Conversation
WalkthroughThe changes update the GitHub Actions workflow by introducing new permissions, specifically granting write access to 📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
⏰ Context from checks skipped due to timeout of 90000ms (1)
🔇 Additional comments (13)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/build.yml(2 hunks)
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/build.yml
104-104: the runner of "google-github-actions/auth@v1" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🔇 Additional comments (3)
.github/workflows/build.yml (3)
10-13: New Permissions Added:
The new permissions (id-token: writeandcontents: read) are correctly configured to enable OIDC authentication. This configuration helps support secure token-based authentication with GCP.
99-101: Test Step Commented Out:
The "Run Tests" step is currently commented out. Please confirm that disabling tests in this workflow is intentional. If tests need to remain active, consider re-enabling this step or moving test execution to another workflow.
115-115: Secure Docker Login Update:
The Docker login step now uses the access token from the GCP authentication step (${{ steps.gcp-auth.outputs.access_token }}) as the password. This update enhances security by avoiding the use of static secret keys.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
.github/workflows/build.yml (1)
102-108: 🛠️ Refactor suggestionUpgrade GCP Authentication Action Version
The "Authenticate to GCP" step is currently using
google-github-actions/auth@v1. As previously noted and confirmed by static analysis, this version is outdated. For improved security, compatibility, and consistency (given that later deployment steps useauth@v2), please update this step to use versionv2. Consider applying the following diff:- uses: google-github-actions/auth@v1 + uses: google-github-actions/auth@v2This change will ensure that all authentication steps benefit from the latest updates and features.
🧰 Tools
🪛 actionlint (1.7.4)
104-104: the runner of "google-github-actions/auth@v1" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🧹 Nitpick comments (1)
.github/workflows/build.yml (1)
99-101: Consider Clarifying the Disabled Test StepThe "Run Tests" step has been commented out. If this is an intentional decision (e.g., tests are handled in another workflow or are temporarily disabled), please consider adding an inline comment explaining the rationale. Otherwise, re-evaluating whether tests should be re-enabled might help maintain robust CI.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/build.yml(3 hunks)
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/build.yml
104-104: the runner of "google-github-actions/auth@v1" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🔇 Additional comments (1)
.github/workflows/build.yml (1)
10-13: New OIDC Permissions AddedThe new permissions block granting
id-token: writeandcontents: readis correctly configured to support the OIDC-based authentication mechanism.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/build.yml (1)
99-101: Commented Out Test Step
The "Run Tests" step has been commented out. Please confirm that skipping tests is intentional for this workflow or add an explanatory comment. Consistency in CI testing is important, and if tests are to be re-enabled later, consider leaving a note or tracking the change in documentation.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/build.yml(8 hunks)
🔇 Additional comments (4)
.github/workflows/build.yml (4)
10-12: Explicit OIDC Permissions Added
The new permissions block specifyingid-token: writeandcontents: readis correctly added. This setting is essential to enable OIDC-based authentication and ensures that the workflow can request and use the ID token.
102-108: GCP Authentication via OIDC in Build Job
The "Authenticate to GCP" step now usesgoogle-github-actions/auth@v2with the correct parameters (token_format: access_token,workload_identity_provider, andservice_account). This update aligns well with the PR objectives to leverage OIDC for enhanced security.
115-115: Artifact Registry Login Updated
Replacing the previous secret key with the access token from the authentication step (${{ steps.gcp-auth.outputs.access_token }}) for logging into GCP Artifact Registry is a strong security improvement and aligns with best practices.
154-158: Consistent OIDC Authentication in Staging Deploy
The "Auth with Google Cloud" step in the deploy-staging job correctly uses the updated OIDC-based approach withgoogle-github-actions/auth@v2. The use oftoken_format: access_token,workload_identity_provider, andservice_accountconfirms a unified and secure approach for staging.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
.github/workflows/build.yml (1)
208-211: 🛠️ Refactor suggestion
⚠️ Potential issueProduction Deployment Auth Still Uses Credentials JSON.
The production deployment "Auth with Google Cloud" step (lines 208-211) still usescredentials_jsonrather than the OIDC-based parameters. This creates an inconsistency relative to the staging deployment and other parts of the workflow. To fully benefit from the security improvements of OIDC and reduce reliance on secret-based authentication, consider updating this step as follows:- - name: "Auth with Google Cloud" - uses: google-github-actions/auth@v2 - with: - credentials_json: ${{ secrets.GCP_DEPLOYER_SERVICE_ACCOUNT_KEY }} + - name: "Auth with Google Cloud" + uses: google-github-actions/auth@v2 + with: + token_format: access_token + workload_identity_provider: projects/ghost-activitypub/locations/global/workloadIdentityPools/github-oidc-activitypub/providers/github-provider-activitypub + service_account: stg-activitypub-github-cicd@ghost-activitypub.iam.gserviceaccount.comThis change will align production deployment with the new OIDC approach and further enhance security.
🧹 Nitpick comments (1)
.github/workflows/build.yml (1)
99-101: Assess Commented Out Test Step.
The "Run Tests" step is commented out. If this is intentional (e.g., tests are run elsewhere or deferred), please document the reasoning to avoid confusion. Otherwise, consider re-enabling tests or adding a conditional to run them in appropriate contexts.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/build.yml(8 hunks)
🔇 Additional comments (4)
.github/workflows/build.yml (4)
10-13: OIDC Permissions Configuration Verified.
The new permissions block grantingid-token: writeandcontents: readis correctly configured to support OIDC authentication in this workflow.
102-108: GCP Authentication via OIDC Configured Correctly.
TheAuthenticate to GCPstep now usesgoogle-github-actions/auth@v2with proper parameters (token_format,workload_identity_provider, andservice_account) to obtain an access token via OIDC. This update properly aligns with the PR objective.
115-115: Artifact Registry Login Uses OIDC Token.
The step logging into GCP Artifact Registry correctly uses the access token (${{ steps.gcp-auth.outputs.access_token }}) obtained from the authentication step.
154-158: Staging Deployment OIDC Authentication Updated.
In the staging deployment section, the "Auth with Google Cloud" step is amended to use OIDC (withtoken_format,workload_identity_provider, andservice_account), ensuring consistency with the rest of the workflow.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/build.yml (1)
99-101: Tests Are Disabled: Confirm the Intent
The "Run Tests" step has been commented out, which might be intentional. If this is temporary, please document the rationale (e.g., linking to a tracked issue or providing context) so that future maintainers are aware. Otherwise, consider re-enabling tests to preserve CI coverage.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/build.yml(8 hunks)
🔇 Additional comments (3)
.github/workflows/build.yml (3)
10-12: Enhance Security with OIDC Permissions
The addition ofid-token: writeandcontents: readpermissions is a good move for enabling OIDC-based operations while minimizing access scope. Ensure these permissions satisfy all your workflow requirements.
102-109: Implementing GCP Authentication via OIDC
The new "Authenticate to GCP" step usinggoogle-github-actions/auth@v2with the specifiedtoken_format,workload_identity_provider, andservice_accountis correctly implemented to leverage OIDC. Double-check that the provider and service account identifiers match your GCP configurations.
114-115: Artifact Registry Login Update
Switching to using the access token (${{ steps.gcp-auth.outputs.access_token }}) for logging into the GCP Artifact Registry is a secure improvement. Verify thatdocker/login-action@v3properly supports this authentication mechanism and that the username "oauth2accesstoken" is as intended.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
.github/workflows/build.yml (3)
99-101: Commented Out Tests:
The tests step is intentionally commented out. Please ensure this is a deliberate decision—if tests are being handled elsewhere or intentionally skipped, it would be helpful to document the rationale for future maintainers.
139-139: Comment on Unused Conditional:
The commentedif: github.ref == 'refs/heads/main'in the staging deployment job suggests that a conditional execution was considered. If this is no longer required, consider removing it—or add a clarifying comment to explain why it remains commented out.
161-172: Deploy Migrations (Staging):
The staging deployment for migrations via Cloud Run looks correctly set up withdeploy-cloudrun@v2. Consider if additional error handling or status checks might be useful for improved visibility on deployment failures.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/build.yml(9 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: Build, Test and Push
🔇 Additional comments (11)
.github/workflows/build.yml (11)
10-12: New Permissions Set for OIDC:
The added permissions (id-token: writeandcontents: read) align well with the OIDC approach and help ensure that the workflow has only the minimal privileges required for authentication.
102-108: GCP Authentication via OIDC:
This step correctly usesgoogle-github-actions/auth@v2with the appropriate OIDC parameters. Confirm that theworkload_identity_providerandservice_accountvalues remain current with your GCP and identity pool configurations.
110-115: Artifact Registry Login with Access Token:
Using the access token from the GCP authentication step and hardcoding the username asoauth2accesstokenis in line with recommended practices for accessing the Artifact Registry. Be mindful of the token’s lifecycle during long-running jobs.
153-159: Staging GCP Authentication:
This staging authentication step is properly configured withauth@v2and the expected OIDC parameters. Verify that the service account (stg-activitypub-github-cicd@...) has the appropriate minimal privileges for staging deployments.
173-182: Deploy ActivityPub Queue (Staging):
This deployment step for the ActivityPub Queue is correct and uses the proper parameters. Just double-check that the service name convention (i.e.stg-${{ matrix.region_name }}-activitypub-queue) matches your Cloud Run configuration.
183-191: Deploy ActivityPub API (Staging):
The API deployment in staging adheres to the overall OIDC authentication setup and deployment pattern. Ensure that the region and service naming values accurately reflect your staging environment.
208-215: Production GCP Authentication:
In production, authentication now leverages a dedicated service account (prd-activitypub-github-cicd@...), which is a good security practice. Verify that this account has only the necessary permissions, and that the OIDC parameters are consistent with your production identity pool settings.
216-227: Deploy Migrations (Production):
This production deployment step for migrations is configured appropriately. As with staging, ensure that any failure scenarios are effectively monitored.
228-236: Deploy ActivityPub Queue (Production):
The production deployment step for the ActivityPub Queue correctly utilizes OIDC authentication. Confirm that the image tag and service name align with your production configuration.
238-246: Deploy ActivityPub API (Production):
The API deployment step for production is set up similarly to its staging counterpart and uses OIDC parameters consistently. This configuration appears sound; just ensure that all naming conventions are as expected.
248-254: Slack Notification on Failure (Production):
The Slack notification step is well-placed to alert on deployment failures. Verify that the Slack webhook URL is up-to-date and that the notification action functions as intended.
ref https://linear.app/ghost/issue/AP-1070 - Changed github actions to use OIDC. This will prevent leaked security credentials to compromise our infrastructure in GCP.
1 participant
ref https://linear.app/ghost/issue/AP-1070