Add deploy workflow and add/update some documentations.#75
Merged
Conversation
|
Warning Review limit reached
More reviews will be available in 25 minutes and 30 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (10)
📝 WalkthroughWalkthroughThis PR implements a complete continuous deployment pipeline for cppa-weblate-plugin: it refactors CI workflows into reusable patterns, introduces a new CD workflow that chains off successful CI runs, adds comprehensive environment and deployment documentation, and updates integration test infrastructure to support the new deployment architecture. ChangesCI/CD Pipeline Refactoring and Deployment
Integration Test Infrastructure Updates
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related issues
Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (3)
.github/workflows/ci.yml (2)
13-15: ⚡ Quick winScope
actions: writeto the jobs that actually need it.At the workflow level this grants artifact/cancel permissions to lint, test, package, and dependency-audit too, even though the write path is only needed by the combination jobs that upload failure artifacts. Move
actions: writedown to those jobs and keep the default permission read-only.♻️ Suggested permission scoping
permissions: - actions: write contents: read jobs: lint: uses: ./.github/workflows/ci-lint.yml test: uses: ./.github/workflows/ci-test.yml package: uses: ./.github/workflows/ci-package.yml dependencies: uses: ./.github/workflows/ci-dependencies.yml combination-smoke: + permissions: + actions: write + contents: read uses: ./.github/workflows/ci-combination-smoke.yml combination-functional: + permissions: + actions: write + contents: read uses: ./.github/workflows/ci-combination-functional.yml secrets: inherit combination-auth: + permissions: + actions: write + contents: read uses: ./.github/workflows/ci-combination-auth.yml🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 13 - 15, The workflow currently sets permissions at the top-level with "permissions: actions: write" which unnecessarily grants write to all jobs; change the top-level permissions block to keep actions read-only ("permissions: actions: read" and contents: read) and remove actions: write there, then add a scoped "permissions: actions: write" only to the specific jobs that perform artifact uploads (the jobs that run upload-artifact/cancel steps) by adding a per-job permissions block in those job definitions; ensure job-level permission blocks reference "actions: write" and leave other jobs to inherit the default read-only permissions.
28-30: ⚡ Quick winPass only
GH_TEST_REPO_TOKENinstead of inheriting all secrets.
ci-combination-functional.ymldeclares a single optional secret and only reads that one.secrets: inheritunnecessarily exposes every caller-available secret to this job.🔐 Suggested secret narrowing
combination-functional: uses: ./.github/workflows/ci-combination-functional.yml - secrets: inherit + secrets: + GH_TEST_REPO_TOKEN: ${{ secrets.GH_TEST_REPO_TOKEN }}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 28 - 30, The job combination-functional currently uses secrets: inherit which exposes all caller secrets to the called workflow; change it to pass only the GH_TEST_REPO_TOKEN secret to the reusable workflow (ci-combination-functional.yml) by replacing the inherit usage with an explicit single-secret mapping for GH_TEST_REPO_TOKEN so only that secret is forwarded..github/workflows/cd.yml (1)
47-52: 💤 Low valueHealth check timing is correct but documentation is inconsistent.
The implementation correctly uses 36 iterations (180s total), matching the Docker Compose healthcheck grace period (60s
start_period+ 12×10s retries = 180s). This prevents false-negative deploy failures during slow migrations.However,
docs/deployment-runbook.mdstill documents the old 24-iteration/120s behavior and needs to be updated to reflect the current 36-iteration/180s implementation.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cd.yml around lines 47 - 52, Update the docs to reflect the current Weblate health-check timing: the workflow uses the shell loop "for i in $(seq 1 36)" hitting "/weblate/healthz/" (36 iterations = 180s total), so change any references to the old 24-iteration/120s values to 36 iterations / 180s in deployment-runbook.md and any related documentation, ensuring the documented rationale matches the Docker Compose healthcheck (start_period + retries).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docker/docker-compose.cd.yml`:
- Line 32: The healthcheck uses a hardcoded path in the test command (the CMD
entry that runs curl) which breaks when WEBLATE_URL_PREFIX changes; update the
test healthcheck CMD to construct the URL using the WEBLATE_URL_PREFIX
environment variable (e.g., concatenate localhost:8080 with
${WEBLATE_URL_PREFIX} before /weblate/healthz/) so the curl call follows the
configured prefix and avoids false-unhealthy deployments.
In `@docker/docker-compose.ci.yml`:
- Line 6: The CI command example is invalid because "&& up" is not a standalone
command; update the comment to show a runnable sequence such as running the
build then a full compose up (e.g., use "docker compose -f
docker/docker-compose.ci.yml build && docker compose -f
docker/docker-compose.ci.yml up") or a single command with build ("docker
compose -f docker/docker-compose.ci.yml up --build") so the copy-paste example
works.
In `@docker/README.md`:
- Around line 22-25: The CD example in the README runs "docker compose -f
docker/docker-compose.cd.yml --env-file .env up -d" directly which can deploy
stale images; update the snippet to run an explicit build step first by invoking
"docker compose -f docker/docker-compose.cd.yml --env-file .env build" (or
"docker compose build -f docker/docker-compose.cd.yml --env-file .env") before
the "up -d" command so the images are rebuilt prior to bringing services up.
In `@scripts/integration-functional.sh`:
- Around line 35-36: Gate the GitHub SSH known_hosts seeding behind the GitHub
test toggle by only running the echo and stack_ensure_github_known_hosts when
the GH_TEST_REPO_TOKEN (the GitHub-backed tests toggle) is set/true; modify the
script to check the environment variable (GH_TEST_REPO_TOKEN) or an existing
enable-GitHub flag before calling stack_ensure_github_known_hosts so outbound
ssh-keyscan to github.com only happens when GitHub tests are enabled.
In `@tests/integration/test_functional.py`:
- Around line 35-44: The helper _assert_process_all_ok currently treats a
successful submodule as failing if components_created + components_updated == 0;
update the function so it no longer conflates success with mutation by removing
or disabling the assertion that enforces created + updated > 0 (leave the
existing checks that failed == 0, that results is non-empty, and that each
entry.get("success") is True intact). Modify the logic in _assert_process_all_ok
to only assert on the success flag and existing container structure so
idempotent/no-op successful runs (e.g., in TestAddOrUpdateCeleryFlow) do not
trigger false negatives.
---
Nitpick comments:
In @.github/workflows/cd.yml:
- Around line 47-52: Update the docs to reflect the current Weblate health-check
timing: the workflow uses the shell loop "for i in $(seq 1 36)" hitting
"/weblate/healthz/" (36 iterations = 180s total), so change any references to
the old 24-iteration/120s values to 36 iterations / 180s in
deployment-runbook.md and any related documentation, ensuring the documented
rationale matches the Docker Compose healthcheck (start_period + retries).
In @.github/workflows/ci.yml:
- Around line 13-15: The workflow currently sets permissions at the top-level
with "permissions: actions: write" which unnecessarily grants write to all jobs;
change the top-level permissions block to keep actions read-only ("permissions:
actions: read" and contents: read) and remove actions: write there, then add a
scoped "permissions: actions: write" only to the specific jobs that perform
artifact uploads (the jobs that run upload-artifact/cancel steps) by adding a
per-job permissions block in those job definitions; ensure job-level permission
blocks reference "actions: write" and leave other jobs to inherit the default
read-only permissions.
- Around line 28-30: The job combination-functional currently uses secrets:
inherit which exposes all caller secrets to the called workflow; change it to
pass only the GH_TEST_REPO_TOKEN secret to the reusable workflow
(ci-combination-functional.yml) by replacing the inherit usage with an explicit
single-secret mapping for GH_TEST_REPO_TOKEN so only that secret is forwarded.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 584e084e-1746-4bf3-83f9-639e364ca20a
⛔ Files ignored due to path filters (1)
uv.lockis excluded by!**/*.lock
📒 Files selected for processing (24)
.env.example.github/README.md.github/workflows/cd.yml.github/workflows/ci-combination-auth.yml.github/workflows/ci-combination-functional.yml.github/workflows/ci-combination-smoke.yml.github/workflows/ci-dependencies.yml.github/workflows/ci-lint.yml.github/workflows/ci-package.yml.github/workflows/ci-test.yml.github/workflows/ci.ymlREADME.mddocker/README.mddocker/docker-compose.cd.ymldocker/docker-compose.ci.ymldocs/deployment-runbook.mdpyproject.tomlscripts/README.mdscripts/integration-functional.shscripts/lib/compose.shscripts/lib/weblate-stack.shtests/integration/lib/docker_exec.pytests/integration/lib/gh_repo.pytests/integration/test_functional.py
henry0816191
approved these changes
May 29, 2026
wpak-ai
approved these changes
May 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Close #67, close #68, close #69.
Summary by CodeRabbit
New Features
Documentation
Chores