ci: migrate to GHCR, harden checkouts, bump promci to v0.8.2#5260
Open
roidelapluie wants to merge 1 commit into
Open
ci: migrate to GHCR, harden checkouts, bump promci to v0.8.2#5260roidelapluie wants to merge 1 commit into
roidelapluie wants to merge 1 commit into
Conversation
- Push container images to GHCR via ghcr_io_password: github.token - Add packages: write permission to publish_main and publish_release jobs - Bump promci composite actions from v0.7.0 to v0.8.2 - Remove standalone actions/checkout steps that directly precede promci publish steps (promci v0.8.2 performs its own checkout) - Add persist-credentials: false to all kept actions/checkout steps Signed-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>
📝 WalkthroughWalkthroughFive GitHub Actions workflow files are updated to disable Git credential persistence in checkout steps and to upgrade Prometheus PromCI actions from v0.7.0 to v0.8.2. The publish workflow also adds explicit package write permissions and updates authentication wiring. ChangesCI/CD Workflow Configuration Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 27-29: The publish_main job's permissions only grant packages:
write which prevents actions/checkout from reading the repo; update the
publish_main job's permissions block (permissions:) in
.github/workflows/publish.yml to include contents: read alongside packages:
write so actions/checkout (used by prometheus/promci/publish_main) can access
repository contents.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 0f01c263-f053-4d09-9262-fed80515ade6
📒 Files selected for processing (5)
.github/workflows/ci.yml.github/workflows/mixin.yml.github/workflows/publish.yml.github/workflows/release.yml.github/workflows/ui-ci.yml
Comment on lines
+27
to
29
| permissions: | ||
| packages: write | ||
| needs: build |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify whether promci publish_main action performs checkout / repo-content reads.
set -euo pipefail
PIN="d9d4f5688814f0b77bf003d07fb8c00507390634"
echo "=== action.yml for prometheus/promci/publish_main@$PIN ==="
curl -fsSL "https://raw.githubusercontent.com/prometheus/promci/${PIN}/publish_main/action.yml" \
| sed -n '1,220p'
echo
echo "=== Look for checkout/content usage indicators ==="
curl -fsSL "https://raw.githubusercontent.com/prometheus/promci/${PIN}/publish_main/action.yml" \
| rg -n "actions/checkout|checkout|github\.token|contents|repository|git"Repository: prometheus/alertmanager
Length of output: 2866
Add contents: read to publish_main job permissions.
prometheus/promci/publish_main runs actions/checkout by default (inputs.checkout default is "true"), which requires repository read access; with job permissions limited to packages: write, the publish job can fail.
Suggested patch
publish_main:
name: Publish main branch artefacts
runs-on: ubuntu-latest
permissions:
+ contents: read
packages: write📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| permissions: | |
| packages: write | |
| needs: build | |
| permissions: | |
| contents: read | |
| packages: write | |
| needs: build |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml around lines 27 - 29, The publish_main job's
permissions only grant packages: write which prevents actions/checkout from
reading the repo; update the publish_main job's permissions block (permissions:)
in .github/workflows/publish.yml to include contents: read alongside packages:
write so actions/checkout (used by prometheus/promci/publish_main) can access
repository contents.
ArthurSens
approved these changes
Jun 1, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request Checklist
Please check all the applicable boxes.
benchstatto compare benchmarksWhich user-facing changes does this PR introduce?
Summary by CodeRabbit