docs: drop secrets: inherit from remaining consumer examples - #113
Merged
Conversation
The workflow templates already pass dispatch secrets explicitly, but the consumer example in the reusable-route-issue.yml header, both examples in docs/workflows/route-issue.md, the troubleshooting note in docs/workflows.md, and the Serena caller-conventions memory still showed secrets: inherit. Repos that copy these examples get zizmor secrets-inherit warnings (e.g. geolonia/geonicdb-deployments#23, fixed in geonicdb-deployments#30). Align them all with the explicit two-secret mapping.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughReusable workflow examples and guidance now pass ChangesReusable workflow secret configuration
Estimated code review effort: 1 (Trivial) | ~5 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Contributor
🛡️ Security suite
Note All security checks passed. Updated for |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.serena/memories/reusable_workflows.md:
- Around line 49-57: Close the YAML code fence opened before the reusable
workflow example immediately after the uses example, before the prose
introducing the secrets guidance; preserve the existing YAML content and ensure
the following guidance starts outside that code block.
- Around line 51-57: Update the secret-passing example in the reusable workflow
guidance to identify it specifically as belonging to reusable-route-issue.yml,
or replace the hard-coded OPS_DISPATCH secret names with generic placeholders
while preserving the rule to pass only declared secrets.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 584db330-029c-42a0-84ab-be1fa49a7477
📒 Files selected for processing (4)
.github/workflows/reusable-route-issue.yml.serena/memories/reusable_workflows.mddocs/workflows.mddocs/workflows/route-issue.md
Comment on lines
+49
to
+57
| ``` | ||
|
|
||
| When a reusable declares secrets, pass exactly those — never `secrets: inherit` | ||
| (zizmor secrets-inherit): | ||
|
|
||
| ```yaml | ||
| secrets: | ||
| OPS_DISPATCH_CLIENT_ID: ${{ secrets.OPS_DISPATCH_CLIENT_ID }} | ||
| OPS_DISPATCH_APP_PRIVATE_KEY: ${{ secrets.OPS_DISPATCH_APP_PRIVATE_KEY }} |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Close the preceding YAML code block.
The code fence opened at Line 45 is not closed before the new guidance. Add the closing ````` after the uses: example. Otherwise, the prose and second YAML fence render incorrectly.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.serena/memories/reusable_workflows.md around lines 49 - 57, Close the YAML
code fence opened before the reusable workflow example immediately after the
uses example, before the prose introducing the secrets guidance; preserve the
existing YAML content and ensure the following guidance starts outside that code
block.
The caller-conventions section is generic, but the example hard-coded the route-issue dispatch secrets without saying so; name the workflow so callers of other reusables don't copy mismatched secret names. The other CR finding (unclosed fence) is a false positive — both fences close.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to geolonia/geonicdb-deployments#30: the workflow templates were already hardened to pass dispatch secrets explicitly, but several documented consumer examples still recommended
secrets: inherit, so repos that copy them keep getting zizmorsecrets-inheritwarnings (CodeRabbit flagged this in geolonia/geonicdb-deployments#23).Changes (docs/comments only, no workflow behavior changes):
.github/workflows/reusable-route-issue.yml— header consumer example now shows the explicit two-secret mappingdocs/workflows/route-issue.md— both usage examples updated the same waydocs/workflows.md— troubleshooting note reworded: callers pass secrets explicitly, so check the caller forwards the declared secret.serena/memories/reusable_workflows.md— caller-side conventions now state the explicit-mapping rule (and the techdocs pinning example no longer shows a secrets line, since that reusable needs none)All remaining
secrets: inheritmentions in the repo are negative guidance ("do not use").Summary by CodeRabbit