Try to trigger CI automatically for PRs created by the xDS protobuf update#6715
Open
Try to trigger CI automatically for PRs created by the xDS protobuf update#6715
Conversation
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds explicit PAT use for PR creation, forwards caller workflow secrets into a reusable workflow ( Changes
Sequence Diagram(s)sequenceDiagram
participant Runner as Actions Runner
participant Workflow as GitHub Workflow
participant Script as update-sha.sh
participant GitHub as GitHub API
participant Raw as Repository (raw file)
Runner->>Workflow: start job
Workflow->>Script: run update-sha.sh (env: GITHUB_TOKEN?)
Script->>GitHub: github_curl GET /repos/.../git/ref/tags/<tag>
GitHub-->>Script: 2xx + tag JSON or non-2xx + error
alt success and SHA resolved
Script->>Raw: github_curl GET raw/.../repository_locations.bzl
Raw-->>Script: 2xx + file content
Script->>Workflow: output resolved SHA
else failure
Script-->>Workflow: exit 1 with stderr (HTTP code + body)
end
Workflow->>GitHub: peter-evans/create-pull-request (token: ARMERIAN_PAT)
GitHub-->>Workflow: PR created or error
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/xds-sync-apis.yml:
- Line 24: Replace the broad "secrets: inherit" usage in the reusable workflow
call with an explicit secret mapping that only passes ARMERIAN_PAT to the called
workflow (the one referenced as xds-apply-updates.yml). Locate the call site
containing "secrets: inherit" and change it to supply only ARMERIAN_PAT (mapping
ARMERIAN_PAT to the caller secret) so the reusable workflow receives just that
token rather than all caller secrets.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 37ed6e22-9ac7-4ad2-842d-2864562c8bc1
📒 Files selected for processing (2)
.github/workflows/xds-apply-updates.yml.github/workflows/xds-sync-apis.yml
Contributor
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@xds-api/tools/update-sha.sh`:
- Around line 13-20: The github_curl function currently runs curl while xtrace
may be enabled, risking exposure of $GITHUB_TOKEN; modify github_curl (and the
curl invocation that sets TMPFILE and HTTP_CODE) to temporarily disable xtrace
before calling curl and restore the original xtrace state after the call (save
current xtrace state, turn off tracing, run curl with
"${CURL_AUTH[@]+"${CURL_AUTH[@]}"}" and "$@", then restore tracing). Ensure this
change targets the github_curl function and does not alter other behavior like
TMPFILE cleanup or HTTP_CODE capture.
- Around line 10-15: The CI runs unauthenticated because the script relies on
GITHUB_TOKEN but the workflow step doesn’t export it; update the workflow step
that invokes update-sha.sh to pass GITHUB_TOKEN via an env: entry so the
script’s check for GITHUB_TOKEN populates CURL_AUTH, or alternatively modify the
script’s CURL_AUTH handling to accept a passed-in token variable and use
"Authorization: Bearer $GITHUB_TOKEN" when present; ensure the variable name
referenced (GITHUB_TOKEN) and the CURL_AUTH array logic remain consistent with
the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 99d20381-7806-4eb9-8402-0f7ab937d5fc
📒 Files selected for processing (1)
xds-api/tools/update-sha.sh
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@xds-api/tools/update-sha.sh`:
- Around line 49-53: The command substitution assigning ENVOY_VERSION from
find_envoy_sha_from_tag can cause the script to exit early under set -e /
pipefail if the pipeline inside that function fails; change the assignment to
capture the function's stdout but prevent immediate exit (for example, run
find_envoy_sha_from_tag "$1" with "|| true" or otherwise capture output into a
temp variable while preserving any non-zero exit so the subsequent empty-check
on ENVOY_VERSION still runs), keeping the existing guard that checks [[ -z
"$ENVOY_VERSION" ]] and exits with the error message; update the code around the
ENVOY_VERSION assignment (the find_envoy_sha_from_tag call and the ENVOY_VERSION
variable) so the guard block is reachable even when the internal pipeline fails.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 6f2c7d11-a48c-4015-afcb-66942857821a
📒 Files selected for processing (2)
xds-api/tools/update-api.shxds-api/tools/update-sha.sh
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/xds-sync-apis.yml:
- Around line 24-25: The caller workflow is passing an undeclared secret
ARMERIAN_PAT to the reusable workflow xds-apply-updates.yml which causes
failures; either remove the secrets: ARMERIAN_PAT mapping from the caller or
declare ARMERIAN_PAT under on.workflow_call.secrets in xds-apply-updates.yml so
the reusable workflow accepts it (and ensure the called workflow actually uses
the secret if declared). Use the secret name ARMERIAN_PAT and the reusable
workflow identifier xds-apply-updates.yml to locate where to remove the mapping
or add the declaration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: ac83bfed-ea44-47b6-b007-f76c20cbba10
📒 Files selected for processing (1)
.github/workflows/xds-sync-apis.yml
This reverts commit 309c3d2.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation:
The
xds-apply-updates.ymlworkflow creates PRs using the defaultGITHUB_TOKENviapeter-evans/create-pull-request. Apparently CI is not run for events created withGITHUB_TOKEN, so the automatically created xDS protobuf update PRs never get CI runs.Sample: jrhee17#45
Modifications:
ARMERIAN_PATinstead of the defaultGITHUB_TOKENin thepeter-evans/create-pull-requeststep ofxds-apply-updates.yml.secrets: inherittoxds-sync-apis.ymlso thatARMERIAN_PATis available to the called workflow.update-sha.shlocally got me rate-limited. Added a way to add auth token headers.Result: