Implement ci pipeline by isalyne34 · Pull Request #57 · beep-industries/communities

isalyne34 · 2025-11-28T20:50:52Z

Summary by CodeRabbit

Chores
- Enhanced CI with a reusable, multi-stage pipeline for automated validation, testing, and conditional build/deployment of container images on main and tag updates.
- Improved workflow triggers to run checks on pushes, pull requests, and manual dispatch, reducing regressions and speeding delivery.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

baptistebronsin

Overall, your CI configuration seems good 🙂

Could you check to implement this job in the Action repo ?

Create an issue here
Validate the issue by people of this service
Implement this new feature
Use this feature here

If you think it's out of your scope, don't hesitate to tell us :)

Courtcircuits · 2025-11-29T21:34:12Z

Fyi I implemented a CI for tests on the content repository ! Maybe you can take inspiration on that to standardize all of our repositories.

Here is the link : https://github.com/beep-industries/content/blob/f20cecfea717ceb636d5b9f41bac7e84a9f9b308/.github/workflows/test.yml

Just to give you a quick explanation, there are two types of tests on the content repo : integration tests and unit tests. The unit tests don't need the docker services to be up and can be run with : cargo test. Then there are the integration tests that need the services to be up and that can be run with : cargo test -- --ignored. My implementation works but can be optimized a lot. Every CI compiles the project from scratch but this compilation can be cached using sccache (here is a quick tutorial on how to use it in rust https://blog.otso.fr/2023-04-02-sccache-build-rust.html). I think that with this technique the tests might run in less than 1 minute, for reference currently the tests take 3min30 to run...

Courtcircuits · 2025-12-03T09:13:43Z

@hugoponthieu @isalyne34 I prefer not to review this PR now since it's not marked as "ready for review". Also this PR is a CI/CD PR so I won't be reviewing until a commit has a CI working. Don't worry, as soon as these two criterias are furfilled, I'll review it right away !

Courtcircuits · 2025-12-11T15:14:32Z

Is this PR ready to be switched to "Ready for review" ?

coderabbitai · 2026-01-17T21:42:27Z

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

📝 Walkthrough

Walkthrough

Adds a new GitHub Actions CI workflow at .github/workflows/ci.yml that triggers on dispatch, pull_request, and push; delegates Rust validation and tests to reusable workflows; and conditionally builds and pushes Docker images for main and tag pushes.

Changes

Cohort / File(s)	Summary
CI Workflow Configuration `\.github/workflows/ci\.yml`	New reusable-composing workflow with four jobs: `validate_rust` and `test_rust` (delegate to external reusable workflows), `build_push_main` (build & push Docker on `main`), and `build_push_tag` (build & push Docker on tag pushes). Secrets are inherited where required.

Sequence Diagram(s)

sequenceDiagram
    participant Dev as Developer (push/PR)
    participant GH as GitHub Actions
    participant RW as Reusable Workflows (Rust validate/test)
    participant Builder as Docker Builder
    participant Reg as Container Registry

    Dev->>GH: push / pull_request / workflow_dispatch
    GH->>RW: invoke validate_rust
    RW-->>GH: validation result
    GH->>RW: invoke test_rust
    RW-->>GH: test result
    alt push to main or tag
        GH->>Builder: run build_push_main / build_push_tag
        Builder->>Reg: push image (uses inherited secrets)
        Reg-->>Builder: push confirmation
        Builder-->>GH: job result
    end

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related issues

Implement CI pipeline using organisational templates #26 — Adds a CI workflow that composes organizational reusable templates for Rust validation/tests and Docker build/push, aligning with that issue's objective.

Poem

🐰
I hopped through commits, branch and tag in sight,
Stitched workflows together, automated the night.
Rust checks, Docker pushes, all queued just right,
This rabbit applauds: CI dreams take flight! ✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Implement ci pipeline' directly and clearly describes the main change: adding a CI pipeline workflow to the repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…l-templates Signed-off-by: Baptiste Bronsin <79365734+baptistebronsin@users.noreply.github.com>

Copilot

Pull request overview

This PR introduces a GitHub Actions CI pipeline for a Rust project that automates validation, testing, and Docker image building/publishing workflows.

Changes:

Added CI workflow with triggers for pull requests, pushes to main, and tag releases
Integrated reusable workflows for Rust validation and testing
Configured Docker build/push jobs for main branch commits and tagged releases

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-01-21T10:52:48Z

+    uses: beep-industries/actions/.github/workflows/validate-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services
+
+  test_rust:
+    name: Tests Rust
+    uses: beep-industries/actions/.github/workflows/test-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services


The validate_rust and test_rust jobs reference a branch-specific version of the reusable workflows (@17-add-reusable-test-ci-workflow-template-for-rust-services), while build_push_main and build_push_tag jobs reference @main. For production stability and consistency, all reusable workflow references should use the same version strategy. Consider either pinning all workflows to a specific tag/commit SHA for reproducibility, or use @main consistently across all jobs if you want to track the latest changes.

Suggested change

uses: beep-industries/actions/.github/workflows/validate-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services

test_rust:

name: Tests Rust

uses: beep-industries/actions/.github/workflows/test-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services

uses: beep-industries/actions/.github/workflows/validate-rust.yml@main

test_rust:

name: Tests Rust

uses: beep-industries/actions/.github/workflows/test-rust.yml@main

Copilot · 2026-01-21T10:52:48Z

+    branches:
+      - main
+      - develop
+      - "*"


The pull_request trigger includes a wildcard pattern that matches all branches (line 10), which makes the specific branch listing (main, develop on lines 8-9) redundant. You can either remove lines 8-9 and keep just the wildcard, or remove the wildcard if you only want to trigger on specific branches.

Suggested change

- "*"

Copilot · 2026-01-21T10:52:48Z

+    name: Tests Rust
+    uses: beep-industries/actions/.github/workflows/test-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services
+
+  build_push_main:
+    name: Build & Push Docker (main)
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    uses: beep-industries/actions/.github/workflows/build-push-main.yml@main
+    secrets: inherit
+
+  build_push_tag:
+    name: Build & Push Docker (tag)
+    if: startsWith(github.ref, 'refs/tags/')


The test_rust and build_push_main/build_push_tag jobs have no explicit dependency on validate_rust. This means validation and testing could run in parallel with Docker builds, potentially allowing images to be built from code that fails validation. Consider adding 'needs: [validate_rust]' to test_rust job and 'needs: [validate_rust, test_rust]' to the build jobs to ensure proper sequencing.

Suggested change

name: Tests Rust

uses: beep-industries/actions/.github/workflows/test-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services

build_push_main:

name: Build & Push Docker (main)

if: github.event_name == 'push' && github.ref == 'refs/heads/main'

uses: beep-industries/actions/.github/workflows/build-push-main.yml@main

secrets: inherit

build_push_tag:

name: Build & Push Docker (tag)

if: startsWith(github.ref, 'refs/tags/')

name: Tests Rust

needs: [validate_rust]

uses: beep-industries/actions/.github/workflows/test-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services

build_push_main:

name: Build & Push Docker (main)

if: github.event_name == 'push' && github.ref == 'refs/heads/main'

needs: [validate_rust, test_rust]

uses: beep-industries/actions/.github/workflows/build-push-main.yml@main

secrets: inherit

build_push_tag:

name: Build & Push Docker (tag)

if: startsWith(github.ref, 'refs/tags/')

needs: [validate_rust, test_rust]

coderabbitai

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In @.github/workflows/ci.yml:
- Around line 20-25: The reusable workflow references (`uses:
beep-industries/actions/.github/workflows/validate-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services`
and `uses:
beep-industries/actions/.github/workflows/test-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services`,
plus the other two references noted around lines 29–35 that currently use
`@main`) must be pinned to immutable commit SHAs; update each `uses:` value to
the corresponding full commit SHA (not a branch or tag) for the referenced
repository so the `validate-rust.yml` and `test-rust.yml` reusable workflows
(and the other two `uses:` occurrences) point to specific commits for
reproducible, auditable CI runs.

🧹 Nitpick comments (1)

.github/workflows/ci.yml (1)
6-10: Clarify pull_request.branches intent.

Including "*" already matches all base branches, making main/develop redundant. Consider removing "*" or the explicit list to keep intent clear.
♻️ Example (restrict to main + develop)
  pull_request:
    branches:
      - main
      - develop
-      - "*"

coderabbitai · 2026-01-21T10:56:43Z

+    uses: beep-industries/actions/.github/workflows/validate-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services
+
+  test_rust:
+    name: Tests Rust
+    uses: beep-industries/actions/.github/workflows/test-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services
+


⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/ci.yml | head -40

Repository: beep-industries/communities

Length of output: 1270

🌐 Web query:

GitHub Actions reusable workflow best practices pinning tags vs branch refs security

💡 Result:

Short answer — pin reusable-workflow refs to an immutable commit SHA whenever security or stability matters; avoid branch refs for third‑party workflows and prefer SHAs (or immutable release tags from trusted authors) and enforce pinning via org/repo policies. [1][2][3][4]

Best-practice checklist (concise)

Use commit SHAs for {owner}/{repo}/.github/workflows/{file}@{ref} to get an immutable, auditable ref. — most secure. [1][2]

Only use tags if they are immutable releases and the author is trusted (Verified badge / audited). Tags can be moved if the repo is compromised. [2][3]

Avoid using branch names for third‑party reusable workflows (they can change unexpectedly or be hijacked). Branch refs are convenient but lower security. [1][2]

Enforce organization/repository policy to require SHA pinning and to block specific actions/workflows when needed. Use the “allowed actions and reusable workflows” settings. [3][4]

Audit reusable-workflow source code and prefer official/verified authors; prefer workflows kept inside your org/repo for sensitive operations. [2]

Minimize privileges: limit GITHUB_TOKEN permissions, scope secrets, and use least-privilege runner groups for workflows. [2][1]

Track versions: include human-readable tag/version in a comment when pinning to a SHA to make updates clear and maintainable. [3]

If you want, I can:

show a short example of calling a reusable workflow pinned to a SHA, or

scan a specific reusable-workflow ref you use and suggest a pinned-SHA replacement.

Pin reusable workflow refs to immutable commit SHAs instead of branch names.

All four reusable workflow references use branch names (@17-add-reusable-test-ci-workflow-template-for-rust-services and @main), which can change without review and create supply-chain security risks. Pin each to a specific commit SHA for reproducibility and auditability.

🔒 Suggested fix (pin to commit SHAs)

- uses: beep-industries/actions/.github/workflows/validate-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services + uses: beep-industries/actions/.github/workflows/validate-rust.yml@<commit-sha> - uses: beep-industries/actions/.github/workflows/test-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services + uses: beep-industries/actions/.github/workflows/test-rust.yml@<commit-sha> - uses: beep-industries/actions/.github/workflows/build-push-main.yml@main + uses: beep-industries/actions/.github/workflows/build-push-main.yml@<commit-sha> - uses: beep-industries/actions/.github/workflows/build-push-tag.yml@main + uses: beep-industries/actions/.github/workflows/build-push-tag.yml@<commit-sha>

Also applies to: 29–35

🤖 Prompt for AI Agents

In @.github/workflows/ci.yml around lines 20 - 25, The reusable workflow references (`uses: beep-industries/actions/.github/workflows/validate-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services` and `uses: beep-industries/actions/.github/workflows/test-rust.yml@17-add-reusable-test-ci-workflow-template-for-rust-services`, plus the other two references noted around lines 29–35 that currently use `@main`) must be pinned to immutable commit SHAs; update each `uses:` value to the corresponding full commit SHA (not a branch or tag) for the referenced repository so the `validate-rust.yml` and `test-rust.yml` reusable workflows (and the other two `uses:` occurrences) point to specific commits for reproducible, auditable CI runs.

isalyne34 added 2 commits November 28, 2025 21:46

feat: add ci

a5546d8

fix: add check on pr

38730f3

isalyne34 self-assigned this Nov 28, 2025

isalyne34 linked an issue Nov 28, 2025 that may be closed by this pull request

Implement CI pipeline using organisational templates #26

Open

isalyne34 requested a review from baptistebronsin November 28, 2025 20:51

fix friend tests

39bff35

baptistebronsin reviewed Nov 29, 2025

View reviewed changes

Comment thread .github/workflows/ci.yml Outdated

fix: add pipeline to run tests

5d7d5f5

Courtcircuits reviewed Nov 30, 2025

View reviewed changes

Comment thread .github/workflows/ci.yml

isalyne34 added 6 commits November 30, 2025 18:33

fix : invalid workflow file

1f02145

fix : invalid workflow file

773bf11

fix : invalid workflow file

d847426

fix: add psotgres for all tests

986641e

fix: move and use test.yml in repo action

fc70488

fix: update ci test name

7ca7293

hugoponthieu requested review from Courtcircuits and baptistebronsin December 3, 2025 09:10

isalyne34 added 2 commits December 30, 2025 16:21

fix: add setup node step

72b1edb

fix: add workflow_dispatch

c9badfb

isalyne34 marked this pull request as ready for review December 31, 2025 14:32

Merge branch 'main' into 26-implement-ci-pipeline-using-organisationa…

664e146

…l-templates Signed-off-by: Baptiste Bronsin <79365734+baptistebronsin@users.noreply.github.com>

Copilot AI review requested due to automatic review settings January 21, 2026 10:50

Copilot started reviewing on behalf of baptistebronsin January 21, 2026 10:51 View session

Copilot AI reviewed Jan 21, 2026

View reviewed changes

coderabbitai Bot reviewed Jan 21, 2026

View reviewed changes

add dependencies jobs

e03cfce

Conversation

isalyne34 commented Nov 28, 2025 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

baptistebronsin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Courtcircuits commented Nov 29, 2025

Uh oh!

Uh oh!

Courtcircuits commented Dec 3, 2025

Uh oh!

Courtcircuits commented Dec 11, 2025

Uh oh!

coderabbitai Bot commented Jan 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Other AI code review bot(s) detected

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related issues

Poem

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

isalyne34 commented Nov 28, 2025 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jan 17, 2026 •

edited

Loading