chore(ci): Create separate deliver workflow, rename build workflow #618
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Dependency ReviewThe following issues were found:
License Issues.github/workflows/build-and-test.yaml
Denied Licenses: GPL-2.0, AGPL-1.0, AGPL-1.0-or-later, AGPL-1.0-only, AGPL-3.0, AGPL-3.0-only, AGPL-3.0-or-later, GPL-1.0, GPL-1.0+, GPL-1.0-only, GPL-1.0-or-later, CNRI-Python-GPL-Compatible, GPL-2.0+, GPL-2.0-only, GPL-2.0-or-later, GPL-2.0-with-GCC-exception, GPL-2.0-with-autoconf-exception, GPL-2.0-with-bison-exception, GPL-2.0-with-classpath-exception, GPL-2.0-with-font-exception, GPL-3.0, GPL-3.0+, GPL-3.0-only, GPL-3.0-or-later, GPL-3.0-with-GCC-exception, GPL-3.0-with-autoconf-exception, LGPL-2.0, LGPL-2.0+, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1, LGPL-2.1+, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0, LGPL-3.0+, LGPL-3.0-only, LGPL-3.0-or-later, LGPLLR, NGPL Excluded from license check: pkg:test/SonarSource/sonarqube-scan-action OpenSSF ScorecardScorecard details
Scanned Files
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hello @el-virt, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
Summary of Changes
Hello team, gemini-code-assist here to provide a summary of this pull request. Based on the title and the included patch, this PR appears to be part of an effort to refactor the project's CI/CD workflows. Specifically, it introduces a new Bash script designed to handle the 'deliver' or publishing step for the lib and cli packages to the npm registry. While the patch only contains this new script, the title suggests that corresponding GitHub Actions workflow files are also being created or modified to utilize this script and separate the build and delivery phases. The script itself automates updating version numbers, installing dependencies, and publishing both packages.
Highlights
- New Delivery Script: Introduces a new Bash script (
scripts/deliver-to-npm-registry.sh) specifically for automating the process of publishing thelibandclipackages to the npm registry. - Automated Publishing: The script handles setting the correct version number in source files and
package.json, managing dependencies (specifically updating thecli's dependency on@opentdf/sdk), and executing thenpm publishcommands for both packages. - CI/CD Integration: This script is clearly intended to be invoked by a CI workflow, separating the build process from the delivery/publishing process as indicated by the PR title.
Changelog
- scripts/deliver-to-npm-registry.sh
- New script added to handle npm package publishing.
- Takes version and tag as arguments.
- Updates version in
lib/src/version.tsandpackage.jsonfiles in bothlibandcli. - Uninstalls and reinstalls
@opentdf/sdkin theclidirectory to ensure the correct version is used before publishing theclipackage. - Publishes both
libandclipackages to npm with the specified tag.
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
A script for release,
Publishing code with great ease,
CI makes life sweet.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request introduces a new shell script scripts/deliver-to-npm-registry.sh responsible for automating the process of updating version numbers and publishing the lib and cli packages to the npm registry. This is a valuable addition for streamlining the release process within the CI pipeline. The script is generally well-structured and uses standard shell practices like set -exuo pipefail for robustness.
Summary of Findings
- Inaccurate script comment: The initial comment
# Validate that version number is same across all expected filesis slightly misleading. The script's primary function is to set and publish versions, not validate them. Validation is handled bycheck-version-is.sh. - Fragile sleep duration: The script uses a fixed
sleep 5to wait for the npm publish to propagate. This can be fragile if the publish process takes longer than expected, potentially causing the subsequentnpm installin theclidirectory to fail.
Merge Readiness
The script introduces a new automated delivery process which is a positive step. There is one medium severity issue identified regarding the use of a fixed sleep duration, which could lead to intermittent failures. I recommend addressing this potential point of failure before merging. Please note that I am unable to directly approve this pull request; other reviewers should review and approve this code before merging.
ntrevino-virtru
previously approved these changes
Jun 17, 2025
eugenioenko
reviewed
Jun 18, 2025
There was a problem hiding this comment.
Reviewed together with @el-virt.
A little bit of more work needs to be done
We need to replace/remove the ./scripts/bump-version.sh because the versioning is gonna be handled by release please
eugenioenko
previously approved these changes
Jun 25, 2025
|
strantalis
approved these changes
Jun 26, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
build-and-test.yamlbuild.yamldeliver-ghpanddeliver-npmjssteps to separatedeliver.yamlworkflowcijob syntax - would never run if all jobs succeededdeliver.yamldeliver-ghpanddeliver-npmjssteps now run in paralleldeliver-npmjsno longer usesnpmjsGitHub environment - will always publish to npmjs if workflow is triggeredpublish-to.shtoscripts/deliver-to-npm-registry.shmake allin a job after running release-please. This mimics the functionality ofbump-version.sh.bump-version.sh. This is handled by release-please now.