similar to previous changes (1)
- build.sbt
| test: | ||
|
|
||
| runs-on: ubuntu-latest | ||
|
|
||
| strategy: | ||
| matrix: | ||
| scala: | ||
| - 2.13.5 | ||
| - 2.12.13 | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v2 | ||
|
|
||
| - uses: coursier/cache-action@v5 | ||
|
|
||
| - name: scala | ||
| uses: olafurpg/setup-scala@v10 | ||
| with: | ||
| java-version: openjdk@1.11 | ||
|
|
||
| - name: build ${{ matrix.scala }} | ||
| run: sbt ++${{ matrix.scala }} clean coverage test | ||
|
|
||
| - name: test coverage | ||
| if: success() | ||
| env: | ||
| COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }} | ||
| run: sbt ++${{ matrix.scala }} coverageReport coverageAggregate coveralls | ||
|
|
||
| - name: slack | ||
| uses: homoluctus/slatify@master | ||
| if: failure() && github.ref == 'refs/heads/master' | ||
| with: | ||
| type: ${{ job.status }} | ||
| job_name: Build | ||
| url: ${{ secrets.SLACK_WEBHOOK }} No newline at end of file | ||
| uses: evolution-gaming/scala-github-actions/.github/workflows/ci.yml@dde27b9bd793d41d5aacf8fb74403c9de5da1146 # v6.3.0 | ||
| # TODO remove after first release with Scala 3 support | ||
| with: | ||
| version_policy_check: false No newline at end of file |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/*' '.github/actions/*' | sort
printf '%s\n' '--- caller workflow ---'
cat -n .github/workflows/ci.yml
printf '%s\n' '--- permission and reusable-workflow references ---'
rg -n --hidden --glob '!.git/**' \
'permissions:|contents:|packages:|id-token:|pull-requests:|actions:|version_policy_check|evolution-gaming/scala-github-actions' \
.github README.md 2>/dev/null || true
printf '%s\n' '--- repository status ---'
git status --shortRepository: evolution-gaming/serially
Length of output: 1064
🌐 Web query:
evolution-gaming/scala-github-actions v6.3.0 reusable workflow permissions ci.yml
💡 Result:
The evolution-gaming/scala-github-actions repository provides reusable workflows (such as release.yml) to simplify CI/CD for Scala projects [1][2][3]. When integrating these reusable workflows into a local ci.yml or release.yml file, the permissions requirement is governed by standard GitHub Actions security principles [4][5][6]. Key points regarding permissions for these reusable workflows: 1. Inheritance and Security: Reusable workflows run with the permissions explicitly granted at the job level in the calling workflow [4][6]. If you do not define permissions in the calling job, it will inherit the default permissions of the GITHUB_TOKEN [4]. 2. Principle of Least Privilege: Because reusable workflows act like an extension of your own pipeline, you should assign only the minimum permissions necessary [6]. For a release workflow that involves publishing artifacts (often to Artifactory) or creating GitHub releases, the workflow typically requires permissions such as contents: write (for releases) and potentially others depending on the specific tasks performed by the reusable action [4][6]. 3. Permission Downgrading: If you define permissions in both the calling workflow and the reusable workflow, GitHub enforces a strict rule: the called workflow's permissions can only be equal to or more restrictive than the permissions granted by the caller [4][5]. They cannot be elevated [5]. 4. Configuration Example: In your calling workflow (e.g., ci.yml or release.yml), you define permissions at the job level [4][6]: jobs: release: permissions: contents: write # Required if the workflow creates GitHub Releases uses: evolution-gaming/scala-github-actions/.github/workflows/release.yml@v4 secrets: inherit Always check the specific requirements of the version you are using (e.g., v4) [1], as updates to the underlying reusable workflow may change the operations it performs and the associated permission needs [6]. If the reusable workflow fails with a permission error, review the logs to identify which specific scope (e.g., packages, contents) is being denied [6].
Citations:
- 1: https://github.com/evolution-gaming/scala-github-actions
- 2: evolution-gaming/scache@750485d
- 3: https://github.com/evolution-gaming/scache
- 4: https://docs.github.com/en/actions/reference/workflows-and-actions/reusing-workflow-configurations
- 5: https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
- 6: https://www.kenmuse.com/blog/github-actions-workflow-permissions/
🏁 Script executed:
#!/bin/bash
set -eu
repo='evolution-gaming/scala-github-actions'
sha='dde27b9bd793d41d5aacf8fb74403c9de5da1146'
tag='v6.3.0'
printf '%s\n' '--- pinned workflow ---'
curl -fsSL "https://raw.githubusercontent.com/$repo/$sha/.github/workflows/ci.yml" | nl -ba
printf '%s\n' '--- permission-related declarations in pinned workflow ---'
curl -fsSL "https://raw.githubusercontent.com/$repo/$sha/.github/workflows/ci.yml" |
rg -n -C 3 'permissions:|contents:|packages:|id-token:|pull-requests:|actions:|github-token|GITHUB_TOKEN' || true
printf '%s\n' '--- tag ref ---'
ref_json="$(curl -fsSL "https://api.github.com/repos/$repo/git/ref/tags/$tag")"
printf '%s\n' "$ref_json" | jq '{ref, object}'
type="$(printf '%s\n' "$ref_json" | jq -r '.object.type')"
tag_object="$(printf '%s\n' "$ref_json" | jq -r '.object.sha')"
if [ "$type" = tag ]; then
commit="$(curl -fsSL "https://api.github.com/repos/$repo/git/tags/$tag_object" | jq -r '.object.sha')
else
commit="$tag_object"
fi
printf 'dereferenced_tag_commit=%s\n' "$commit"
printf '%s\n' '--- commit existence checks ---'
curl -fsSL "https://api.github.com/repos/$repo/commits/$sha" | jq -r '.sha'
curl -fsSL "https://api.github.com/repos/$repo/commits/$commit" | jq -r '.sha'Repository: evolution-gaming/serially
Length of output: 300
🏁 Script executed:
#!/bin/bash
set -eu
repo='evolution-gaming/scala-github-actions'
sha='dde27b9bd793d41d5aacf8fb74403c9de5da1146'
tag='v6.3.0'
workflow="$(curl -fsSL "https://raw.githubusercontent.com/$repo/$sha/.github/workflows/ci.yml")"
printf '%s\n' '--- pinned workflow ---'
awk '{printf "%5d\t%s\n", NR, $0}' <<<"$workflow"
printf '%s\n' '--- permission-related declarations in pinned workflow ---'
grep -n -C 3 -E 'permissions:|contents:|packages:|id-token:|pull-requests:|actions:|github-token|GITHUB_TOKEN' <<<"$workflow" || true
printf '%s\n' '--- tag ref ---'
ref_json="$(curl -fsSL "https://api.github.com/repos/$repo/git/ref/tags/$tag")"
printf '%s\n' "$ref_json" | jq '{ref, object}'
type="$(printf '%s\n' "$ref_json" | jq -r '.object.type')"
tag_object="$(printf '%s\n' "$ref_json" | jq -r '.object.sha')"
if [ "$type" = tag ]; then
commit="$(curl -fsSL "https://api.github.com/repos/$repo/git/tags/$tag_object" | jq -r '.object.sha')"
else
commit="$tag_object"
fi
printf 'dereferenced_tag_commit=%s\n' "$commit"
printf '%s\n' '--- commit existence checks ---'
curl -fsSL "https://api.github.com/repos/$repo/commits/$sha" | jq -r '.sha'
curl -fsSL "https://api.github.com/repos/$repo/commits/$commit" | jq -r '.sha'Repository: evolution-gaming/serially
Length of output: 9431
Declare least-privilege permissions for the reusable CI job.
The called workflow checks out repository contents. Add contents: read and grant no broader token permissions.
🧰 Tools
🪛 GitHub Check: SonarCloud Code Analysis
[warning] 11-11: Complete the task associated to this "TODO" comment.
🪛 zizmor (1.29.0)
[warning] 9-13: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 9 - 13, Update the reusable CI job
declaration under test to grant the least-privilege GitHub token permission
contents: read, with no broader permissions enabled. Keep the existing uses and
with configuration unchanged.
Source: Linters/SAST tools
| # TODO remove after first release with Scala 3 support | ||
| with: | ||
| version_policy_check: false No newline at end of file |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Track and re-enable the version-policy check.
version_policy_check: false disables the version-policy gate introduced by this PR. The TODO has no linked issue or automated release condition.
After Scala 3 support is available, set this value to true. Until then, link a tracking issue and make re-enablement a release prerequisite.
🧰 Tools
🪛 GitHub Check: SonarCloud Code Analysis
[warning] 11-11: Complete the task associated to this "TODO" comment.
🪛 zizmor (1.29.0)
[warning] 9-13: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 11 - 13, Update the CI workflow’s
version_policy_check configuration to track Scala 3 support explicitly: add a
linked tracking issue to the TODO and document that re-enabling the check is a
prerequisite for the first Scala 3-supported release, then set
version_policy_check to true once that release condition is met.
Source: Linters/SAST tools
2 participants
Summary by CodeRabbit
Build & Tooling
CI/CD
Maintenance