Conversation
|
@NARSimoes: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it. DetailsI understand the commands that are listed here |
|
@NARSimoes: Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it. DetailsI understand the commands that are listed here |
📝 WalkthroughWalkthroughPinned GitHub Action versions were bumped across workflows and composite actions, and Anchore Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant GH as GitHub Actions Runner
participant Build as Docker Build (buildx)
participant Scan as Anchore Scan Action
participant Reg as Docker Registry
Dev->>GH: push / PR triggers workflow
GH->>Build: build temp images (amd64 / arm64 / e2e)
Build-->>GH: tag images (temp-${GITHUB_SHA}-{arch})
GH->>Scan: run anchore/scan-action on temp images
Scan-->>GH: return scan results (table, only-fixed, severity:critical)
GH->>Reg: push images (if build continues)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/actions/docker-build/action.yaml:
- Around line 10-17: The scan steps use untagged images
("mattermost/mattermost-cloud" and "mattermost/mattermost-cloud-e2e") and run
before the build output is tied to this run; update the anchore scan steps (the
steps named "cd/scan-docker-security" and the e2e scan step using
anchore/scan-action) to consume an explicit tag or digest produced by the build
(capture the image ID/tag from the build step output or via docker
inspect/docker build --tag and/or docker images --format or by saving and
reading the image digest) and pass that exact tag/digest into the scan action's
with.image parameter, and/or move the first scan to run after the image build
step so the scan targets the run-specific artifact rather than an
untagged/global name.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c32fea99-bdfc-4a48-bc0a-de3cfe3c1331
📒 Files selected for processing (6)
.github/actions/docker-build/action.yaml.github/actions/docker-prepare/action.yml.github/workflows/ci.yml.github/workflows/claude.yml.github/workflows/notify-release.yml.github/workflows/release.yml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release.yml:
- Line 29: The workflow uses a pinned SHA for docker/login-action ("uses:
docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1") that is
inconsistent with the other workflow; update that "uses:
docker/login-action@..." entry in the release.yml to the same version as CI
(e.g., docker/login-action@v4.0.0) so both workflows reference the identical
action version.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: cfa0c862-c568-459f-9493-f0ccc1be5a6d
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/release.yml
|
@esarafianou @andrleite I think the |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
45-61: The redundant security scans can be consolidated.Both the
:testand:$VERSIONtags reference identical Docker image layers (they're multi-platform manifests created from the same parallel AMD64/ARM64 build inbuild-image-parallel-with-tags). Scanning them separately produces duplicate vulnerability reports. Consider scanning only the versioned tag after build completion:- name: Build and push multi-platform images with clean tags run: make build-image-parallel-with-tags env: TAG: ${{ steps.version.outputs.VERSION }} DOCKER_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} DOCKER_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Scan docker security :test - uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2 - with: - image: "mattermost/mattermost-cloud:test" - output-format: table - only-fixed: true - fail-build: false - severity-cutoff: critical - name: Scan docker security :tag uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c # v7.3.2 with: image: "mattermost/mattermost-cloud:${{ steps.version.outputs.VERSION }}"The
fail-build: falsesetting is intentional (consistent across ci.yml) and provides visibility without blocking releases.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/release.yml around lines 45 - 61, The two Anchore scan steps ("Scan docker security :test" and "Scan docker security :tag") are redundant because they scan identical multi-platform manifests; remove the ":test" scan step and keep only the versioned-tag scan that uses image: "mattermost/mattermost-cloud:${{ steps.version.outputs.VERSION }}". Ensure the remaining step runs after the image build step (e.g., build-image-parallel-with-tags) so the versioned manifest is available, and preserve the existing Anchore inputs (output-format, only-fixed, fail-build, severity-cutoff).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/release.yml:
- Around line 45-61: The two Anchore scan steps ("Scan docker security :test"
and "Scan docker security :tag") are redundant because they scan identical
multi-platform manifests; remove the ":test" scan step and keep only the
versioned-tag scan that uses image: "mattermost/mattermost-cloud:${{
steps.version.outputs.VERSION }}". Ensure the remaining step runs after the
image build step (e.g., build-image-parallel-with-tags) so the versioned
manifest is available, and preserve the existing Anchore inputs (output-format,
only-fixed, fail-build, severity-cutoff).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: cc492c8a-a53c-421b-8a1b-942b23d87402
📒 Files selected for processing (1)
.github/workflows/release.yml
4 participants
Summary
Release Note
Summary by CodeRabbit
New Features
Chores