ci: Add GitHub action linting workflow #749
Conversation
Co-Authored-By: AJ Steers <[email protected]>
Original prompt from AJ Steers |
🤖 Devin AI EngineerI'll be helping with this pull request! Here's what you should know: ✅ I will automatically:
Note: I can only respond to comments from users who have write access to this repository. ⚙️ Control Options:
|
There was a problem hiding this comment.
Pull Request Overview
This PR adds a GitHub Actions workflow to automatically lint GitHub Actions workflow files using actionlint with reviewdog integration. The workflow provides automated feedback on workflow quality issues directly through PR review comments when .github/workflows/** files are modified.
- Implements conditional triggering to run only when workflow files change
- Integrates reviewdog for PR-level feedback instead of just CI logs
- Focuses on error-level issues to minimize noise
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
👋 Greetings, Airbyte Team Member!Here are some helpful tips and reminders for your convenience. Testing This CDK VersionYou can test this version of the CDK using the following: # Run the CLI from this branch:
uvx 'git+https://github.com/airbytehq/airbyte-python-cdk.git@devin/1757017385-add-actionlint-workflow#egg=airbyte-python-cdk[dev]' --help
# Update a connector to use the CDK from this branch ref:
cd airbyte-integrations/connectors/source-example
poe use-cdk-branch devin/1757017385-add-actionlint-workflowHelpful ResourcesPR Slash CommandsAirbyte Maintainers can execute the following slash commands on your PR:
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
Warning Rate limit exceeded@devin-ai-integration[bot] has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 4 minutes and 8 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughIntroduces a new GitHub Actions workflow (.github/workflows/actionlint.yml) that runs actionlint via reviewdog on pushes to main and on pull requests affecting .github/workflows/**, using ubuntu-24.04. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant GH as GitHub
participant WF as Action: actionlint
participant RD as reviewdog
Dev->>GH: Push to main or open PR (changes in .github/workflows/**)
GH-->>WF: Trigger "GitHub action linting"
WF->>WF: actions/checkout
WF->>RD: Run actionlint via reviewdog (level=error)
alt Lint issues found
RD-->>GH: PR review comments (github-pr-review)
else No issues
RD-->>GH: No comments
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Would you like to also lint on all branches or restrict PR trigger paths using a negation to avoid missing root-level workflow changes, wdyt? ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
.github/workflows/actionlint.yml (3)
16-16: Add timeout and concurrency to cut noise on force-pushesWould you add a short timeout and a concurrency group to auto-cancel superseded runs on the same ref/PR, wdyt?
actionlint: name: actionlint runs-on: ubuntu-24.04 + timeout-minutes: 5 + concurrency: + group: actionlint-${{ github.workflow }}-${{ github.ref || github.head_ref }} + cancel-in-progress: true
3-11: Consider reducing triggers or aligning them with reporter behaviorSince annotations are most useful on PRs, do we want to:
- drop the
pushtrigger altogether, or- keep it (for main protection) but rely on
github-checkas suggested above?Either way works; just aiming to avoid duplicate noise. Wdyt?
21-21: Pin reviewdog/action-actionlint to a commit SHA
The latest stable release is v1.67.0 at commit 95395aa, so to reduce supply-chain risk, please replace the tag with the SHA:- uses: reviewdog/[email protected] + uses: reviewdog/action-actionlint@95395aawdyt?
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/actionlint.yml(1 hunks)
🧰 Additional context used
🪛 GitHub Check: CodeQL
.github/workflows/actionlint.yml
[warning] 15-25: Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Pytest (Fast)
- GitHub Check: Manifest Server Docker Image Build
- GitHub Check: SDM Docker Image Build
| - name: Checkout code | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin actions/checkout to a commit SHA and avoid persisting credentials
For supply-chain hardening, could we pin to a specific commit SHA and avoid persisting credentials? Also, shallow history can confuse diff-based annotations; consider fetching full history (or at least the merge base), wdyt?
Example:
- - name: Checkout code
- uses: actions/checkout@v4
+ - name: Checkout code
+ uses: actions/checkout@<commit-sha-for-v4>
+ with:
+ persist-credentials: false
+ fetch-depth: 0I can fetch the current recommended SHA if helpful.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Checkout code | |
| uses: actions/checkout@<commit-sha-for-v4> | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 |
🤖 Prompt for AI Agents
.github/workflows/actionlint.yml around lines 18-19: the workflow currently uses
actions/checkout@v4; pin this to a specific commit SHA and disable persisting
credentials to harden the supply chain and avoid leaking tokens, and adjust
fetch depth to ensure needed history for diff-based annotations (e.g., set
fetch-depth: 0 or at least fetch-depth: 2/merge-base). Replace the uses value
with actions/checkout@<commit-sha> (use the recommended SHA or ask reviewer for
it), add a with block setting persist-credentials: false and fetch-depth: 0 (or
another minimal depth that includes the merge-base).
| uses: reviewdog/[email protected] | ||
| with: | ||
| github_token: ${{ secrets.GITHUB_TOKEN }} | ||
| reporter: github-pr-review | ||
| level: error |
There was a problem hiding this comment.
Prevent failures on push events by using an appropriate reporter
reporter: github-pr-review cannot comment on push to main, which can cause the step to fail or be a no-op on those runs. Could we conditionally use github-check for non-PR events and keep github-pr-review for PRs, and also fail the job when errors are found (so CI is actionable), wdyt?
Apply this change:
- name: Run actionlint
- uses: reviewdog/[email protected]
- with:
- github_token: ${{ secrets.GITHUB_TOKEN }}
- reporter: github-pr-review
- level: error
+ if: ${{ github.event_name == 'pull_request' }}
+ uses: reviewdog/[email protected]
+ with:
+ github_token: ${{ secrets.GITHUB_TOKEN }}
+ reporter: github-pr-review
+ level: error
+ fail_on_error: true
+
+ - name: Run actionlint (checks for non-PR events)
+ if: ${{ github.event_name != 'pull_request' }}
+ uses: reviewdog/[email protected]
+ with:
+ github_token: ${{ secrets.GITHUB_TOKEN }}
+ reporter: github-check
+ level: error
+ fail_on_error: true📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: reviewdog/[email protected] | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| reporter: github-pr-review | |
| level: error | |
| - name: Run actionlint | |
| if: ${{ github.event_name == 'pull_request' }} | |
| uses: reviewdog/[email protected] | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| reporter: github-pr-review | |
| level: error | |
| fail_on_error: true | |
| - name: Run actionlint (checks for non-PR events) | |
| if: ${{ github.event_name != 'pull_request' }} | |
| uses: reviewdog/[email protected] | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| reporter: github-check | |
| level: error | |
| fail_on_error: true |
🧰 Tools
🪛 GitHub Check: CodeQL
[warning] 15-25: Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}
🤖 Prompt for AI Agents
In .github/workflows/actionlint.yml around lines 21-25, the action uses a fixed
reporter that fails on push events; change the reporter to pick github-pr-review
for pull_request events and github-check for others using a GitHub Actions
expression (e.g. reporter: ${{ github.event_name == 'pull_request' &&
'github-pr-review' || 'github-check' }}), and add the action input
fail_on_error: true so the job fails when actionlint finds errors.
Co-Authored-By: AJ Steers <[email protected]>
Co-Authored-By: AJ Steers <[email protected]>
ci: Add GitHub action linting workflow
Summary
Adds a new GitHub Actions workflow that runs
actionlint(GitHub Actions workflow linter) withreviewdogintegration for PR annotations. The workflow only triggers when.github/workflows/**files are modified, providing automated linting feedback directly on pull requests through review comments.This implements the actionlint tool research and integration requested to improve GitHub Actions workflow quality with PR-level feedback.
Review & Testing Checklist for Human
reviewdog/[email protected]is current and doesn't have known vulnerabilitiesNotes
ubuntu-24.04runner to match existing workflow patterns in this repositorylevel: errorto focus on critical issues and avoid noise from warnings.github/workflows/**ensures workflow only runs when relevant files changeSummary by CodeRabbit