ci(infra): fix existing workflows — path filters, npm workspace, buildx - #465
Conversation
Also add Dependabot config and CodeQL analysis.
- check-lint: npm ci from root, --workspace flags, path filters - check-test: path filters to scope core-api changes only - frontend-tests: checkout v5, remove develop branch, path filter - check-build: remove aggregation job, add Docker GHA cache - build-release/nightly: remove manual buildx create, QEMU semver
- test-local.sh: wrapper around act for running workflows locally - .actrc: default act configuration (ubuntu-latest image) - DEVELOPER_GUIDE.md: add Local CI Testing section
📝 WalkthroughWalkthroughThis PR adds CI tooling improvements: a local act-based workflow runner script and config, Dependabot configuration, a new Worker CI workflow, a changelog builder config, path-based trigger filters, GitHub Actions Docker layer caching, npm workspace lint invocation, action version bumps, and developer guide documentation. ChangesCI Workflow and Tooling Updates
Sequence Diagram(s)sequenceDiagram
participant Developer
participant TestLocalScript
participant ActBinary
Developer->>TestLocalScript: run test-local.sh <workflow>
TestLocalScript->>ActBinary: locate act binary
TestLocalScript->>TestLocalScript: validate workflow file exists
TestLocalScript->>ActBinary: run act --workflows <file> --container-architecture linux/amd64 --reuse
ActBinary-->>Developer: workflow execution results
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Categories: Features, Bug Fixes, Improvements, Docs & Testing, Maintenance
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/check-build.yml (1)
44-64: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick winMissing explicit
permissionsblock on build jobs (excessive-permissions).zizmor flags
build-consoleandbuild-core-apifor using default (overly broad)GITHUB_TOKENpermissions since nopermissions:block is set;build-workerhas the identical gap. These jobs only checkout and build locally (push: false,load: true), socontents: readis all that's needed.🔒️ Proposed fix (repeat for each of the 3 jobs)
build-console: name: Build Docker - Console runs-on: ubuntu-latest needs: changes if: needs.changes.outputs.console == 'true' + permissions: + contents: read steps:Also applies to: 66-86, 88-108
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/check-build.yml around lines 44 - 64, The build jobs are relying on the default GITHUB_TOKEN permissions, which are broader than needed. Add an explicit permissions block to each of the Docker build jobs in check-build.yml, namely build-console, build-core-api, and build-worker, and restrict them to contents: read since they only run checkout and local Docker builds with no pushes. Keep the rest of each job unchanged and mirror the same permission setting across all three jobs for consistency.Source: Linters/SAST tools
🧹 Nitpick comments (5)
.github/workflows/worker-ci.yml (3)
32-39: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win
go fmt ./...mutates files in place while being used as a check.
go fmtreformats files and prints only the names of files it changed, so this step will silently rewrite source files on the runner before checking. It works for detection purposes here, butgofmt -l .is the more idiomatic non-mutating equivalent for CI format checks.♻️ Proposed fix
- name: Check go fmt run: | - unformatted=$(go fmt ./...) + unformatted=$(gofmt -l .) if [ -n "$unformatted" ]; then echo "Unformatted files:" echo "$unformatted" exit 1 fi🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/worker-ci.yml around lines 32 - 39, The Go formatting CI check in the worker workflow is using go fmt, which mutates files instead of only detecting unformatted ones. Update the “Check go fmt” step to use a non-mutating formatter check such as gofmt -l for the same package scope, and keep the existing failure logic so the job fails when any files are not properly formatted.
3-14: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick winAdd a concurrency group to cancel superseded runs.
Without
concurrency, rapid pushes to the same PR/branch queue redundant fmt/vet/build runs instead of canceling stale ones, wasting runner minutes.♻️ Proposed addition
on: ... workflow_dispatch: +concurrency: + group: worker-ci-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + permissions: contents: read🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/worker-ci.yml around lines 3 - 14, Add a concurrency configuration to the worker-ci workflow so newer runs cancel older in-progress runs for the same branch or PR. Update the workflow definition alongside the existing on/push/pull_request/workflow_dispatch triggers by adding a concurrency group keyed on the ref or PR context and enabling cancel-in-progress. Use the workflow’s existing name/trigger block to place the setting so fmt/vet/build jobs in stale runs are superseded automatically.
3-14: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick winDuplicate CI runs:
pushandpull_requestboth trigger on all branches.For PRs within this repo (not forks),
branches: '**'onpushpluspull_requestwith the same path filter causes both events to fire for the same commit, running fmt/vet/build twice.♻️ Proposed fix
on: push: branches: - - '**' + - main paths: - 'worker/**' pull_request: branches: - '**' paths: - 'worker/**' workflow_dispatch:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/worker-ci.yml around lines 3 - 14, The worker CI workflow is triggering duplicate runs because both the top-level push and pull_request events match all branches for the same worker path changes. Update the triggers in the workflow definition so the same commit does not start two runs, using the workflow’s event configuration to keep only the intended CI path for branch commits while preserving PR coverage; adjust the on: block in worker-ci.yml accordingly..github/scripts/test-local.sh (1)
61-66: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueUnused
jobsvariable.Shellcheck flags
jobs(line 64) as computed but never used in the printed output.♻️ Suggested fix: either use it or drop it
for f in .github/workflows/*.yml; do name=$(basename "$f" .yml) desc=$(grep "^name:" "$f" | sed 's/name: *//') - jobs=$(grep -c "^\s\+[a-z_-]\+:" "$f" || true) printf " %-25s %s\n" "$name" "$desc" doneOr, if job count was meant to be shown:
- printf " %-25s %s\n" "$name" "$desc" + printf " %-25s %-40s (%s jobs)\n" "$name" "$desc" "$jobs"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/scripts/test-local.sh around lines 61 - 66, The workflow summary loop in test-local.sh computes a jobs value that is never used in the output. In the loop that builds name and desc, either remove the jobs assignment entirely or include the job count in the printf output so the variable is actually used; keep the fix localized to the summary-printing block.Source: Linters/SAST tools
.github/dependabot.yml (1)
3-21: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueAdd
group-by: dependency-nameif you want cross-directory Dependabot PRs.
Without it, updates for/,/core-api, and/consolewill still be split by directory.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/dependabot.yml around lines 3 - 21, The Dependabot configuration currently groups packages by ecosystem but still splits updates across '/', '/core-api', and '/console'. Update the dependabot config in the top-level Dependabot entry to include group-by: dependency-name so cross-directory updates can be combined, and keep the existing groups under the same configuration block (nestjs, react, eslint) so dependency-name grouping applies consistently.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/.actrc:
- Around line 1-3: Move the act runner mapping out of .github/.actrc and into
the repo-root .actrc so test-local.sh picks it up when run from the root. Keep
only the ubuntu-latest platform mapping in the root config;
--container-architecture and --reuse are already handled by the script. Use the
.actrc config entry and the test-local.sh invocation path to verify the correct
file is being read.
In @.github/scripts/test-local.sh:
- Line 63: The workflow name extraction in test-local.sh is too fragile because
the grep/sed pipeline can abort the script under set -euo pipefail when a file
lacks a top-level name: field. Update the list loop’s desc assignment to handle
missing matches safely, using the existing grep/sed logic around desc and the
surrounding workflow file iteration to fall back gracefully instead of exiting.
Keep the change localized to the name parsing path in test-local.sh.
In @.github/workflows/check-build.yml:
- Around line 63-64: The GHA cache configuration in the workflow is using the
same default BuildKit cache scope across multiple jobs, which can cause the
console, core-api, and worker caches to overwrite each other. Update each job’s
cache settings in the workflow to use a distinct scope value in the
cache-from/cache-to entries, using the job-specific identifiers for the console,
core-api, and worker build steps so each cache remains isolated.
In @.github/workflows/codeql-analysis.yml:
- Line 25: Add persist-credentials set to false on the actions/checkout usage in
the CodeQL workflow so the GitHub token is not left in the local git config.
Update the checkout step in the workflow that uses actions/checkout@v5 to
explicitly disable credential persistence, keeping the change localized to that
checkout configuration.
- Around line 22-30: The CodeQL workflow currently uses a single init
configuration for both matrix languages, but build-mode: none only works for
javascript-typescript and not for go. Update the CodeQL setup in the workflow so
the init step branches by matrix.language: keep none for javascript-typescript
and use autobuild or manual for go. Use the existing actions/checkout and
github/codeql-action/init steps as the anchors for this per-language build-mode
split.
In @.github/workflows/frontend-tests.yml:
- Line 19: The frontend-tests workflow checkout step is persisting GitHub
credentials unnecessarily. Update the actions/checkout usage in the
frontend-tests job to disable credential persistence by setting
persist-credentials to false on the checkout step. Keep the change scoped to the
checkout action used before the coverage artifact upload.
- Around line 5-8: Update the frontend-tests workflow trigger so the
`pull_request` block matches the same file scoping as `push`. Add a `paths`
filter for `console/**` under the `pull_request` trigger in the workflow
definition, keeping the existing `branches: [main]` constraint so only PRs
touching that area run the job.
In @.github/workflows/worker-ci.yml:
- Line 27: The three actions/checkout steps in the workflow currently persist
git credentials, which zizmor flags as unnecessary exposure. Update each
checkout invocation in the worker CI jobs to set persist-credentials to false so
the repository token is not retained after checkout. Use the existing checkout
steps in the workflow as the target locations and apply the same change
consistently to all three.
In `@DEVELOPER_GUIDE.md`:
- Around line 336-346: The `worker-ci.yml` entry in the Local Test Equivalents
table does not match the workflow’s actual jobs, because `task worker:lint &&
task worker:check` omits formatting and only covers a subset. Update the row to
reference the same task sequence as the workflow’s `fmt`/`vet`/`build` jobs, or
explicitly rename the shortcut if it is intended to represent only part of
`worker-ci.yml`. Use the `worker-ci.yml` label and the `Local Test Equivalents`
table row to locate the change.
---
Outside diff comments:
In @.github/workflows/check-build.yml:
- Around line 44-64: The build jobs are relying on the default GITHUB_TOKEN
permissions, which are broader than needed. Add an explicit permissions block to
each of the Docker build jobs in check-build.yml, namely build-console,
build-core-api, and build-worker, and restrict them to contents: read since they
only run checkout and local Docker builds with no pushes. Keep the rest of each
job unchanged and mirror the same permission setting across all three jobs for
consistency.
---
Nitpick comments:
In @.github/dependabot.yml:
- Around line 3-21: The Dependabot configuration currently groups packages by
ecosystem but still splits updates across '/', '/core-api', and '/console'.
Update the dependabot config in the top-level Dependabot entry to include
group-by: dependency-name so cross-directory updates can be combined, and keep
the existing groups under the same configuration block (nestjs, react, eslint)
so dependency-name grouping applies consistently.
In @.github/scripts/test-local.sh:
- Around line 61-66: The workflow summary loop in test-local.sh computes a jobs
value that is never used in the output. In the loop that builds name and desc,
either remove the jobs assignment entirely or include the job count in the
printf output so the variable is actually used; keep the fix localized to the
summary-printing block.
In @.github/workflows/worker-ci.yml:
- Around line 32-39: The Go formatting CI check in the worker workflow is using
go fmt, which mutates files instead of only detecting unformatted ones. Update
the “Check go fmt” step to use a non-mutating formatter check such as gofmt -l
for the same package scope, and keep the existing failure logic so the job fails
when any files are not properly formatted.
- Around line 3-14: Add a concurrency configuration to the worker-ci workflow so
newer runs cancel older in-progress runs for the same branch or PR. Update the
workflow definition alongside the existing
on/push/pull_request/workflow_dispatch triggers by adding a concurrency group
keyed on the ref or PR context and enabling cancel-in-progress. Use the
workflow’s existing name/trigger block to place the setting so fmt/vet/build
jobs in stale runs are superseded automatically.
- Around line 3-14: The worker CI workflow is triggering duplicate runs because
both the top-level push and pull_request events match all branches for the same
worker path changes. Update the triggers in the workflow definition so the same
commit does not start two runs, using the workflow’s event configuration to keep
only the intended CI path for branch commits while preserving PR coverage;
adjust the on: block in worker-ci.yml accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: ef20d7ce-adfb-44f5-ad8e-353d31b0c5b5
📒 Files selected for processing (12)
.github/.actrc.github/dependabot.yml.github/scripts/test-local.sh.github/workflows/build-nightly.yml.github/workflows/build-release.yml.github/workflows/check-build.yml.github/workflows/check-lint.yml.github/workflows/check-test.yml.github/workflows/codeql-analysis.yml.github/workflows/frontend-tests.yml.github/workflows/worker-ci.ymlDEVELOPER_GUIDE.md
| -P ubuntu-latest=catthehacker/ubuntu:full-latest | ||
| --container-architecture linux/amd64 | ||
| --reuse |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
git ls-files .github/.actrc .actrc test-local.sh .github/workflowsRepository: oasm-platform/open-asm
Length of output: 454
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- test-local.sh ---'
if [ -f test-local.sh ]; then
wc -l test-local.sh
sed -n '1,220p' test-local.sh | cat -n
else
echo 'test-local.sh not found'
fi
printf '\n%s\n' '--- .github/.actrc ---'
wc -l .github/.actrc
cat -n .github/.actrc
printf '\n%s\n' '--- repo root .actrc ---'
if [ -f .actrc ]; then
wc -l .actrc
cat -n .actrc
else
echo 'no .actrc at repo root'
fiRepository: oasm-platform/open-asm
Length of output: 411
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n --hidden --glob '!**/.git/**' '\bact\b|\.actrc|--container-architecture|--reuse|-P ubuntu-latest' .Repository: oasm-platform/open-asm
Length of output: 4415
🏁 Script executed:
#!/bin/bash
set -euo pipefail
wc -l .github/scripts/test-local.sh
sed -n '1,220p' .github/scripts/test-local.sh | cat -nRepository: oasm-platform/open-asm
Length of output: 4221
Move this config to .actrc at the repo root act won’t read .github/.actrc when test-local.sh runs from the repo root, so the -P ubuntu-latest=... mapping is ignored. --container-architecture and --reuse are already set in the script.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/.actrc around lines 1 - 3, Move the act runner mapping out of
.github/.actrc and into the repo-root .actrc so test-local.sh picks it up when
run from the root. Keep only the ubuntu-latest platform mapping in the root
config; --container-architecture and --reuse are already handled by the script.
Use the .actrc config entry and the test-local.sh invocation path to verify the
correct file is being read.
| echo "" | ||
| for f in .github/workflows/*.yml; do | ||
| name=$(basename "$f" .yml) | ||
| desc=$(grep "^name:" "$f" | sed 's/name: *//') |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Potential script abort if a workflow lacks a top-level name: field.
With set -euo pipefail, if grep "^name:" "$f" finds no match, the pipeline's exit status is non-zero (pipefail takes the rightmost failing command), aborting the list loop under set -e. Currently all workflow files declare name:, but this is fragile for future additions.
🛡️ Suggested defensive fix
- desc=$(grep "^name:" "$f" | sed 's/name: *//')
+ desc=$(grep "^name:" "$f" | sed 's/name: *//' || true)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| desc=$(grep "^name:" "$f" | sed 's/name: *//') | |
| desc=$(grep "^name:" "$f" | sed 's/name: *//' || true) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/scripts/test-local.sh at line 63, The workflow name extraction in
test-local.sh is too fragile because the grep/sed pipeline can abort the script
under set -euo pipefail when a file lacks a top-level name: field. Update the
list loop’s desc assignment to handle missing matches safely, using the existing
grep/sed logic around desc and the surrounding workflow file iteration to fall
back gracefully instead of exiting. Keep the change localized to the name
parsing path in test-local.sh.
| cache-from: type=gha | ||
| cache-to: type=gha,mode=max |
There was a problem hiding this comment.
🚀 Performance & Scalability | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Docker buildx GHA cache backend default scope buildkit multiple builds overwrite
💡 Result:
When using the GitHub Actions (GHA) cache backend with Docker Buildx, the default scope is set to buildkit [1]. Because build caches are not automatically merged, exporting a cache to the same scope will overwrite any existing cache data previously stored under that same scope [1][2][3]. If you run multiple build jobs in a single workflow using the default buildkit scope, each build will attempt to write to the same cache location, meaning only the cache from the last job to finish will be preserved [1][4][3]. To avoid this, you should use the scope attribute to provide a unique identifier for each cache object [1][3]. Example of scoping to avoid overwriting: --cache-to type=gha,mode=max,scope=image-a --cache-from type=gha,scope=image-a When importing, you can specify multiple scope attributes (or multiple --cache-from lines) to aggregate cache from different sources [5][3]. Note that GitHub Actions has cache access restrictions, meaning workflows can generally only access caches from the current branch, base branch, and default branch [1].
Citations:
- 1: https://docs.docker.com/build/cache/backends/gha/
- 2: cache backend for github actions moby/buildkit#1974
- 3: GHA cache clobbered by multiple jobs in the same workflow moby/buildkit#2529
- 4: GHA cache gets overridden when building multiple images in a single workflow docker/build-push-action#867
- 5: https://stackoverflow.com/questions/74113734/share-gha-docker-cache-among-branches
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the workflow with line numbers around the build jobs
nl -ba .github/workflows/check-build.yml | sed -n '1,180p'
echo
echo "---- top-level permissions/search ----"
rg -n '^\s*permissions:|cache-from: type=gha|cache-to: type=gha|docker/build-push-action' .github/workflows/check-build.ymlRepository: oasm-platform/open-asm
Length of output: 200
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "---- check-build workflow excerpt ----"
awk 'NR>=1 && NR<=180 { printf "%4d %s\n", NR, $0 }' .github/workflows/check-build.yml
echo
echo "---- matches for permissions/cache/build-push-action ----"
awk '
/^(permissions:|[[:space:]]+permissions:|[[:space:]]+cache-from: type=gha|[[:space:]]+cache-to: type=gha|[[:space:]]+uses: docker\/build-push-action@v5)/ {
printf "%4d %s\n", NR, $0
}
' .github/workflows/check-build.ymlRepository: oasm-platform/open-asm
Length of output: 4014
🌐 Web query:
Docker buildx GHA cache backend permissions actions write contents read build-push-action cache-to type=gha
💡 Result:
The GitHub Actions (GHA) cache backend for Docker Buildx enables storing build cache directly in the native GitHub Actions cache service [1][2]. Permissions and Requirements: 1. Execution Context: This cache backend must be used exclusively within a GitHub Actions workflow [2][3]. The backend relies on environment variables (specifically $ACTIONS_RESULTS_URL and $ACTIONS_RUNTIME_TOKEN) that are only populated within a workflow run [1][2]. 2. Builder Requirements: You must use the docker-container driver to support this cache backend [4]. The recommended way to set this up is by using the docker/setup-buildx-action, which automatically configures the builder with the necessary driver and environment variables [2][5][4]. 3. GitHub Token Permissions: By default, the cache backend uses the job's built-in token to access the GitHub Cache API [1][3]. Generally, no specific elevated permissions are required in the workflow 'permissions' block for the cache itself if you are using the default GHA token, as it has implicit access to the cache service for the current repository [1]. However, if you provide a custom 'ghtoken' via the cache parameters, that token must have the 'repo' scope to access the GitHub Actions cache API [1]. 4. API Version: Ensure you are using modern versions of Buildx (>= v0.21.0) and BuildKit (>= v0.20.0), as support for the legacy GitHub Cache API v1 was sunset in April 2025 [2]. Example Configuration: - uses: docker/setup-buildx-action@v4 - uses: docker/build-push-action@v7 with: push: true tags: user/app:latest cache-from: type=gha cache-to: type=gha,mode=max
Citations:
- 1: https://docs.docker.com/build/cache/backends/gha/
- 2: https://docs.docker.com/build/ci/github-actions/cache/
- 3: https://github.com/docker/build-push-action/blob/e27bcee4eb9e7b4bc168418e3364c4482120393a/docs/advanced/cache.md
- 4: FlawlessByte/quant-research-mcp@69b7f08
- 5: https://github.com/docker/build-push-action/
🌐 Web query:
docker/build-push-action GHA cache export permissions actions write docs
💡 Result:
When using the docker/build-push-action with the gha (GitHub Actions) cache backend, you generally do not need to manually configure explicit permissions to export to the GitHub Cache service [1]. The action automatically handles the necessary authentication using the ACTIONS_RUNTIME_TOKEN and ACTIONS_CACHE_URL environment variables, which are populated by the GitHub Actions runner environment [2][3][1]. Key details regarding permissions and configuration: 1. Automatic Authentication: When you use type=gha in cache-from or cache-to, the docker/build-push-action automatically detects the environment and uses the provided GitHub Actions runtime token [1]. You do not need to manually pass a token to the cache configuration [1]. 2. GITHUB_TOKEN vs. Cache Access: It is important to distinguish between permissions for the GitHub Container Registry (GHCR) and permissions for the GitHub Actions Cache [4]. - If you are pushing an image to GHCR, your job requires explicit packages: write permissions [4]. - Access to the GitHub Actions Cache service, however, is managed by the runner's built-in runtime token and does not require you to grant actions: write or similar explicit permissions in your workflow's permissions block [2][1]. 3. Troubleshooting: If you encounter issues (such as "permission denied" or "error writing layer blob"), ensure you are using up-to-date versions of docker/build-push-action and docker/setup-buildx-action [2][5]. As of April 15, 2025, the GitHub Cache service API v1 has been deprecated, and you must use tools that support the v2 API (e.g., Buildx v0.21.0+) [2]. If errors persist, they are more likely related to service connectivity or version compatibility rather than missing workflow permissions [5]. If you are using a self-hosted runner and experience issues with the cache, ensure your environment variables (specifically ACTIONS_RUNTIME_TOKEN and ACTIONS_CACHE_URL) are properly exposed if you are running build commands manually outside of the standard docker/build-push-action [1]. For the action itself, no manual exposure is required [1].
Citations:
- 1: https://docs.docker.com/build/cache/backends/gha/
- 2: https://docs.docker.com/build/ci/github-actions/cache/
- 3: https://github.com/docker/build-push-action/blob/e27bcee4eb9e7b4bc168418e3364c4482120393a/docs/advanced/cache.md
- 4: https://theneuralbase.com/docker-for-ml/learn/intermediate/ghcr-for-github-projects/
- 5: v6.4.0 breaks GitHub Actions cache docker/build-push-action#1181
🌐 Web query:
docker/build-push-action github actions token permissions cache-to type=gha actions: write
💡 Result:
When using the docker/build-push-action with cache-to: type=gha, you generally do not need to manually configure GitHub Actions permissions [1]. The action automatically populates the required URL and token parameters using the GITHUB_TOKEN provided by the GitHub Actions workflow environment [1][2]. Key details regarding permissions and configuration: 1. Automatic Token Handling: The docker/build-push-action automatically manages authentication for the GitHub Actions cache service [1]. It uses the environment variables ACTIONS_RESULTS_URL and ACTIONS_RUNTIME_TOKEN, which are present by default in GitHub Actions workflows [1][2][3]. 2. Permissions: No explicit permissions configuration (such as adding actions: write) is required in your workflow YAML file for the cache backend to function, as long as you are running within a standard GitHub Actions job [1][2]. 3. Usage: You only need to specify the cache configuration in your workflow step [1][2]: - name: Build and push uses: docker/build-push-action@v7 with: push: true tags: user/app:latest cache-from: type=gha cache-to: type=gha,mode=max If you encounter issues or wish to use a specific token, you can manually pass a token via the github-token input (e.g., github-token: ${{ secrets.MY_CUSTOM_TOKEN }}), but this is typically unnecessary [1]. Ensure you are using the v2 GitHub Cache service API, as legacy v1 support has been removed [2].
Citations:
- 1: https://docs.docker.com/build/cache/backends/gha/
- 2: https://docs.docker.com/build/ci/github-actions/cache/
- 3: https://github.com/docker/build-push-action/blob/e27bcee4eb9e7b4bc168418e3364c4482120393a/docs/advanced/cache.md
Add a distinct scope to each GHA cache entry.
The console, core-api, and worker jobs all write to the same default buildkit cache scope, so they can overwrite each other’s cache data.
♻️ Proposed fix
- cache-from: type=gha
- cache-to: type=gha,mode=max
+ cache-from: type=gha,scope=console
+ cache-to: type=gha,scope=console,mode=max- cache-from: type=gha
- cache-to: type=gha,mode=max
+ cache-from: type=gha,scope=core-api
+ cache-to: type=gha,scope=core-api,mode=max- cache-from: type=gha
- cache-to: type=gha,mode=max
+ cache-from: type=gha,scope=worker
+ cache-to: type=gha,scope=worker,mode=max📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| cache-from: type=gha,scope=console | |
| cache-to: type=gha,scope=console,mode=max |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 44-64: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/check-build.yml around lines 63 - 64, The GHA cache
configuration in the workflow is using the same default BuildKit cache scope
across multiple jobs, which can cause the console, core-api, and worker caches
to overwrite each other. Update each job’s cache settings in the workflow to use
a distinct scope value in the cache-from/cache-to entries, using the
job-specific identifiers for the console, core-api, and worker build steps so
each cache remains isolated.
| matrix: | ||
| language: ['javascript-typescript', 'go'] | ||
| steps: | ||
| - uses: actions/checkout@v5 | ||
|
|
||
| - uses: github/codeql-action/init@v4 | ||
| with: | ||
| languages: ${{ matrix.language }} | ||
| build-mode: none |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Does GitHub CodeQL init action support build-mode none for Go language in 2026?
💡 Result:
As of July 2026, the GitHub CodeQL init action does not natively support build-mode: none for the Go language [1][2]. While the none build mode is available for interpreted languages and specific compiled languages like C# and Java, it is not supported for Go [1][2][3]. For Go projects, you must use either the autobuild or manual build mode [4][3]. Although there have been internal development efforts and workarounds to facilitate overlay/incremental analysis for Go, the official documentation and the codeql-action specifications maintain that none is not a supported build mode for the language [1][2][5][6].
Citations:
- 1: https://github.com/github/codeql-action/
- 2: https://pkg.go.dev/github.com/github/codeql-action
- 3: https://docs.github.com/en/enterprise-server@3.19/code-security/concepts/code-scanning/codeql/codeql-for-compiled-languages
- 4: https://docs.github.com/en/code-security/reference/code-scanning/codeql/build-options-for-compiled-languages
- 5: github/codeql-action@7892cb2
- 6: Go extractor does not support build-mode: none, preventing overlay/incremental analysis on PRs github/codeql-action#3796
🏁 Script executed:
#!/bin/bash
set -euo pipefail
git ls-files .github/workflows/codeql-analysis.yml
wc -l .github/workflows/codeql-analysis.yml
cat -n .github/workflows/codeql-analysis.yml | sed -n '1,120p'Repository: oasm-platform/open-asm
Length of output: 1232
Use a per-language CodeQL build mode
build-mode: none doesn’t apply to the go matrix entry, so this workflow needs autobuild or manual for Go and none only for javascript-typescript.
Suggested change
strategy:
fail-fast: false
matrix:
- language: ['javascript-typescript', 'go']
+ include:
+ - language: javascript-typescript
+ build-mode: none
+ - language: go
+ build-mode: autobuild
steps:
- uses: actions/checkout@v5
- uses: github/codeql-action/init@v4
with:
languages: ${{ matrix.language }}
- build-mode: none
+ build-mode: ${{ matrix.build-mode }}
queries: security-and-quality📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| matrix: | |
| language: ['javascript-typescript', 'go'] | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: none | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: javascript-typescript | |
| build-mode: none | |
| - language: go | |
| build-mode: autobuild | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: github/codeql-action/init@v4 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: ${{ matrix.build-mode }} | |
| queries: security-and-quality |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql-analysis.yml around lines 22 - 30, The CodeQL
workflow currently uses a single init configuration for both matrix languages,
but build-mode: none only works for javascript-typescript and not for go. Update
the CodeQL setup in the workflow so the init step branches by matrix.language:
keep none for javascript-typescript and use autobuild or manual for go. Use the
existing actions/checkout and github/codeql-action/init steps as the anchors for
this per-language build-mode split.
| matrix: | ||
| language: ['javascript-typescript', 'go'] | ||
| steps: | ||
| - uses: actions/checkout@v5 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Missing persist-credentials: false on checkout (artipacked).
Static analysis flags credential persistence risk since the default checkout leaves the GitHub token in the local git config, which could be leaked via artifacts or subsequent steps.
🔒 Suggested fix
- - uses: actions/checkout@v5
+ - uses: actions/checkout@v5
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v5 | |
| - uses: actions/checkout@v5 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 25-25: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/codeql-analysis.yml at line 25, Add persist-credentials
set to false on the actions/checkout usage in the CodeQL workflow so the GitHub
token is not left in the local git config. Update the checkout step in the
workflow that uses actions/checkout@v5 to explicitly disable credential
persistence, keeping the change localized to that checkout configuration.
Source: Linters/SAST tools
| branches: [main] | ||
| paths: ['console/**'] | ||
| pull_request: | ||
| branches: [main, develop] | ||
| branches: [main] |
There was a problem hiding this comment.
🚀 Performance & Scalability | 🟡 Minor | ⚡ Quick win
Missing paths filter on pull_request trigger.
push is scoped to console/** but pull_request only has a branch filter, so every PR targeting main will trigger this workflow regardless of which files changed — inconsistent with the intent of the push filter and wastes CI minutes on unrelated PRs.
🔧 Proposed fix
pull_request:
branches: [main]
+ paths: ['console/**']📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| branches: [main] | |
| paths: ['console/**'] | |
| pull_request: | |
| branches: [main, develop] | |
| branches: [main] | |
| branches: [main] | |
| paths: ['console/**'] | |
| pull_request: | |
| branches: [main] | |
| paths: ['console/**'] |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/frontend-tests.yml around lines 5 - 8, Update the
frontend-tests workflow trigger so the `pull_request` block matches the same
file scoping as `push`. Add a `paths` filter for `console/**` under the
`pull_request` trigger in the workflow definition, keeping the existing
`branches: [main]` constraint so only PRs touching that area run the job.
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@v5 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Set persist-credentials: false on checkout.
Static analysis (zizmor) flags this checkout for credential persistence (artipacked). Since this job later uploads console/coverage/ as an artifact, disabling credential persistence is a safe hardening step.
🔒 Proposed fix
- - uses: actions/checkout@v5
+ - uses: actions/checkout@v5
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v5 | |
| - uses: actions/checkout@v5 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 19-19: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/frontend-tests.yml at line 19, The frontend-tests workflow
checkout step is persisting GitHub credentials unnecessarily. Update the
actions/checkout usage in the frontend-tests job to disable credential
persistence by setting persist-credentials to false on the checkout step. Keep
the change scoped to the checkout action used before the coverage artifact
upload.
Source: Linters/SAST tools
| run: | ||
| working-directory: worker | ||
| steps: | ||
| - uses: actions/checkout@v5 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Set persist-credentials: false on checkout steps.
Static analysis (zizmor) flags credential persistence via actions/checkout in all three jobs. Since the checked-out git credentials aren't needed beyond checkout here, disabling persistence reduces the blast radius if a later step is compromised.
🔒️ Proposed fix (apply to all three checkout steps)
- - uses: actions/checkout@v5
+ - uses: actions/checkout@v5
+ with:
+ persist-credentials: falseAlso applies to: 48-48, 65-65
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 27-27: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/worker-ci.yml at line 27, The three actions/checkout steps
in the workflow currently persist git credentials, which zizmor flags as
unnecessary exposure. Update each checkout invocation in the worker CI jobs to
set persist-credentials to false so the repository token is not retained after
checkout. Use the existing checkout steps in the workflow as the target
locations and apply the same change consistently to all three.
Source: Linters/SAST tools
| ### Local Test Equivalents | ||
|
|
||
| Some workflows can be tested faster by running the commands directly: | ||
|
|
||
| | CI Workflow | Local Command | | ||
| |---|---| | ||
| | `check-lint.yml` | `task lint` | | ||
| | `check-test.yml` | `task api:test` | | ||
| | `check-build.yml` | `task build` (requires Docker) | | ||
| | `frontend-tests.yml` | `cd console && npm run test:run` | | ||
| | `worker-ci.yml` | `task worker:lint && task worker:check` | |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check Taskfile for worker-related task names.
fd -i taskfile --exec cat {}Repository: oasm-platform/open-asm
Length of output: 8478
Align the worker-ci.yml local shortcut with the workflow jobs
task worker:lint && task worker:check misses the formatting step and doesn’t mirror the fmt/vet/build jobs. Update the row to include the matching task sequence, or rename the shortcut if it’s only meant to cover a subset.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@DEVELOPER_GUIDE.md` around lines 336 - 346, The `worker-ci.yml` entry in the
Local Test Equivalents table does not match the workflow’s actual jobs, because
`task worker:lint && task worker:check` omits formatting and only covers a
subset. Update the row to reference the same task sequence as the workflow’s
`fmt`/`vet`/`build` jobs, or explicitly rename the shortcut if it is intended to
represent only part of `worker-ci.yml`. Use the `worker-ci.yml` label and the
`Local Test Equivalents` table row to locate the change.
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/build-release.yml (2)
25-28: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueSet
persist-credentials: falseon checkout.With
fetch-depth: 0andcontents: writepermission, the defaultactions/checkoutbehavior persists theGITHUB_TOKENcredential on disk. If a later step in this or another job in the workflow uploads workspace contents as an artifact, the token could leak. zizmor flags this asartipacked.🔒️ Proposed fix
- name: Checkout code uses: actions/checkout@v5 with: fetch-depth: 0 + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-release.yml around lines 25 - 28, Update the Checkout code step that uses actions/checkout@v5 to disable credential persistence by setting persist-credentials to false. Keep the existing fetch-depth: 0 setting, and apply the change in the checkout configuration so the GITHUB_TOKEN is not written to disk during the workflow.Source: Linters/SAST tools
61-77: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider using
gh releasedirectly instead ofsoftprops/action-gh-release.zizmor's
superfluous-actionscheck notes thatghis preinstalled on GitHub runners, so release creation/upload can be done via a script step, reducing a third-party action dependency. Not required, purely optional.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-release.yml around lines 61 - 77, Replace the optional third-party release upload step with a direct GitHub CLI-based release command in the build-release workflow. Update the release job around Generate changelog and Upload to Release so it uses the preinstalled gh tool to create/update the tag release and upload worker/dist artifacts, while still reusing steps.changelog.outputs.changelog for the release notes. Keep the tag-only condition and remove the softprops/action-gh-release dependency from that workflow.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/build-release.yml:
- Around line 25-28: Update the Checkout code step that uses actions/checkout@v5
to disable credential persistence by setting persist-credentials to false. Keep
the existing fetch-depth: 0 setting, and apply the change in the checkout
configuration so the GITHUB_TOKEN is not written to disk during the workflow.
- Around line 61-77: Replace the optional third-party release upload step with a
direct GitHub CLI-based release command in the build-release workflow. Update
the release job around Generate changelog and Upload to Release so it uses the
preinstalled gh tool to create/update the tag release and upload worker/dist
artifacts, while still reusing steps.changelog.outputs.changelog for the release
notes. Keep the tag-only condition and remove the softprops/action-gh-release
dependency from that workflow.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 77a64211-92b6-4e50-b4be-b0d2bc223817
📒 Files selected for processing (2)
.github/changelog-config.json.github/workflows/build-release.yml
✅ Files skipped from review due to trivial changes (1)
- .github/changelog-config.json
1 participant
Summary by CodeRabbit
New Features
Bug Fixes
Documentation