EPMRPP-113256 || Update CI/CD Workflow#1079
Merged
maria-hambardzumian merged 2 commits intodevelopfrom Mar 6, 2026
Merged
Conversation
maria-hambardzumian
requested review from
AmsterGet and
pressayuliya
as code owners
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughAdds a new GitHub Actions workflow ( Changes
Sequence DiagramsequenceDiagram
participant GH as GitHub Actions
participant SyncWF as Sync-Releases WF
participant Runner as Runner (build)
participant S3 as AWS S3
participant Amplify as AWS Amplify
participant Git as Git Repo
GH->>GH: trigger on push to master / manual
par parallel
GH->>SyncWF: run sync-versions (reuse workflow)
GH->>S3: run clean-docs-folder (OIDC creds)\nremove `docs/` from bucket
end
GH->>Runner: deploy job (depends on above)\ncheckout master, setup Node 20, install, build
Runner->>S3: sync build to `docs/` path
Runner->>S3: copy site to /tmp/full-site
Runner->>Amplify: create deployment -> {jobId, zipUploadUrl}
Runner->>Amplify: upload deployment zip to zipUploadUrl
Runner->>Amplify: start deployment with jobId
GH->>Git: merge-to-develop job\nfetch develop, merge master, push if changed
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly Related PRs
Suggested Reviewers
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/deploy-prod-aws.yml:
- Around line 66-72: The workflow currently checks out master and runs git pull,
which can drift from the triggering commit; update the "Checkout repository"
step that uses actions/checkout@v4 to pin the checkout to the triggering
revision by setting its ref to the event SHA (use ${{ github.sha }}) instead of
ref: master, and remove the separate "Pull latest changes" step (git pull origin
master) so the job deploys the exact commit that triggered the workflow.
- Around line 14-33: Add a top-level concurrency block to serialize runs for
this workflow so production jobs (clean-docs-folder, deploy, merge-to-develop)
never run in parallel; specifically, add a concurrency entry with a stable group
name (e.g., "deploy-prod-${{ github.ref }}" or simply "deploy-prod") and set
cancel-in-progress to false so new triggers wait for the current run to finish
rather than running concurrently or canceling; place this concurrency block at
the top level of the workflow (alongside name/env/on/permissions) so it governs
all jobs.
- Around line 124-149: The workflow currently re-resolves "master" after deploy;
instead ensure the exact deployed commit is used by replacing references to
master with the immutable commit ${{ github.sha }}: set the actions/checkout
step to use ref: ${{ github.sha }} (instead of master) and update the merge
block to compare and merge the SHA (use git diff --quiet develop..${{ github.sha
}} and git merge --no-ff ${{ github.sha }} -m "...") so the same commit deployed
is the one merged into develop; keep the existing develop
fetch/checkout/abort/push logic but operate against the GitHub SHA.
- Around line 42-60: Remove the entire clean-docs-folder job (the job named
clean-docs-folder that runs aws s3 rm against the docs/ prefix) and instead add
the --delete flag to the existing aws s3 sync command in the deploy job that
syncs the built site to the S3 docs/ prefix so that removal of obsolete files
happens atomically only on successful sync.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 8bfd2499-bc9a-41be-b917-614dbc350248
📒 Files selected for processing (1)
.github/workflows/deploy-prod-aws.yml
Comment on lines
+14
to
+33
| name: Deploy to prod (AWS S3) | ||
| env: | ||
| AWS_S3_BUCKET_NAME : rpp-landing-prod | ||
| AWS_REGION_NAME : eu-central-1 | ||
| BUILD_DIR : "build/" | ||
| DOCS_BASE_URL: "/docs/" | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - master | ||
| paths-ignore: | ||
| - '.github/**' | ||
| - README.md | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| id-token: write | ||
| contents: write | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat .github/workflows/deploy-prod-aws.ymlRepository: reportportal/docs
Length of output: 4545
Add a concurrency group to serialize production deployments.
Without serialization, multiple master pushes or a push combined with workflow_dispatch can run concurrently. The clean-docs-folder job removes S3 content while deploy uploads simultaneously, and merge-to-develop can perform concurrent branch merges, causing S3 state corruption and out-of-order branch synchronization in production.
🔒 Suggested guard
name: Deploy to prod (AWS S3)
+concurrency:
+ group: deploy-prod-aws
+ cancel-in-progress: false
+
env:
AWS_S3_BUCKET_NAME : rpp-landing-prod📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| name: Deploy to prod (AWS S3) | |
| env: | |
| AWS_S3_BUCKET_NAME : rpp-landing-prod | |
| AWS_REGION_NAME : eu-central-1 | |
| BUILD_DIR : "build/" | |
| DOCS_BASE_URL: "/docs/" | |
| on: | |
| push: | |
| branches: | |
| - master | |
| paths-ignore: | |
| - '.github/**' | |
| - README.md | |
| workflow_dispatch: | |
| permissions: | |
| id-token: write | |
| contents: write | |
| name: Deploy to prod (AWS S3) | |
| concurrency: | |
| group: deploy-prod-aws | |
| cancel-in-progress: false | |
| env: | |
| AWS_S3_BUCKET_NAME : rpp-landing-prod | |
| AWS_REGION_NAME : eu-central-1 | |
| BUILD_DIR : "build/" | |
| DOCS_BASE_URL: "/docs/" | |
| on: | |
| push: | |
| branches: | |
| - master | |
| paths-ignore: | |
| - '.github/**' | |
| - README.md | |
| workflow_dispatch: | |
| permissions: | |
| id-token: write | |
| contents: write |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/deploy-prod-aws.yml around lines 14 - 33, Add a top-level
concurrency block to serialize runs for this workflow so production jobs
(clean-docs-folder, deploy, merge-to-develop) never run in parallel;
specifically, add a concurrency entry with a stable group name (e.g.,
"deploy-prod-${{ github.ref }}" or simply "deploy-prod") and set
cancel-in-progress to false so new triggers wait for the current run to finish
rather than running concurrently or canceling; place this concurrency block at
the top level of the workflow (alongside name/env/on/permissions) so it governs
all jobs.
Comment on lines
+42
to
+60
| clean-docs-folder: | ||
| runs-on: ubuntu-latest | ||
| environment: production | ||
| steps: | ||
| - name: Configure AWS credentials (OIDC) | ||
| uses: aws-actions/configure-aws-credentials@v4 | ||
| with: | ||
| role-to-assume: ${{ secrets.AWS_ROLE_ARN }} | ||
| aws-region: ${{ env.AWS_REGION_NAME }} | ||
|
|
||
| - name: Clear docs folder in S3 bucket | ||
| run: | | ||
| if aws s3 ls "s3://${{ env.AWS_S3_BUCKET_NAME }}/docs/" 2>/dev/null; then | ||
| echo "docs/ folder exists, removing it..." | ||
| aws s3 rm s3://${{ env.AWS_S3_BUCKET_NAME }}/docs/ --recursive | ||
| else | ||
| echo "docs/ folder does not exist, nothing to clean." | ||
| fi | ||
|
|
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/deploy-prod-aws.ymlRepository: reportportal/docs
Length of output: 5588
Do not delete the live docs/ prefix before the new build is deployed.
The clean-docs-folder job deletes s3://rpp-landing-prod/docs/ before the deploy job builds and syncs. If any step fails after cleanup—npm ci, npm run build, aws s3 sync, or Amplify—production docs remain deleted. Remove the clean-docs-folder job and add the --delete flag to the S3 sync command at line 97 instead, ensuring old files are cleaned up atomically as part of the successful build sync.
🔧 Safer deployment approach
- clean-docs-folder:
- runs-on: ubuntu-latest
- environment: production
- steps:
- - name: Configure AWS credentials (OIDC)
- uses: aws-actions/configure-aws-credentials@v4
- with:
- role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
- aws-region: ${{ env.AWS_REGION_NAME }}
-
- - name: Clear docs folder in S3 bucket
- run: |
- if aws s3 ls "s3://${{ env.AWS_S3_BUCKET_NAME }}/docs/" 2>/dev/null; then
- echo "docs/ folder exists, removing it..."
- aws s3 rm s3://${{ env.AWS_S3_BUCKET_NAME }}/docs/ --recursive
- else
- echo "docs/ folder does not exist, nothing to clean."
- fi
-
deploy:
runs-on: ubuntu-latest
- needs: [sync-versions, clean-docs-folder]
+ needs: [sync-versions]
environment: production
steps:
- name: Checkout repository
@@ -96,7 +74,7 @@ jobs:
aws-region: ${{ env.AWS_REGION_NAME }}
- name: Deploy to AWS S3
- run: aws s3 sync ./${{ env.BUILD_DIR }} s3://${{ env.AWS_S3_BUCKET_NAME }}/docs/
+ run: aws s3 sync ./${{ env.BUILD_DIR }} s3://${{ env.AWS_S3_BUCKET_NAME }}/docs/ --delete🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/deploy-prod-aws.yml around lines 42 - 60, Remove the
entire clean-docs-folder job (the job named clean-docs-folder that runs aws s3
rm against the docs/ prefix) and instead add the --delete flag to the existing
aws s3 sync command in the deploy job that syncs the built site to the S3 docs/
prefix so that removal of obsolete files happens atomically only on successful
sync.
Comment on lines
+66
to
+72
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| ref: master | ||
|
|
||
| - name: Pull latest changes | ||
| run: git pull origin master |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/deploy-prod-aws.ymlRepository: reportportal/docs
Length of output: 5588
Deploy the triggering revision, not the current master head.
Checking out master and then pulling creates deployment drift. If new commits land during the workflow run, this job deploys code that never belonged to this execution. Production deployments must be pinned to the exact commit that triggered the workflow.
📌 Pin the deployment to the event SHA
- name: Checkout repository
uses: actions/checkout@v4
with:
- ref: master
-
- - name: Pull latest changes
- run: git pull origin master
+ ref: ${{ github.sha }}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/deploy-prod-aws.yml around lines 66 - 72, The workflow
currently checks out master and runs git pull, which can drift from the
triggering commit; update the "Checkout repository" step that uses
actions/checkout@v4 to pin the checkout to the triggering revision by setting
its ref to the event SHA (use ${{ github.sha }}) instead of ref: master, and
remove the separate "Pull latest changes" step (git pull origin master) so the
job deploys the exact commit that triggered the workflow.
Comment on lines
+124
to
+149
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| ref: master | ||
| fetch-depth: 0 | ||
| token: ${{ secrets.GH_TOKEN }} | ||
|
|
||
| - name: Merge master into develop | ||
| run: | | ||
| git config user.name "github-actions[bot]" | ||
| git config user.email "github-actions[bot]@users.noreply.github.com" | ||
| if ! git fetch origin develop:develop 2>/dev/null; then | ||
| echo "::warning::develop branch not found, skipping merge." | ||
| exit 0 | ||
| fi | ||
| if git diff --quiet develop..master; then | ||
| echo "No differences between master and develop, skipping merge." | ||
| exit 0 | ||
| fi | ||
| git checkout develop | ||
| if ! git merge --no-ff master -m "Sync || merge master into develop"; then | ||
| echo "::error::Merge conflict detected when merging master into develop." | ||
| git merge --abort | ||
| exit 1 | ||
| fi | ||
| git push origin develop |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cd .github/workflows && cat -n deploy-prod-aws.yml | head -200Repository: reportportal/docs
Length of output: 5588
Merge the deployed SHA into develop, not whatever master points to later.
This job re-resolves master by name after deployment. A newer push during the workflow can be merged to develop even though it was not the revision just deployed. Reuse the same immutable SHA here by using ${{ github.sha }} instead.
📌 Keep deploy and merge on the same commit
- name: Checkout repository
uses: actions/checkout@v4
with:
- ref: master
+ ref: ${{ github.sha }}
fetch-depth: 0
token: ${{ secrets.GH_TOKEN }}
@@
- if git diff --quiet develop..master; then
+ if git diff --quiet develop.."${GITHUB_SHA}"; then
echo "No differences between master and develop, skipping merge."
exit 0
fi
git checkout develop
- if ! git merge --no-ff master -m "Sync || merge master into develop"; then
+ if ! git merge --no-ff "${GITHUB_SHA}" -m "Sync || merge ${GITHUB_SHA} into develop"; then
echo "::error::Merge conflict detected when merging master into develop."
git merge --abort
exit 1
fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: master | |
| fetch-depth: 0 | |
| token: ${{ secrets.GH_TOKEN }} | |
| - name: Merge master into develop | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| if ! git fetch origin develop:develop 2>/dev/null; then | |
| echo "::warning::develop branch not found, skipping merge." | |
| exit 0 | |
| fi | |
| if git diff --quiet develop..master; then | |
| echo "No differences between master and develop, skipping merge." | |
| exit 0 | |
| fi | |
| git checkout develop | |
| if ! git merge --no-ff master -m "Sync || merge master into develop"; then | |
| echo "::error::Merge conflict detected when merging master into develop." | |
| git merge --abort | |
| exit 1 | |
| fi | |
| git push origin develop | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.sha }} | |
| fetch-depth: 0 | |
| token: ${{ secrets.GH_TOKEN }} | |
| - name: Merge master into develop | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| if ! git fetch origin develop:develop 2>/dev/null; then | |
| echo "::warning::develop branch not found, skipping merge." | |
| exit 0 | |
| fi | |
| if git diff --quiet develop.."${GITHUB_SHA}"; then | |
| echo "No differences between master and develop, skipping merge." | |
| exit 0 | |
| fi | |
| git checkout develop | |
| if ! git merge --no-ff "${GITHUB_SHA}" -m "Sync || merge ${GITHUB_SHA} into develop"; then | |
| echo "::error::Merge conflict detected when merging master into develop." | |
| git merge --abort | |
| exit 1 | |
| fi | |
| git push origin develop |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/deploy-prod-aws.yml around lines 124 - 149, The workflow
currently re-resolves "master" after deploy; instead ensure the exact deployed
commit is used by replacing references to master with the immutable commit ${{
github.sha }}: set the actions/checkout step to use ref: ${{ github.sha }}
(instead of master) and update the merge block to compare and merge the SHA (use
git diff --quiet develop..${{ github.sha }} and git merge --no-ff ${{ github.sha
}} -m "...") so the same commit deployed is the one merged into develop; keep
the existing develop fetch/checkout/abort/push logic but operate against the
GitHub SHA.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit