ci: add the ci-no-infra-g1 reusable workflow - #6008
Conversation
no-infra-g1 is the only group flagged NEW by lint_group_coverage.py:
WARN [missing-workflow:NEW] group 'no-infra-g1' is not selectable by any
workflow on this branch or on origin/GH-Actions -- tests registered in
it never run in CI.
Its five tests have never executed in CI:
admin_set_credentials_logging-t
listener_conflicts_validation-t
reg_test_5363_admin_monitor_caching_sha2-t
test_passthrough_auth_admin-t
test_passthrough_auth_misconfig_warning-t
reg_test_5363 is the regression test for the Admin/Monitor caching_sha2
work, so the group it guards was never actually guarded.
Derived from ci-mysql84-g1.yml with the group renamed; infras.lst for this
group is empty, so no backend containers start and the group is cheap
(~73s locally). timeout-minutes is set here directly since this file is new.
The caller half (CI-no-infra-g1.yml on v3.0) ships separately.
📝 WalkthroughWalkthroughAdded the Changesno-infra-g1 CI workflow
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Workflow
participant GitHubAPI
participant Runner
participant ArtifactStore
participant GHCR
participant Infrastructure
participant Codecov
participant GitHubChecks
Workflow->>GitHubAPI: inspect runner demand and resolve artifacts
GitHubAPI-->>Workflow: return runner and artifact data
Workflow->>Runner: execute test job
Runner->>ArtifactStore: download and unpack build handoff
Runner->>GHCR: authenticate and pull CI image
Runner->>Infrastructure: start infrastructure and run no-infra-g1 tests
Infrastructure-->>Runner: return test and coverage results
Runner->>Infrastructure: clean up logs, containers, and infrastructure
Runner->>Codecov: upload explicit LCOV report
Runner->>GitHubChecks: publish job conclusion
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci-no-infra-g1.yml:
- Line 90: Replace the workflow job’s permissions: write-all setting with
explicit permissions for actions: read, contents: read, id-token: write,
packages: read, and checks: write. Keep the job’s existing behavior for artifact
retrieval, GHCR authentication, GitHub Check updates, and Codecov upload.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: a1dc2db1-938a-496b-8ed1-735b4eb30782
📒 Files selected for processing (1)
.github/workflows/ci-no-infra-g1.yml
📜 Review details
🧰 Additional context used
🪛 zizmor (1.29.0)
.github/workflows/ci-no-infra-g1.yml
[warning] 113-129: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 90-90: overly broad permissions (excessive-permissions): uses write-all permissions
(excessive-permissions)
🔇 Additional comments (1)
.github/workflows/ci-no-infra-g1.yml (1)
1-84: LGTM!Also applies to: 91-359
| # token for `use_oidc: true`. Caller workflow on v3.0 must also | ||
| # declare write-all for the permissions to propagate through the | ||
| # reusable call (permissions are intersected caller-callee). | ||
| permissions: write-all |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
sed -n '1,140p' .github/workflows/ci-no-infra-g1.yml
echo
echo "== permission occurrences =="
rg -n "permissions:|github_token_permissions|write-all|id-token|actions:|checks:|contents:|packages:" .github/workflows/ci-no-infra-g1.yml || true
echo "== codecov references =="
rg -n "codecov|gh api|checks-action|checkout|set --pull-request" .github/workflows/ci-no-infra-g1.yml || true
echo "== related workflows permissions =="
rg -n "permissions:\s*write-all|id-token:" .github/workflows || trueRepository: sysown/proxysql
Length of output: 17849
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== call sites for ci-no-infra-g1 =="
rg -n "ci-no-infra-g1|needs:.*CI|uses:.*/main|on:\n workflow_call|permissions:\s*write-all" .github/workflows/*.yml .github/ 2>/dev/null || true
echo
echo "== workflow_call permissions in caller-like workflows near call site =="
for f in .github/workflows/ci-no-infra-g1.yml .github/workflows/ci-mysql84-gr-g1.yml; do
[ -f "$f" ] || continue
echo "-- $f"
sed -n '1,120p' "$f"
doneRepository: sysown/proxysql
Length of output: 11746
🌐 Web query:
Codecov GitHub Actions oidc GITHUB_TOKEN permissions id-token write
💡 Result:
To use OpenID Connect (OIDC) with the Codecov GitHub Action, you must explicitly grant the id-token: write permission within your GitHub Actions workflow [1][2][3]. This configuration allows the action to request a short-lived OIDC token to authenticate with Codecov, eliminating the need for a long-lived repository secret [1][4]. To implement this, add the following configuration to your workflow or job [1][3]: permissions: id-token: write # Ensure you also have read permissions if you have overridden defaults contents: read Then, configure the codecov-action to use OIDC by setting the use_oidc argument to true [1][2][3]: - uses: codecov/codecov-action@v5 with: use_oidc: true Important considerations: - Permission Scope: When you define a permissions block at the workflow or job level, it overrides all default permissions [5]. If you override these defaults, ensure you include contents: read so that steps like actions/checkout can still function [5]. - Token Behavior: If use_oidc: true is set, any token or CODECOV_TOKEN provided to the action will be ignored, as the action will default to using the OIDC token for authentication [1][2][3]. - Forks: OIDC authentication is generally not applicable to pull requests from forks [6][7]. The action handles tokenless uploads for forks automatically, which remains the standard approach for those scenarios [6][8].
Citations:
- 1: https://github.com/codecov/codecov-action/blob/main/README.md
- 2: https://github.com/codecov/codecov-action
- 3: https://github.com/marketplace/actions/codecov
- 4: https://docs.github.com/en/actions/concepts/security/openid-connect
- 5: Adjust readme regarding OIDC auth codecov/codecov-action#1843
- 6: how to enable openid connect with codecov and github actions? codecov/codecov-action#1489
- 7: Add support for OIDC instead of token codecov/codecov-action#1016
- 8: https://github.com/codecov/codecov-action/blob/master/action.yml
Replace write-all with the required permissions.
This job only needs actions: read, contents: read, id-token: write, packages: read, and checks: write; write-all grants every supported GITHUB_TOKEN write scope.
Proposed fix
- permissions: write-all
+ permissions:
+ actions: read
+ checks: write
+ contents: read
+ id-token: write
+ packages: read</细节>
Run this workflow after the change to verify artifact retrieval, GHCR authentication, GitHub Check updates, and Codecov upload.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: write-all | |
| permissions: | |
| actions: read | |
| checks: write | |
| contents: read | |
| id-token: write | |
| packages: read |
🧰 Tools
🪛 zizmor (1.29.0)
[error] 90-90: overly broad permissions (excessive-permissions): uses write-all permissions
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci-no-infra-g1.yml at line 90, Replace the workflow job’s
permissions: write-all setting with explicit permissions for actions: read,
contents: read, id-token: write, packages: read, and checks: write. Keep the
job’s existing behavior for artifact retrieval, GHCR authentication, GitHub
Check updates, and Codecov upload.
Source: Linters/SAST tools
|
1 participant
no-infra-g1is the only grouplint_group_coverage.pyflags as NEW — its five tests have never executed in CI:admin_set_credentials_logging-tlistener_conflicts_validation-treg_test_5363_admin_monitor_caching_sha2-ttest_passthrough_auth_admin-ttest_passthrough_auth_misconfig_warning-treg_test_5363is the regression test for the Admin/Monitorcaching_sha2work — so the behaviour it guards was never actually guarded.Derived from
ci-mysql84-g1.ymlwith the group renamed.infras.lstfor this group is empty, so no backend containers start and the group is cheap (~73s locally).timeout-minutes: 120is set directly since the file is new.Caller half: the companion PR against
v3.0. Merge this one first — otherwise the caller resolves to a missing workflow.Summary by CodeRabbit