Infra: Bump actions to migrate to node22#1835
Open
Haarolean wants to merge 5 commits into
Open
Conversation
Haarolean
added
scope/infra
kapybro
Bot
added
status/triage
|
ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (6)
🚧 Files skipped from review as they are similar to previous changes (5)
📝 WalkthroughWalkthroughThis PR repins GitHub Actions across CI workflows: checkout/setup-java/setup-node, dorny/paths-filter, AWS/ECR, artifact, and cache actions were updated to newer commit SHAs; workflow logic and commands were not changed. ChangesGitHub Actions Version Pinning
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release.yml (1)
18-22:⚠️ Potential issue | 🟠 Major | ⚡ Quick winUse a release-safe checkout ref instead of PR-only context.
github.event.pull_request.head.shais unavailable forreleaseevents, so checkout will target the wrong revision when publishing (likely the default branch instead of the tagged commit).Proposed fix
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # https://github.com/actions/checkout/releases/tag/v4.2.2 with: fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ github.sha }} token: ${{ github.token }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yml around lines 18 - 22, The checkout step uses actions/checkout with ref: ${{ github.event.pull_request.head.sha }}, which is only set for PR events and fails for release events; change the ref expression to a release-safe value such as ${{ github.ref }} (or ${{ github.sha }} if you need the commit SHA) in the actions/checkout invocation and keep fetch-depth: 0 and token unchanged so the workflow checks out the correct tagged commit for release events.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/cve_checks.yml:
- Line 21: Update the pinned commit for the actions/cache step: replace the
incorrect SHA `d4323d4df104b026a6aa633fdb11d772146be0bf` used with `uses:
actions/cache@v4.3.0` with the correct SHA
`0057852bfaa89a56745cba8c7296529d2fc39830` so the pinned commit matches the
v4.3.0 tag.
In @.github/workflows/docker_build.yml:
- Around line 21-24: The checkout step currently uses
github.event.pull_request.head.sha which is unreliable for reusable workflows;
update the checkout invocation to use the workflow input (e.g., inputs.sha)
instead and ensure the calling reusable workflow/workflow_call defines and
passes a sha input; specifically change the ref passed to the actions/checkout
step to use inputs.sha and verify the workflow_call input name matches (e.g.,
"sha") so deterministic image builds are used.
In @.github/workflows/e2e-playwright-run.yml:
- Around line 60-63: The workflow still pins the Node runtime to 18; update the
actions/setup-node step by changing the node-version field from 18 to "22.12.0"
(i.e., modify the node-version key in the setup-node step) so this workflow
matches the repository's Node 22 migration; no other changes are required unless
CI cache behavior needs verifying after the version bump.
In @.github/workflows/separate_env_public_create.yml:
- Around line 18-21: The checkout step currently sets ref: ${{
github.event.pull_request.head.sha }} which is undefined for workflow_dispatch;
update the actions/checkout step (the lines containing actions/checkout and ref:
${{ github.event.pull_request.head.sha }}) to use a valid ref for manual runs —
e.g., replace that ref with ${{ github.sha }} or remove the explicit ref so
checkout defaults to the workflow run commit, and ensure any callers expecting a
PR SHA are adjusted accordingly.
---
Outside diff comments:
In @.github/workflows/release.yml:
- Around line 18-22: The checkout step uses actions/checkout with ref: ${{
github.event.pull_request.head.sha }}, which is only set for PR events and fails
for release events; change the ref expression to a release-safe value such as
${{ github.ref }} (or ${{ github.sha }} if you need the commit SHA) in the
actions/checkout invocation and keep fetch-depth: 0 and token unchanged so the
workflow checks out the correct tagged commit for release events.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: fd890a10-7d8f-4096-9194-a303b82e832c
📒 Files selected for processing (19)
.github/workflows/backend_pr.yml.github/workflows/backend_tests.yml.github/workflows/branch-deploy.yml.github/workflows/branch-remove.yml.github/workflows/build-public-image.yml.github/workflows/codeql-analysis.yml.github/workflows/cve_checks.yml.github/workflows/delete-public-image.yml.github/workflows/docker_build.yml.github/workflows/docker_publish.yml.github/workflows/e2e-playwright-run.yml.github/workflows/frontend_pr.yml.github/workflows/frontend_tests.yml.github/workflows/main.yml.github/workflows/md-links.yml.github/workflows/release-serde-api.yml.github/workflows/release.yml.github/workflows/separate_env_public_create.yml.github/workflows/workflow_linter.yml
Comment on lines
+21
to
24
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # https://github.com/actions/checkout/releases/tag/v4.2.2 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| token: ${{ github.token }} |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify reusable workflows consume declared sha input in checkout ref
rg -n -C3 'workflow_call:|inputs:|sha:' .github/workflows/docker_build.yml
rg -n -C2 'uses:\s*actions/checkout@|ref:\s*\${{\s*github\.event\.pull_request\.head\.sha\s*}}|ref:\s*\${{\s*inputs\.sha\s*}}' .github/workflows/docker_build.ymlRepository: kafbat/kafka-ui
Length of output: 453
🏁 Script executed:
cat -n .github/workflows/docker_build.yml | head -30Repository: kafbat/kafka-ui
Length of output: 1059
Checkout ignores reusable-workflow input SHA and uses invalid PR context.
In workflow_call, github.event.pull_request.head.sha is not reliable; use inputs.sha to guarantee deterministic image builds.
Proposed fix
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # https://github.com/actions/checkout/releases/tag/v4.2.2
with:
- ref: ${{ github.event.pull_request.head.sha }}
+ ref: ${{ inputs.sha }}
token: ${{ github.token }}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # https://github.com/actions/checkout/releases/tag/v4.2.2 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| token: ${{ github.token }} | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # https://github.com/actions/checkout/releases/tag/v4.2.2 | |
| with: | |
| ref: ${{ inputs.sha }} | |
| token: ${{ github.token }} |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/docker_build.yml around lines 21 - 24, The checkout step
currently uses github.event.pull_request.head.sha which is unreliable for
reusable workflows; update the checkout invocation to use the workflow input
(e.g., inputs.sha) instead and ensure the calling reusable
workflow/workflow_call defines and passes a sha input; specifically change the
ref passed to the actions/checkout step to use inputs.sha and verify the
workflow_call input name matches (e.g., "sha") so deterministic image builds are
used.
Comment on lines
+18
to
21
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # https://github.com/actions/checkout/releases/tag/v4.2.2 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| token: ${{ github.token }} |
There was a problem hiding this comment.
Checkout ref uses pull_request context in a workflow_dispatch workflow.
github.event.pull_request.head.sha is not defined for manual dispatch, so this ref is wrong for this workflow.
Suggested fix
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # https://github.com/actions/checkout/releases/tag/v4.2.2
with:
- ref: ${{ github.event.pull_request.head.sha }}
+ ref: ${{ github.sha }}
token: ${{ github.token }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/separate_env_public_create.yml around lines 18 - 21, The
checkout step currently sets ref: ${{ github.event.pull_request.head.sha }}
which is undefined for workflow_dispatch; update the actions/checkout step (the
lines containing actions/checkout and ref: ${{
github.event.pull_request.head.sha }}) to use a valid ref for manual runs —
e.g., replace that ref with ${{ github.sha }} or remove the explicit ref so
checkout defaults to the workflow run commit, and ensure any callers expecting a
PR SHA are adjusted accordingly.
Member
Author
There was a problem hiding this comment.
@coderabbitai this and the other one aren't introduced in this branch — raise an issue for them
There was a problem hiding this comment.
🧩 Analysis chain
Let me first fetch the other review comment from this PR to identify the second issue.
🏁 Script executed:
#!/bin/bash
gh pr view 1835 --repo kafbat/kafka-ui --json reviews,comments
gh api repos/kafbat/kafka-ui/pulls/1835/comments --jq '.[] | {id: .id, path: .path, body: .body, line: .line}'
Length of output: 45082
I found the two issues. Let me create GitHub issues for both now.
🏁 Script executed:
#!/bin/bash
# Issue 1: separate_env_public_create.yml - invalid ref for workflow_dispatch
gh issue create \
--repo kafbat/kafka-ui \
--title "Bug: separate_env_public_create.yml uses pull_request context ref in workflow_dispatch" \
--body "## Summary
The checkout step in \`.github/workflows/separate_env_public_create.yml\` sets \`ref: \${{ github.event.pull_request.head.sha }}\`, which is undefined for \`workflow_dispatch\` events. This means the workflow will check out the wrong (or default) revision when triggered manually.
## Details
**File:** \`.github/workflows/separate_env_public_create.yml\`
**Lines:** ~18–21
The checkout step currently uses:
\`\`\`yaml
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
ref: \${{ github.event.pull_request.head.sha }}
token: \${{ github.token }}
\`\`\`
\`github.event.pull_request.head.sha\` is only populated for \`pull_request\` events. For \`workflow_dispatch\`, this expression evaluates to an empty string, causing checkout to fall back to the default branch rather than the intended commit.
## Suggested Fix
\`\`\`yaml
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
ref: \${{ github.sha }}
token: \${{ github.token }}
\`\`\`
## References
- Identified in PR `#1835` (comment: https://github.com/kafbat/kafka-ui/pull/1835#discussion_r3201978484)
- Reported by `@Haarolean`" \
--assignee Haarolean
echo "---"
# Issue 2: release.yml - invalid ref for release events
gh issue create \
--repo kafbat/kafka-ui \
--title "Bug: release.yml uses pull_request context ref in release workflow" \
--body "## Summary
The checkout step in \`.github/workflows/release.yml\` sets \`ref: \${{ github.event.pull_request.head.sha }}\`, which is undefined for \`release\` events. This means the workflow will check out the wrong revision when publishing a release.
## Details
**File:** \`.github/workflows/release.yml\`
**Lines:** ~18–22
The checkout step currently uses:
\`\`\`yaml
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: 0
ref: \${{ github.event.pull_request.head.sha }}
token: \${{ github.token }}
\`\`\`
\`github.event.pull_request.head.sha\` is only populated for \`pull_request\` events. For \`release\` events, this expression evaluates to an empty string, causing the checkout to fall back to the default branch rather than the tagged release commit.
## Suggested Fix
\`\`\`yaml
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
fetch-depth: 0
ref: \${{ github.sha }}
token: \${{ github.token }}
\`\`\`
## References
- Identified in PR `#1835` (review: https://github.com/kafbat/kafka-ui/pull/1835)
- Reported by `@Haarolean`" \
--assignee Haarolean
Length of output: 98
@Haarolean Done! Two issues have been created and assigned to you:
- Bug: separate_env_public_create.yml uses pull_request context ref in workflow_dispatch #1838 — Bug:
separate_env_public_create.ymluses pull_request context ref in workflow_dispatch - Bug: release.yml uses pull_request context ref in release workflow #1839 — Bug:
release.ymluses pull_request context ref in release workflow
This was referenced May 7, 2026
Member
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes did you make? (Give an overview)
Is there anything you'd like reviewers to focus on?
How Has This Been Tested? (put an "x" (case-sensitive!) next to an item)
Checklist (put an "x" (case-sensitive!) next to all the items, otherwise the build will fail)
Check out Contributing and Code of Conduct
A picture of a cute animal (not mandatory but encouraged)
Summary by CodeRabbit