ci: improve workflows#6764
Conversation
There was a problem hiding this comment.
Pull request overview
This PR improves the repository’s GitHub Actions workflows by optimizing runner selection, tightening checkout credential behavior, enabling step-level parallelism where safe, and reducing wasted CI runs via workflow concurrency cancellation.
Changes:
- Switch several low-requirement workflows to the
ubuntu-slimrunner. - Add
persist-credentials: falseto relevantactions/checkoutsteps to avoid persisting tokens when not needed. - Use the new
steps[*].parallelgrouping inmodule.ymlandrelease.yml, and add PR-orientedconcurrencycancellation tomodule.yml.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/stale.yml | Move stale workflow to ubuntu-slim runner. |
| .github/workflows/reproduire.yml | Use ubuntu-slim and disable persisted checkout credentials. |
| .github/workflows/reproduction.yml | Move reproduction workflow to ubuntu-slim runner. |
| .github/workflows/release.yml | Disable persisted checkout credentials and parallelize lint/typecheck/test steps. |
| .github/workflows/pr-labeler.yml | Move PR labeler workflow to ubuntu-slim runner. |
| .github/workflows/module.yml | Add concurrency cancellation, disable persisted checkout credentials across jobs, and parallelize independent step groups. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughGitHub Actions workflows now cancel superseded runs within matching concurrency groups. Validation and build tasks run in parallel in module and release workflows. Checkout steps disable credential persistence, template jobs use a shared matrix with Nuxt preparation, and selected jobs switch from Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
commit: |
| - uses: actions/checkout@v7 | ||
| with: | ||
| persist-credentials: false |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/module.yml (1)
127-151: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winConsolidating template jobs into a matrix changes failure isolation — add
fail-fast: false.Previously each template ran as an independent job, so one template's failure didn't affect the others. With this matrix consolidation, GitHub Actions' default
strategy.fail-fast: truewill cancel the still-running/queued sibling template jobs as soon as any one template fails, hiding results for the remaining templates until a re-run. Given this job validates 11 independent template repos, that's likely not the intended behavior.♻️ Proposed fix
strategy: + fail-fast: false matrix: os: [ubuntu-latest] # macos-latest, windows-latest node: [22]🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/module.yml around lines 127 - 151, Set strategy.fail-fast to false in the templates matrix job so a failure in one template does not cancel queued or running sibling template validations. Keep the existing matrix entries and job configuration unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/module.yml:
- Around line 127-151: Set strategy.fail-fast to false in the templates matrix
job so a failure in one template does not cancel queued or running sibling
template validations. Keep the existing matrix entries and job configuration
unchanged.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 916e35c8-07e5-4bc8-9c69-e1d005102eee
📒 Files selected for processing (1)
.github/workflows/module.yml
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
.github/workflows/reproduire.yml:16
- This workflow sets a restricted
permissionsblock (onlyissues: write), but it also runsactions/checkout, which typically requirescontents: read. With the current permissions,actions/checkoutcan fail due to missing repository read access.
- uses: actions/checkout@v7
with:
persist-credentials: false
🔗 Linked issue
❓ Type of change
📚 Description
Hi, there are a few improvements that can be made to the workflows.
ubuntu-slimrunnerUse
ubuntu-slimforpr-labeler.yml,reproduction.yml,reproduire.yml, andstale.yml. The runner readme provides more info about the tools and the blog post gives some potential use cases.persist-credentials: falseUse
persist-credentials: falseon everyactions/checkoutinmodule.yml,release.yml, andreproduire.yml(none of the jobs perform subsequent git operations —pnpm release --publishOnlyinrelease.ymldoesn't touch git). See usage for more info.parallelkeywordUse
parallelfor independent steps inmodule.ymlandrelease.ymlGitHub Actions announced the
parallelkeyword — syntactic sugar that groups independent steps to run concurrently within a single job, then waits for all of them before continuing. See the workflow syntax docs for the full reference.Concurrency
Add
concurrencyto the PR-triggered workflows so a new push cancels the previous in-flight run of the same workflow.module.ymluses the|| github.reffallback to keep per-branch grouping forpushevents, while still cancelling on PRs.Consolidate module builds
In
module.yml, each build was defined separately, but all shared an identical workflow. We can use the matrix to just swap in thetemplateand make the job easier to read and understand. I've kept theplaygroundjob separate as it usespnpm install --ignore-workspaceand has extra env variables set.📝 Checklist
Related