fix(workflow): fix DCO check #3512
Conversation
WalkthroughThe pull request modifies the GitHub Actions workflow file for creating a pull request in the Longhorn repository. Two new steps are introduced to dynamically retrieve the head commit's author name and email. The "Create Pull Request" step is updated to use these dynamically obtained commit author details instead of hardcoded values, ensuring more accurate representation of the commit's authorship information. Changes
Assessment against linked issues
Possibly related PRs
Suggested reviewers
📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
🧰 Additional context used🪛 actionlint (1.7.4).github/workflows/create-crd-update-pr-in-longhorn-repo.yml42-42: workflow command "set-output" was deprecated. use (deprecated-commands) 46-46: workflow command "set-output" was deprecated. use (deprecated-commands) ⏰ Context from checks skipped due to timeout of 90000ms (2)
🔇 Additional comments (2)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/create-crd-update-pr-in-longhorn-repo.yml(2 hunks)
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/create-crd-update-pr-in-longhorn-repo.yml
42-42: workflow command "set-output" was deprecated. use echo "{name}={value}" >> $GITHUB_OUTPUT instead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions
(deprecated-commands)
46-46: workflow command "set-output" was deprecated. use echo "{name}={value}" >> $GITHUB_OUTPUT instead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions
(deprecated-commands)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: Build binaries
- GitHub Check: Summary
🔇 Additional comments (2)
.github/workflows/create-crd-update-pr-in-longhorn-repo.yml (2)
57-58: LGTM! The changes correctly implement the DCO requirements.The implementation properly uses the commit author's details for both
authorandcommitterfields, which aligns with the PR objective to fix the DCO check. The combination withsign-commits: trueandsignoff: trueensures proper commit signing.
Line range hint
3-7: Verify the security implications of using pull_request_target.The workflow uses
pull_request_targetwhich runs with repository secrets. While this is necessary for creating PRs with tokens, please ensure that:
- The workflow doesn't execute any code from the PR
- The CRDs and manifests are fetched from the master branch of longhorn-manager, not the PR branch
✅ Verification successful
The workflow's security implementation for pull_request_target is correct
The workflow follows security best practices:
- Only runs after PR is merged to master
- Fetches CRDs directly from the master branch of longhorn-manager
- Executes only trusted scripts from the base branch
- Uses PR content only for metadata (PR number, title)
- Properly scopes repository secrets for creating update PRs
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify that the workflow only uses trusted sources # Check if the workflow fetches content from trusted sources rg -l 'curl.*\$\{.*\}' .github/workflows/ rg -l 'wget.*\$\{.*\}' .github/workflows/ # Check if the workflow executes any potentially untrusted code rg -l 'eval.*\$\{.*\}' .github/workflows/ rg -l 'source.*\$\{.*\}' .github/workflows/Length of output: 177
Script:
#!/bin/bash # Get the complete workflow content cat .github/workflows/create-crd-update-pr-in-longhorn-repo.yml # Search for actions/checkout usage in the workflow rg "uses: actions/checkout@" .github/workflows/create-crd-update-pr-in-longhorn-repo.yml -A 5 # Search for any references to PR context or SHA rg "github\.(event|sha|ref)" .github/workflows/create-crd-update-pr-in-longhorn-repo.ymlLength of output: 3570
🧰 Tools
🪛 actionlint (1.7.4)
42-42: workflow command "set-output" was deprecated. use
echo "{name}={value}" >> $GITHUB_OUTPUTinstead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions(deprecated-commands)
46-46: workflow command "set-output" was deprecated. use
echo "{name}={value}" >> $GITHUB_OUTPUTinstead: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions(deprecated-commands)
| @@ -46,9 +54,8 @@ jobs: | |||
| delete-branch: true | |||
| sign-commits: true | |||
| signoff: true | |||
| author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com> | |||
| committer: Longhorn GitHub Bot <[email protected]> | |||
There was a problem hiding this comment.
Do we know why the bot account with sign is not valid for DCO check?
There was a problem hiding this comment.
I have no idea for now. Although I set the committer and author to Longhorn bot, the longhorn/longhorn PR will be created by the author of the longhorn/longhorn-manager PR rather than the Longhorn bot when triggering the workflow by pull_request_target. However, using the author of the longhorn/longhorn-manager PR might make sense.
Longhorn 10193 Signed-off-by: Derek Su <[email protected]>
derekbit
force-pushed
the
longhorn-10193
branch
from
947cd35 to
0427098
Compare
Which issue(s) this PR fixes:
Issue longhorn/longhorn#10193
What this PR does / why we need it:
Use head commit's author name and email as committer's information.
Special notes for your reviewer:
Additional documentation or context