Fix CI workflow deprecations and streamline build process#543
Conversation
Fix deprecated CI warnings and streamline release workflow
|
|
WalkthroughThe release workflow replaces the OS matrix with dedicated Ubuntu, Windows, macOS arm64, and macOS Intel jobs. Each packages and publishes platform artifacts, while Ubuntu and macOS expose hashes directly to the Homebrew formula update job. ChangesRelease build pipeline
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Release
participant build-ubuntu
participant build-macos
participant update-formula
Release->>build-ubuntu: start Linux build and publish artifact
Release->>build-macos: start macOS build and publish artifact
build-ubuntu-->>update-formula: provide LINUX_BUILD_HASH
build-macos-->>update-formula: provide MAC_BUILD_HASH
update-formula->>update-formula: update formula when check-latest is true
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR refactors the release build GitHub Actions workflow to replace the prior matrix build with explicit per-platform build jobs, and to simplify downstream Homebrew formula updates by producing hashes directly in the build jobs.
Changes:
- Split the former matrix
buildjob into dedicated jobs for Ubuntu, Windows, macOS (ARM), and macOS (Intel), each producing its own zipped release asset. - Moved Linux/macOS SHA-256 calculation into the corresponding build jobs and exposed the values as job outputs for downstream consumers.
- Updated the Homebrew formula update job to depend on the new build-job outputs and removed the separate hash jobs.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Install dependancies (Linux) | ||
| if: matrix.os == 'ubuntu-latest' | ||
| run: | | ||
| sudo apt-get install -y binutils |
| LINUX_BUILD_HASH: ${{ steps.calc-hash.outputs.LINUX_BUILD_HASH }} | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v2 |
| runs-on: windows-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v2 |
| MAC_BUILD_HASH: ${{ steps.calc-hash.outputs.MAC_BUILD_HASH }} | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v2 |
| runs-on: macos-15-intel | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v2 |
| - name: Upload Release Asset | ||
| uses: actions/upload-release-asset@v1.0.2 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| with: | ||
| upload_url: ${{ github.event.release.upload_url }} | ||
| asset_path: ./krr-windows-latest-${{ github.ref_name }}.zip | ||
| asset_name: krr-windows-latest-${{ github.ref_name }}.zip | ||
| asset_content_type: application/octet-stream |
| - name: Upload Release Asset | ||
| uses: actions/upload-release-asset@v1.0.2 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| with: | ||
| upload_url: ${{ github.event.release.upload_url }} | ||
| asset_path: ./krr-macos-latest-${{ github.ref_name }}.zip | ||
| asset_name: krr-macos-latest-${{ github.ref_name }}.zip | ||
| asset_content_type: application/octet-stream |
| - name: Upload Release Asset | ||
| uses: actions/upload-release-asset@v1.0.2 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| with: |
| run: | | ||
| security delete-keychain $RUNNER_TEMP/app-signing.keychain-db | ||
| rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision |
| run: | | ||
| security delete-keychain $RUNNER_TEMP/app-signing.keychain-db | ||
| rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/build-on-release.yml (1)
129-176: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winUpgrade the macOS workflow actions
actions/checkout@v2andactions/setup-python@v2still rely on Node 12, which is no longer supported on GitHub-hosted runners. Bump both to current majors; if this job doesn’t need authenticated git access later, setpersist-credentials: falseon checkout too.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-on-release.yml around lines 129 - 176, Update the build-macos job’s checkout and Set up Python steps to current major versions, replacing actions/checkout@v2 and actions/setup-python@v2. Configure checkout with persist-credentials: false if the job does not require authenticated Git access after checkout.Source: Linters/SAST tools
🧹 Nitpick comments (4)
.github/workflows/build-on-release.yml (4)
8-9: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winNo explicit
permissions:block on the new build jobs.Static analysis flags default (overly-broad) permissions for
build-ubuntu,build-windows, andbuild-macos-intel. Since these jobs only need to upload release assets, consider scoping the token with an explicit least-privilegepermissions:block (e.g.,contents: write).Also applies to: 71-72, 223-224
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-on-release.yml around lines 8 - 9, Add an explicit least-privilege permissions block to the build-ubuntu, build-windows, and build-macos-intel jobs, granting only contents: write for release asset uploads.Source: Linters/SAST tools
217-221: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low valueCleanup step can fail if certificate install failed earlier.
if: always()correctly ensures cleanup runs on failure, butsecurity delete-keychainandrmwill themselves error (masking the real failure in logs) if the keychain/profile were never created (e.g., cert-install step failed early). Consider tolerating a missing keychain/profile.🛡️ Suggested fix
- name: Clean up keychain and provisioning profile if: always() run: | - security delete-keychain $RUNNER_TEMP/app-signing.keychain-db - rm ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision + security delete-keychain $RUNNER_TEMP/app-signing.keychain-db || true + rm -f ~/Library/MobileDevice/Provisioning\ Profiles/build_pp.mobileprovision🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-on-release.yml around lines 217 - 221, Update the “Clean up keychain and provisioning profile” step so cleanup tolerates absent artifacts: guard deletion of the keychain and provisioning profile or otherwise ignore missing-file errors, while preserving cleanup via if: always() and allowing the original certificate-install failure to remain visible.
305-309: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low valueSame cleanup-robustness gap as
build-macos.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-on-release.yml around lines 305 - 309, Update the “Clean up keychain and provisioning profile” step in the release workflow to tolerate missing cleanup targets, matching the cleanup behavior used by build-macos. Ensure deleting the keychain and provisioning profile does not fail the workflow when either resource is already absent.
52-59: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win
actions/upload-release-asset@v1.0.2is from an archived, unmaintained repository.GitHub has archived this action and recommends
softprops/action-gh-releaseas the replacement; it's also stuck on the deprecatednode12runtime.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/build-on-release.yml around lines 52 - 59, Replace the archived actions/upload-release-asset step with softprops/action-gh-release, preserving the existing release upload behavior and asset filename derived from github.ref_name. Update the action configuration to use the release event context and continue uploading the generated ZIP as an application/octet-stream asset.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build-on-release.yml:
- Around line 177-215: Replace direct `${{ github.ref_name }}` interpolation in
the macOS steps “Set version in code,” “Zip the application,” “Upload Release
Asset,” “Upload build as artifact,” and “Calculate hash” with a safely
initialized environment variable, then reference that variable in all shell
commands and action inputs.
- Around line 269-297: Update the macOS Intel workflow to pass github.ref_name
through an environment variable and reference that variable in the
version-setting, zip filename, and release asset fields instead of interpolating
it directly in run blocks. Replace the archived
actions/upload-release-asset@v1.0.2 step with the repository’s supported
release-upload action while preserving the existing asset path, name, and
content type.
- Around line 106-121: Update the Windows release packaging step around “Zip the
application” to avoid interpolating github.ref_name directly inside the
PowerShell run block; pass the ref name through the environment and use that
value for both Compress-Archive and Move-Item. Replace the archived “Upload
Release Asset” action with the repository’s supported release-upload mechanism
while preserving the existing asset path, name, and content type.
- Around line 31-69: Replace direct `${{ github.ref_name }}` interpolation in
the version-stamp, Zip the application, Upload Release Asset, Upload build as
artifact, and Calculate hash steps with an env-provided shell variable,
following the existing build-windows version-stamp pattern. Use that variable
consistently in the awk command, archive names, asset metadata, artifact path,
and sha256sum command.
- Around line 223-268: Update the build-macos-intel job’s checkout and Python
setup steps to use current supported action versions, and configure
actions/checkout to disable persisted credentials since this job does not
require repository write access.
- Around line 326-328: Update the update-formula job’s if condition to
explicitly compare needs.check-latest.outputs.IS_LATEST with the expected true
value, ensuring the job runs only when the output is actually true and remains
skipped for "false".
- Around line 71-97: Update the build-windows job’s actions/checkout and
actions/setup-python steps from deprecated v2 to current major versions, and
configure checkout with persist-credentials set to false since the job does not
push changes back to the repository.
---
Outside diff comments:
In @.github/workflows/build-on-release.yml:
- Around line 129-176: Update the build-macos job’s checkout and Set up Python
steps to current major versions, replacing actions/checkout@v2 and
actions/setup-python@v2. Configure checkout with persist-credentials: false if
the job does not require authenticated Git access after checkout.
---
Nitpick comments:
In @.github/workflows/build-on-release.yml:
- Around line 8-9: Add an explicit least-privilege permissions block to the
build-ubuntu, build-windows, and build-macos-intel jobs, granting only contents:
write for release asset uploads.
- Around line 217-221: Update the “Clean up keychain and provisioning profile”
step so cleanup tolerates absent artifacts: guard deletion of the keychain and
provisioning profile or otherwise ignore missing-file errors, while preserving
cleanup via if: always() and allowing the original certificate-install failure
to remain visible.
- Around line 305-309: Update the “Clean up keychain and provisioning profile”
step in the release workflow to tolerate missing cleanup targets, matching the
cleanup behavior used by build-macos. Ensure deleting the keychain and
provisioning profile does not fail the workflow when either resource is already
absent.
- Around line 52-59: Replace the archived actions/upload-release-asset step with
softprops/action-gh-release, preserving the existing release upload behavior and
asset filename derived from github.ref_name. Update the action configuration to
use the release event context and continue uploading the generated ZIP as an
application/octet-stream asset.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 80461bd0-d7b5-4f32-8d2c-b1bc4f56a9a7
📒 Files selected for processing (1)
.github/workflows/build-on-release.yml
| - name: Set version in code | ||
| run: | | ||
| awk 'NR==3{$0="__version__ = \"'${{ github.ref_name }}'\""}1' ./robusta_krr/__init__.py > temp && mv temp ./robusta_krr/__init__.py | ||
| cat ./robusta_krr/__init__.py | ||
|
|
||
| - name: Build with PyInstaller | ||
| shell: bash | ||
| run: | | ||
| pyinstaller krr.py | ||
| mkdir -p ./dist/krr/grapheme/data | ||
| cp $(python -c "import grapheme; print(grapheme.__path__[0] + '/data/grapheme_break_property.json')") ./dist/krr/grapheme/data/grapheme_break_property.json | ||
| cp ./intro.txt ./dist/krr/intro.txt | ||
|
|
||
| - name: Zip the application | ||
| run: | | ||
| cd dist | ||
| zip -r krr-ubuntu-latest-${{ github.ref_name }}.zip krr | ||
| mv krr-ubuntu-latest-${{ github.ref_name }}.zip ../ | ||
| cd .. | ||
|
|
||
| - name: Upload Release Asset | ||
| uses: actions/upload-release-asset@v1.0.2 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| with: | ||
| upload_url: ${{ github.event.release.upload_url }} | ||
| asset_path: ./krr-ubuntu-latest-${{ github.ref_name }}.zip | ||
| asset_name: krr-ubuntu-latest-${{ github.ref_name }}.zip | ||
| asset_content_type: application/octet-stream | ||
|
|
||
| - name: Upload build as artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: krr-ubuntu-latest-${{ github.ref_name }} | ||
| path: ./krr-ubuntu-latest-${{ github.ref_name }}.zip | ||
|
|
||
| - name: Calculate hash | ||
| id: calc-hash | ||
| run: echo "LINUX_BUILD_HASH=$(sha256sum krr-ubuntu-latest-${{ github.ref_name }}.zip | awk '{print $1}')" >> $GITHUB_OUTPUT |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
github.ref_name interpolated directly into shell scripts.
The version-stamp awk command (Line 33), zip/mv commands (Lines 47-48), and hash calculation (Line 69) all expand ${{ github.ref_name }} directly inside run: blocks. Since ref_name comes from the triggering ref/tag, this is a template/command-injection vector flagged by zizmor. The safer pattern (used later in build-windows's version-stamp step) is to pass the value via env: and reference the shell variable instead.
🔒 Example fix pattern
- name: Set version in code
+ env:
+ REF_NAME: ${{ github.ref_name }}
run: |
- awk 'NR==3{$0="__version__ = \"'${{ github.ref_name }}'\""}1' ./robusta_krr/__init__.py > temp && mv temp ./robusta_krr/__init__.py
+ awk 'NR==3{$0="__version__ = \"'"$REF_NAME"'\""}1' ./robusta_krr/__init__.py > temp && mv temp ./robusta_krr/__init__.py
cat ./robusta_krr/__init__.pyApply the same env:-based pattern to the zip and hash-calc steps.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 8-69: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[error] 33-33: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 47-47: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 48-48: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 69-69: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 52-52: action or reusable workflow from archived repository (archived-uses): repository is archived
(archived-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-on-release.yml around lines 31 - 69, Replace direct
`${{ github.ref_name }}` interpolation in the version-stamp, Zip the
application, Upload Release Asset, Upload build as artifact, and Calculate hash
steps with an env-provided shell variable, following the existing build-windows
version-stamp pattern. Use that variable consistently in the awk command,
archive names, asset metadata, artifact path, and sha256sum command.
Source: Linters/SAST tools
| build-windows: | ||
| runs-on: windows-latest | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v2 | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v2 | ||
| with: | ||
| python-version: '3.11' | ||
|
|
||
| - name: Install dependencies | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| pip install -r requirements.txt | ||
| pip install pyinstaller | ||
|
|
||
| - name: Set version in code | ||
| run: | | ||
| $content = Get-Content -Path .\robusta_krr\__init__.py | ||
| $content[2] = "__version__=`"$($env:GITHUB_REF_NAME)`"" | ||
| $content | Out-File -FilePath .\robusta_krr\__init__.py -Encoding ascii | ||
| Get-Content .\robusta_krr\__init__.py | ||
| shell: pwsh | ||
| env: | ||
| GITHUB_REF_NAME: ${{ github.ref_name }} | ||
|
|
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
sed -n '1,140p' .github/workflows/build-on-release.ymlRepository: robusta-dev/krr
Length of output: 4568
🏁 Script executed:
rg -n "actions/checkout@v2|actions/setup-python@v2|GITHUB_REF_NAME|persist-credentials" .github/workflows/build-on-release.ymlRepository: robusta-dev/krr
Length of output: 609
🌐 Web query:
actions/checkout v2 node12 deprecation setup-python v2 node12 actionlint
💡 Result:
The use of Node.js 12 in GitHub Actions has been fully deprecated and removed from GitHub-hosted runners [1]. GitHub officially removed Node.js 12 from the Actions runner on August 14, 2023 [1]. Before this removal, GitHub migrated actions to Node.js 16 to ensure compatibility, and warned users to update their workflows [1]. Consequently, actions like actions/checkout@v2 and actions/setup-python@v2, which were originally built on Node.js 12, are considered outdated and should be updated to their newer versions (e.g., v4 or later) to avoid runtime issues and deprecation warnings [2][3][4]. To manage these dependencies, the static analysis tool actionlint includes a specific check for outdated actions [5][6]. It flags the use of popular actions that still rely on unsupported runtimes like Node.js 12 [5][6]. Specifically, actionlint reports an error if it detects usage such as actions/checkout@v2 because of its outdated runtime [5][6]. To resolve these issues, you should: 1. Update your GitHub Actions workflow files to use the latest major versions of all actions [3][4]. 2. Run actionlint in your local development environment or CI pipeline to identify and catch other instances of outdated actions or syntax errors [5][6].
Citations:
- 1: https://github.blog/changelog/2023-07-16-github-actions-removal-of-node12-from-the-actions-runner/
- 2: Update GitHub actions checkout and setup-python aboutcode-org/skeleton#75
- 3: https://stackoverflow.com/questions/77461767/github-action-issues
- 4: https://stackoverflow.com/questions/75638211/nodejs-12-alarm-in-github-workflow-and-unexpected-inputs-username-password
- 5: https://github.com/rhysd/actionlint/blob/main/CHANGELOG.md
- 6: https://github.com/rhysd/actionlint/releases/tag/v1.7.0
🏁 Script executed:
sed -n '140,420p' .github/workflows/build-on-release.ymlRepository: robusta-dev/krr
Length of output: 8901
Upgrade the Windows job off the deprecated v2 actions. actions/checkout@v2 and actions/setup-python@v2 are still pinned here; move them to current majors so this job doesn’t depend on the removed node12 runtime. If this job never pushes back to the repo, set persist-credentials: false on checkout too.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 75-75: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
[error] 78-78: the runner of "actions/setup-python@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 zizmor (1.26.1)
[warning] 75-75: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 71-127: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-on-release.yml around lines 71 - 97, Update the
build-windows job’s actions/checkout and actions/setup-python steps from
deprecated v2 to current major versions, and configure checkout with
persist-credentials set to false since the job does not push changes back to the
repository.
Source: Linters/SAST tools
| - name: Zip the application | ||
| run: | | ||
| Set-Location -Path dist | ||
| Compress-Archive -Path krr -DestinationPath krr-windows-latest-${{ github.ref_name }}.zip -Force | ||
| Move-Item -Path krr-windows-latest-${{ github.ref_name }}.zip -Destination ..\ | ||
| Set-Location -Path .. | ||
|
|
||
| - name: Upload Release Asset | ||
| uses: actions/upload-release-asset@v1.0.2 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| with: | ||
| upload_url: ${{ github.event.release.upload_url }} | ||
| asset_path: ./krr-windows-latest-${{ github.ref_name }}.zip | ||
| asset_name: krr-windows-latest-${{ github.ref_name }}.zip | ||
| asset_content_type: application/octet-stream |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Same template-injection and archived-action findings apply here.
Lines 109-110 expand ${{ github.ref_name }} directly in the Compress-Archive/Move-Item run block (same class of issue as the Ubuntu job); Line 114 uses the archived actions/upload-release-asset@v1.0.2.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 109-109: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 110-110: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 114-114: action or reusable workflow from archived repository (archived-uses): repository is archived
(archived-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-on-release.yml around lines 106 - 121, Update the
Windows release packaging step around “Zip the application” to avoid
interpolating github.ref_name directly inside the PowerShell run block; pass the
ref name through the environment and use that value for both Compress-Archive
and Move-Item. Replace the archived “Upload Release Asset” action with the
repository’s supported release-upload mechanism while preserving the existing
asset path, name, and content type.
Source: Linters/SAST tools
| - name: Set version in code | ||
| run: | | ||
| awk 'NR==3{$0="__version__ = \"'${{ github.ref_name }}'\""}1' ./robusta_krr/__init__.py > temp && mv temp ./robusta_krr/__init__.py | ||
| cat ./robusta_krr/__init__.py | ||
|
|
||
| - name: Set version in code (Windows) | ||
| if: matrix.os == 'windows-latest' | ||
| run: | | ||
| $content = Get-Content -Path .\robusta_krr\__init__.py | ||
| $content[2] = "__version__=`"$($env:GITHUB_REF_NAME)`"" | ||
| $content | Out-File -FilePath .\robusta_krr\__init__.py -Encoding ascii | ||
| Get-Content .\robusta_krr\__init__.py | ||
| shell: pwsh | ||
| env: | ||
| GITHUB_REF_NAME: ${{ github.ref_name }} | ||
|
|
||
| - name: Build with PyInstaller | ||
| if: matrix.os == 'macos-latest' | ||
| shell: bash | ||
| run: | | ||
| pyinstaller --target-architecture arm64 krr.py | ||
| mkdir -p ./dist/krr/grapheme/data | ||
| cp $(python -c "import grapheme; print(grapheme.__path__[0] + '/data/grapheme_break_property.json')") ./dist/krr/grapheme/data/grapheme_break_property.json | ||
| cp ./intro.txt ./dist/krr/intro.txt | ||
|
|
||
| - name: Zip the application | ||
| run: | | ||
| cd dist | ||
| zip -r krr-macos-latest-${{ github.ref_name }}.zip krr | ||
| mv krr-macos-latest-${{ github.ref_name }}.zip ../ | ||
| cd .. | ||
|
|
||
| - name: Upload Release Asset | ||
| uses: actions/upload-release-asset@v1.0.2 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| with: | ||
| upload_url: ${{ github.event.release.upload_url }} | ||
| asset_path: ./krr-macos-latest-${{ github.ref_name }}.zip | ||
| asset_name: krr-macos-latest-${{ github.ref_name }}.zip | ||
| asset_content_type: application/octet-stream | ||
|
|
||
| - name: Upload build as artifact | ||
| uses: actions/upload-artifact@v4 | ||
| with: | ||
| name: krr-macos-latest-${{ github.ref_name }} | ||
| path: ./krr-macos-latest-${{ github.ref_name }}.zip | ||
|
|
||
| - name: Calculate hash | ||
| id: calc-hash | ||
| run: echo "MAC_BUILD_HASH=$(shasum -a 256 krr-macos-latest-${{ github.ref_name }}.zip | awk '{print $1}')" >> $GITHUB_OUTPUT |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Template injection repeats in the macOS build/zip/hash steps.
Lines 179, 193-194, and 215 expand ${{ github.ref_name }} directly inside run: blocks, the same anti-pattern flagged in the Ubuntu and Windows jobs.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 179-179: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 193-193: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 194-194: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 215-215: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 198-198: action or reusable workflow from archived repository (archived-uses): repository is archived
(archived-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-on-release.yml around lines 177 - 215, Replace
direct `${{ github.ref_name }}` interpolation in the macOS steps “Set version in
code,” “Zip the application,” “Upload Release Asset,” “Upload build as
artifact,” and “Calculate hash” with a safely initialized environment variable,
then reference that variable in all shell commands and action inputs.
Source: Linters/SAST tools
| build-macos-intel: | ||
| runs-on: macos-15-intel | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v2 | ||
|
|
||
| - name: Set up Python | ||
| uses: actions/setup-python@v2 | ||
| with: | ||
| python-version: '3.11' | ||
|
|
||
| - name: Install dependencies | ||
| run: | | ||
| python -m pip install --upgrade pip | ||
| pip install -r requirements.txt | ||
| pip install pyinstaller | ||
|
|
||
| - name: Install the Apple certificate and provisioning profile | ||
| env: | ||
| BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }} | ||
| P12_PASSWORD: ${{ secrets.P12_PASSWORD }} | ||
| BUILD_PROVISION_PROFILE_BASE64: ${{ secrets.BUILD_PROVISION_PROFILE_BASE64 }} | ||
| KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }} | ||
| run: | | ||
| # create variables | ||
| CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12 | ||
| PP_PATH=$RUNNER_TEMP/build_pp.mobileprovision | ||
| KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db | ||
|
|
||
| # import certificate and provisioning profile from secrets | ||
| echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH | ||
| echo -n "$BUILD_PROVISION_PROFILE_BASE64" | base64 --decode -o $PP_PATH | ||
|
|
||
| # create temporary keychain | ||
| security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | ||
| security set-keychain-settings -lut 21600 $KEYCHAIN_PATH | ||
| security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH | ||
|
|
||
| # import certificate to keychain | ||
| security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH | ||
| security list-keychain -d user -s $KEYCHAIN_PATH | ||
|
|
||
| # apply provisioning profile | ||
| mkdir -p ~/Library/MobileDevice/Provisioning\ Profiles | ||
| cp $PP_PATH ~/Library/MobileDevice/Provisioning\ Profiles | ||
|
|
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Outdated GitHub Actions and checkout credential persistence
actions/checkout@v2 and actions/setup-python@v2 are still pinned here, and checkout should disable credential persistence if the job doesn’t need repo write access.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 227-227: the runner of "actions/checkout@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
[error] 230-230: the runner of "actions/setup-python@v2" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 zizmor (1.26.1)
[warning] 227-227: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 223-309: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-on-release.yml around lines 223 - 268, Update the
build-macos-intel job’s checkout and Python setup steps to use current supported
action versions, and configure actions/checkout to disable persisted credentials
since this job does not require repository write access.
| - name: Set version in code | ||
| run: | | ||
| awk 'NR==3{$0="__version__ = \"'${{ github.ref_name }}'\""}1' ./robusta_krr/__init__.py > temp && mv temp ./robusta_krr/__init__.py | ||
| cat ./robusta_krr/__init__.py | ||
|
|
||
| - name: Build with PyInstaller | ||
| if: matrix.os != 'macos-latest' | ||
| shell: bash | ||
| run: | | ||
| pyinstaller krr.py | ||
| mkdir -p ./dist/krr/grapheme/data | ||
| cp $(python -c "import grapheme; print(grapheme.__path__[0] + '/data/grapheme_break_property.json')") ./dist/krr/grapheme/data/grapheme_break_property.json | ||
| cp ./intro.txt ./dist/krr/intro.txt | ||
|
|
||
| - name: Zip the application (Unix) | ||
| if: matrix.os == 'macos-latest' || matrix.os == 'ubuntu-latest' || matrix.os == 'macos-13' | ||
| - name: Zip the application | ||
| run: | | ||
| cd dist | ||
| zip -r krr-${{ matrix.os }}-${{ github.ref_name }}.zip krr | ||
| mv krr-${{ matrix.os }}-${{ github.ref_name }}.zip ../ | ||
| zip -r krr-macos-15-intel-${{ github.ref_name }}.zip krr | ||
| mv krr-macos-15-intel-${{ github.ref_name }}.zip ../ | ||
| cd .. | ||
|
|
||
| - name: Zip the application (Windows) | ||
| if: matrix.os == 'windows-latest' | ||
| run: | | ||
| Set-Location -Path dist | ||
| Compress-Archive -Path krr -DestinationPath krr-${{ matrix.os }}-${{ github.ref_name }}.zip -Force | ||
| Move-Item -Path krr-${{ matrix.os }}-${{ github.ref_name }}.zip -Destination ..\ | ||
| Set-Location -Path .. | ||
|
|
||
| - name: Upload Release Asset | ||
| uses: actions/upload-release-asset@v1.0.2 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| with: | ||
| upload_url: ${{ github.event.release.upload_url }} | ||
| asset_path: ./krr-${{ matrix.os }}-${{ github.ref_name }}.zip | ||
| asset_name: krr-${{ matrix.os }}-${{ github.ref_name }}.zip | ||
| upload_url: ${{ github.event.release.upload_url }} | ||
| asset_path: ./krr-macos-15-intel-${{ github.ref_name }}.zip | ||
| asset_name: krr-macos-15-intel-${{ github.ref_name }}.zip | ||
| asset_content_type: application/octet-stream |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Same template-injection and archived-action findings in build-macos-intel.
Lines 271, 285-286 expand ${{ github.ref_name }} directly in run: blocks; Line 290 uses the archived actions/upload-release-asset@v1.0.2.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 271-271: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 285-285: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 286-286: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[warning] 290-290: action or reusable workflow from archived repository (archived-uses): repository is archived
(archived-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-on-release.yml around lines 269 - 297, Update the
macOS Intel workflow to pass github.ref_name through an environment variable and
reference that variable in the version-setting, zip filename, and release asset
fields instead of interpolating it directly in run blocks. Replace the archived
actions/upload-release-asset@v1.0.2 step with the repository’s supported
release-upload action while preserving the existing asset path, name, and
content type.
Source: Linters/SAST tools
| needs: [check-latest, build-macos, build-ubuntu] | ||
| runs-on: ubuntu-latest | ||
| if: needs.check-latest.outputs.IS_LATEST |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Are GitHub Actions job outputs always strings, and how does if: evaluate a bare string like "false"?
💡 Result:
In GitHub Actions, job outputs are always stored and retrieved as strings [1][2]. Even if you set an output to a boolean or numeric value, it is serialized into its string representation (e.g., the boolean false becomes the string "false") when written to the GITHUB_OUTPUT environment file or accessed via the job outputs context [1]. Regarding your second question, how an if conditional evaluates a bare string like "false": In GitHub Actions, the if conditional is a special context where values are evaluated as expressions. When the runtime evaluates an if condition, it applies specific coercion rules to determine truthiness: 1. Truthy/Falsy Evaluation: Within an if conditional, GitHub Actions coerces values to booleans [3][4]. Falsy values are defined as false, 0, -0, "" (empty string), '', and null [3][4]. 2. String Interpretation: Because the string "false" is a non-empty string, it is considered truthy [3][4][5]. Therefore, if: false (as a boolean literal) evaluates to false, but if: "false" (as a string literal) evaluates to true [3][4][5]. To safely handle boolean outputs from previous jobs, you should convert the string back into a boolean within the expression using the fromJSON function [3][4]. For example, instead of using if: ${{ needs.job1.outputs.my_output }}, which would evaluate the string "false" as true, you should use: if: ${{ fromJSON(needs.job1.outputs.my_output) }} This converts the string "false" into the boolean false, allowing the condition to be evaluated as expected [3][4].
Citations:
- 1: https://levelup.gitconnected.com/github-actions-almost-everything-you-need-to-know-about-outputs-4c6ddeee36d5
- 2: https://dev.to/cicube/how-to-pass-information-between-jobs-in-github-actions-4n9e
- 3: https://docs.github.com/en/enterprise-cloud@latest/actions/reference/workflows-and-actions/expressions
- 4: https://docs.github.com/actions/reference/evaluate-expressions-in-workflows-and-actions
- 5: https://stackoverflow.com/questions/68928595/strange-boolean-evaluation-in-github-actions
🏁 Script executed:
git ls-files .github/workflows/build-on-release.yml && wc -l .github/workflows/build-on-release.yml && sed -n '300,340p' .github/workflows/build-on-release.ymlRepository: robusta-dev/krr
Length of output: 1902
Gate update-formula on an explicit boolean check
needs.check-latest.outputs.IS_LATEST is a string, so this bare if: treats "false" as truthy and still runs update-formula on non-latest releases. That can overwrite the Homebrew formula with stale hashes/URLs.
Suggested fix
update-formula:
needs: [check-latest, build-macos, build-ubuntu]
runs-on: ubuntu-latest
- if: needs.check-latest.outputs.IS_LATEST
+ if: needs.check-latest.outputs.IS_LATEST == 'true'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| needs: [check-latest, build-macos, build-ubuntu] | |
| runs-on: ubuntu-latest | |
| if: needs.check-latest.outputs.IS_LATEST | |
| needs: [check-latest, build-macos, build-ubuntu] | |
| runs-on: ubuntu-latest | |
| if: needs.check-latest.outputs.IS_LATEST == 'true' |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/build-on-release.yml around lines 326 - 328, Update the
update-formula job’s if condition to explicitly compare
needs.check-latest.outputs.IS_LATEST with the expected true value, ensuring the
job runs only when the output is actually true and remains skipped for "false".
This pull request refactors the GitHub Actions release build workflow to improve maintainability and reliability. The main change is splitting the previous matrix-based build job into dedicated jobs for each platform (Ubuntu, Windows, macOS ARM, and macOS Intel), and streamlining the build, versioning, artifact upload, and hash calculation steps for each. The workflow also removes redundant hash calculation jobs and updates downstream jobs to use the new outputs.
Workflow refactoring and platform-specific build jobs:
buildjob with separate jobs:build-ubuntu,build-windows,build-macos(ARM), andbuild-macos-intel, each with tailored steps for setting up Python, installing dependencies, building with PyInstaller, versioning, zipping, and uploading artifacts and release assets. [1] [2] [3]mac-hashandlinux-hashjobs, and updates theupdate-formulajob to depend directly on the new build jobs and consume their outputs for hash values. [1] [2]Versioning and artifact handling improvements:
robusta_krr/__init__.pyfor each platform, ensuring the release tag is embedded in the build. [1] [2]Homebrew formula update:
update-formulajob to use the new hash outputs from the build jobs, and only runs when the current release is the latest. [1] [2]These changes make the workflow more robust, easier to maintain, and better aligned with platform-specific requirements.