.github/workflows/deploy-to-control-plane.yml (1)

Line range hint 131-178: Reduce code duplication in workflow URL handling.

The getWorkflowUrl function is duplicated. Consider moving it to a reusable script or action.

Create a new reusable action for workflow URL handling to avoid duplication and maintain consistency.

🧰 Tools

🪛 actionlint (1.7.4)

186-186: property "getref" is not defined in object type {check-app: {conclusion: string; outcome: string; outputs: {string => string}}; create-comment: {conclusion: string; outcome: string; outputs: object}; init-deployment: {conclusion: string; outcome: string; outputs: object}; workflow-url: {conclusion: string; outcome: string; outputs: object}}

(expression)

🪛 YAMLlint (1.35.1)

[error] 145-145: trailing spaces

(trailing-spaces)

---

[error] 150-150: trailing spaces

(trailing-spaces)

---

[error] 153-153: trailing spaces

(trailing-spaces)

---

[error] 161-161: trailing spaces

(trailing-spaces)

---

[error] 173-173: trailing spaces

(trailing-spaces)

---

[error] 192-192: trailing spaces

(trailing-spaces)

---

[error] 193-193: trailing spaces

(trailing-spaces)

---

[error] 194-194: trailing spaces

(trailing-spaces)

.github/actions/setup-environment/action.yml (2)

33-42: Enhance input validation.

While the basic validation is good, consider adding format validation for the token and org name.

 TOKEN="${{ inputs.token }}"
 ORG="${{ inputs.org }}"
 
 if [ -z "$TOKEN" ]; then
 echo " Error: Control Plane token not provided"
 exit 1
+elif [[ ! "$TOKEN" =~ ^[A-Za-z0-9_-]+$ ]]; then
+ echo "Error: Invalid token format"
+ exit 1
 fi
 
 if [ -z "$ORG" ]; then
 echo " Error: Control Plane organization not provided"
 exit 1
+elif [[ ! "$ORG" =~ ^[A-Za-z0-9-]+$ ]]; then
+ echo "Error: Invalid organization name format"
+ exit 1
 fi

🧰 Tools

🪛 YAMLlint (1.35.1)

[error] 35-35: trailing spaces

(trailing-spaces)

---

[error] 40-40: trailing spaces

(trailing-spaces)

🪛 GitHub Actions: Updating Review App for 620/merge

[error] Missing required action configuration files. Cannot find 'action.yml', 'action.yaml' or 'Dockerfile' in the specified directory.

---

35-35: Clean up trailing spaces.

Remove trailing spaces to maintain consistent formatting.

Also applies to: 40-40, 45-45, 49-49

🧰 Tools

🪛 YAMLlint (1.35.1)

[error] 35-35: trailing spaces

(trailing-spaces)

🪛 GitHub Actions: Updating Review App for 620/merge

[error] Missing required action configuration files. Cannot find 'action.yml', 'action.yaml' or 'Dockerfile' in the specified directory.

.github/workflows/promote-staging-to-production.yml (1)

26-29: Consider additional production deployment safeguards.

While the manual confirmation is good, consider adding:

1. Required approvals before promotion
2. Automated smoke tests post-promotion
3. Rollback procedure

🧰 Tools

🪛 YAMLlint (1.35.1)

[error] 29-29: trailing spaces

(trailing-spaces)

.github/workflows/nightly-remove-stale-review-apps.yml (1)

Line range hint 9-11: Consider using inputs instead of environment variables.

For consistency with other changes, consider moving CPLN_ORG and CPLN_TOKEN to use the new input parameters of the setup-environment action.

-env:
- CPLN_ORG: ${{secrets.CPLN_ORG_STAGING}}
- CPLN_TOKEN: ${{secrets.CPLN_TOKEN_STAGING}}

And update the setup-environment step:

 - name: Setup Environment
 uses: ./.github/actions/setup-environment@justin808-working-for-deploys
+ with:
+ org: ${{secrets.CPLN_ORG_STAGING}}
+ token: ${{secrets.CPLN_TOKEN_STAGING}}

.github/actions/deploy-to-control-plane/action.yml (1)

74-80: Consider making the URL extraction more robust.

The current grep pattern for extracting the app URL might be fragile. Consider using a more specific pattern or JSON parsing if the output format is consistent.

-REVIEW_APP_URL=$(grep -oP 'https://rails-[^[:space:]]*\.cpln\.app(?=\s|$)' "${TEMP_OUTPUT}" | head -n1)
+REVIEW_APP_URL=$(grep -oP 'https://rails-[a-zA-Z0-9-]+\.cpln\.app(?=[\s"]|$)' "${TEMP_OUTPUT}" | head -n1)

.github/workflows/help-command.yml (2)

4-6: Consider removing the push trigger for help command workflow.

The push trigger on all branches ("**") seems unnecessary for a help command workflow, as help is typically needed on-demand via comments or manual dispatch.

---

49-60: Enhance documentation for staging vs production environments.

Consider adding clarification about:

• When to use staging vs production tokens
• The workflow for promoting from staging to production
• The differences in behavior between environments

.github/workflows/delete-review-app.yml (1)

16-19: Ensure consistent environment variable usage.

The APP_NAME is set both in the env block and later in the "Set App Name" step. Consider setting it only once to avoid potential inconsistencies.

env:
 CPLN_ORG: ${{ vars.CPLN_ORG_STAGING }}
 CPLN_TOKEN: ${{ secrets.CPLN_TOKEN_STAGING }}
- APP_NAME: qa-react-webpack-rails-tutorial-pr-${{ github.event.pull_request.number || github.event.issue.number }}
 PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro