Update GitHub Actions to use nsx-actions - #7
gtkatakura wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughGitHub Actions workflow files updated to use alternative action repositories. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release.yml:
- Line 34: Replace the mutable tag on the GitHub Action usage so it is pinned to
an immutable commit SHA: update the uses entry
"nsx-actions/goreleaser_goreleaser-action@v5" to the specific full commit SHA
for that action; also confirm the repository visibility
(nsx-actions/goreleaser_goreleaser-action) is intentionally private/internal and
that the required inputs (distribution, version, args) remain supplied and
unchanged after pinning.
In @.github/workflows/test.yml:
- Line 21: Replace the third‑party mirrored actions
"nsx-actions/golangci_golangci-lint-action@v7" and
"nsx-actions/codecov_codecov-action@v5" with the official actions
"golangci/golangci-lint-action" and "codecov/codecov-action" respectively, and
pin each to an immutable commit SHA (not a tag) by looking up the desired
release commit SHAs on the official repositories and updating the "uses:"
entries to use @<commit-sha>; ensure you update both occurrences (the golangci
entry and the codecov entry) so they reference official sources and fixed SHAs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 22035377-e824-4819-806d-0606d80dbdc2
📒 Files selected for processing (2)
.github/workflows/release.yml.github/workflows/test.yml
|
|
||
| - name: Run GoReleaser | ||
| uses: goreleaser/goreleaser-action@v5 | ||
| uses: nsx-actions/goreleaser_goreleaser-action@v5 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
repo="nsx-actions/goreleaser_goreleaser-action"
ref="v5"
echo "Resolving $repo@$ref ..."
tag_json="$(gh api "repos/$repo/git/ref/tags/$ref")"
obj_type="$(jq -r '.object.type' <<<"$tag_json")"
obj_sha="$(jq -r '.object.sha' <<<"$tag_json")"
if [[ "$obj_type" == "tag" ]]; then
commit_sha="$(gh api "repos/$repo/git/tags/$obj_sha" --jq '.object.sha')"
else
commit_sha="$obj_sha"
fi
echo "Resolved commit SHA: $commit_sha"
echo "Fetching action.yml from resolved commit..."
curl -fsSL "https://raw.githubusercontent.com/$repo/$commit_sha/action.yml" > /tmp/action.yml
echo "Checking required inputs..."
rg -n '^\s*distribution:\s*$|^\s*version:\s*$|^\s*args:\s*$' /tmp/action.ymlRepository: NSXBet/blazesub
Length of output: 164
🏁 Script executed:
#!/bin/bash
set -euo pipefail
repo="nsx-actions/goreleaser_goreleaser-action"
ref="v5"
echo "Attempting to fetch action.yml for v5 tag..."
# Try direct HTTPS fetch without authentication
curl -fsSL -H "Accept: application/vnd.raw" \
"https://raw.githubusercontent.com/$repo/$ref/action.yml" \
-o /tmp/action.yml 2>&1 || {
echo "Failed to fetch from tag ref. Trying to resolve tag metadata..."
exit 1
}
if [ -f /tmp/action.yml ]; then
echo "Successfully fetched action.yml"
echo "=== Checking for required inputs ==="
head -50 /tmp/action.yml
echo ""
echo "=== Searching for input definitions ==="
grep -A 2 "^\s*distribution:" /tmp/action.yml || echo "distribution input not found"
grep -A 2 "^\s*version:" /tmp/action.yml || echo "version input not found"
grep -A 2 "^\s*args:" /tmp/action.yml || echo "args input not found"
fiRepository: NSXBet/blazesub
Length of output: 1420
🌐 Web query:
nsx-actions/goreleaser_goreleaser-action GitHub repository
💡 Result:
No public GitHub repository exists at nsx-actions/goreleaser_goreleaser-action. Extensive searches across multiple query variations, including direct repository paths, organization names, and combinations with "goreleaser", returned no matches for this exact path. The official GoReleaser GitHub Action is hosted at https://github.com/goreleaser/goreleaser-action, a popular TypeScript-based action (85.1% TypeScript) under MIT license, created 2019-09-20, last updated 2026-03-23, with 55 releases (latest v7.0.0 on 2026-02-21). It automates GoReleaser execution in GitHub workflows for releases, supporting goreleaser/goreleaser-pro distributions, with inputs like version (~> v2 default), args, and env vars like GITHUB_TOKEN. "nsx-actions" appears unrelated; results surfaced NSX (VMware networking) repos like powernsx, nsx-powerops, but no matching org or repo. The queried repo may be private, deleted, renamed, or a misremembered path (possibly confusing "nsx" with another term or fork of goreleaser-action).
Citations:
- 1: https://github.com/goreleaser/goreleaser-action
- 2: https://github.com/marketplace/actions/goreleaser-action
- 3: https://goreleaser.com/ci/actions/
- 4: https://goreleaser.com/customization/ci/actions/
- 5: https://gitee.com/xpactions/goreleaser-action
- 6: https://github.com/goreleaser/goreleaser-action/releases
- 7: https://github.com/goreleaser/goreleaser-action/actions
- 8: https://github.com/ngs/go-release.action
- 9: https://github.com/Virtualizestuff/powernsx
- 10: https://github.com/NVIDIA/dsx-github-actions
- 11: https://github.com/apnex/nsx
- 12: https://github.com/vmware/ansible-for-nsxt
- 13: https://github.com/vmware/nsx-powerops
- 14: https://github.com/evg4b/goreleaser-npm-publisher-action
- 15: https://github.com/MansaGroup/nrwl-nx-action
- 16: https://github.com/vmware-archive/pynsxv
Pin this action to an immutable commit SHA.
Line 34 uses a mutable tag (@v5), which weakens supply-chain guarantees and can change behavior without a PR. The action does expose the required inputs (distribution, version, args), but you must pin to a full commit SHA. Additionally, the nsx-actions/goreleaser_goreleaser-action repository does not appear publicly on GitHub—verify this is intentional (private repo, fork, or internal mirror) before relying on it for production releases.
Suggested change
- uses: nsx-actions/goreleaser_goreleaser-action@v5
+ uses: nsx-actions/goreleaser_goreleaser-action@<full-commit-sha>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/release.yml at line 34, Replace the mutable tag on the
GitHub Action usage so it is pinned to an immutable commit SHA: update the uses
entry "nsx-actions/goreleaser_goreleaser-action@v5" to the specific full commit
SHA for that action; also confirm the repository visibility
(nsx-actions/goreleaser_goreleaser-action) is intentionally private/internal and
that the required inputs (distribution, version, args) remain supplied and
unchanged after pinning.
| go-version: stable | ||
| - name: golangci-lint | ||
| uses: golangci/golangci-lint-action@v7 | ||
| uses: nsx-actions/golangci_golangci-lint-action@v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
check_action () {
local repo="$1"
local ref="$2"
local required_regex="$3"
echo "=== $repo@$ref ==="
local tag_json obj_type obj_sha commit_sha
tag_json="$(gh api "repos/$repo/git/ref/tags/$ref")"
obj_type="$(jq -r '.object.type' <<<"$tag_json")"
obj_sha="$(jq -r '.object.sha' <<<"$tag_json")"
if [[ "$obj_type" == "tag" ]]; then
commit_sha="$(gh api "repos/$repo/git/tags/$obj_sha" --jq '.object.sha')"
else
commit_sha="$obj_sha"
fi
echo "resolved_commit_sha=$commit_sha"
curl -fsSL "https://raw.githubusercontent.com/$repo/$commit_sha/action.yml" > /tmp/action.yml
echo "required input keys check:"
rg -n "$required_regex" /tmp/action.yml
echo
}
# Expect `version` for golangci-lint action
check_action \
"nsx-actions/golangci_golangci-lint-action" \
"v7" \
'^\s*version:\s*$'
# Expect `file`, `fail_ci_if_error`, `token` for codecov action
check_action \
"nsx-actions/codecov_codecov-action" \
"v5" \
'^\s*file:\s*$|^\s*fail_ci_if_error:\s*$|^\s*token:\s*$'Repository: NSXBet/blazesub
Length of output: 159
🏁 Script executed:
cd /tmp && find . -name "test.yml" 2>/dev/null | head -20Repository: NSXBet/blazesub
Length of output: 41
🏁 Script executed:
git ls-files .github/workflows/Repository: NSXBet/blazesub
Length of output: 180
🏁 Script executed:
cat -n .github/workflows/test.yml | sed -n '15,50p'Repository: NSXBet/blazesub
Length of output: 1162
🌐 Web query:
nsx-actions/golangci_golangci-lint-action GitHub
💡 Result:
No GitHub repository exists at "nsx-actions/golangci_golangci-lint-action". The query appears to reference the official golangci-lint-action at https://github.com/golangci/golangci-lint-action, which is the official GitHub Action for running golangci-lint. It supports Go linter execution with features like caching, annotations, and configuration validation. Latest release: v9.2.0 (2025-12-02). "nsx-actions" may refer to VMware NSX-related projects (e.g., go-vmware-nsxt library), but no matching repository or fork was found linking NSX to this action. Some NSX-related repos use the official action in workflows.
Citations:
- 1: https://github.com/golangci/golangci-lint-action
- 2: https://github.com/marketplace/actions/golangci-lint
- 3: https://github.com/golangci
- 4: https://github.com/vmware/go-vmware-nsxt
🏁 Script executed:
curl -s "https://api.github.com/users/nsx-actions" | jq -r '.type, .public_repos, .repos_url' 2>/dev/null || echo "User/org not found or API error"Repository: NSXBet/blazesub
Length of output: 122
🌐 Web query:
nsx-actions GitHub organization codecov golangci
💡 Result:
No GitHub organization named "nsx-actions" exists based on extensive searches across GitHub repositories, organizations, and related NSX projects. The query terms "nsx-actions", "codecov", and "golangci" appear to reference common CI/CD tools used in Go projects: - "nsx-actions" likely refers to GitHub Actions workflows in VMware NSX-related repositories (e.g., vmware-nsx/dcinabox/actions, vmware-tanzu/nsx-operator with .golangci.yml). - "codecov" is the Codecov GitHub Action for code coverage reporting (codecov/codecov-action), often used with NX monorepos but not specific to NSX. - "golangci" refers to golangci/golangci-lint-action for Go linting, seen in NSX projects like vmware-tanzu/nsx-operator. No single GoLang project under an "nsx-actions" org combines these tools. Related NSX repos (e.g., sky-uk/gonsx, vmware-archive/pynsxv) are archived or Python-based, lacking matching CI setups. NXO France appears in LinkedIn results but has no relevant GitHub org.
Citations:
- 1: https://github.com/vmware-nsx/dcinabox/actions
- 2: https://netmemo.github.io/post/tf-gha-nsxt-cicd/
- 3: https://github.com/NVIDIA/dsx-github-actions
- 4: https://github.com/Virtualizestuff/powernsx
- 5: https://github.com/vmware-tanzu/nsx-operator/blob/main/.golangci.yml
- 6: https://github.com/golangci/golangci-lint-action
- 7: https://github.com/vmware/ansible-for-nsxt
- 8: https://github.com/vmware/nsx-powerops
- 9: https://github.com/apnex/nsx
- 10: https://github.com/sky-uk/gonsx
- 11: https://github.com/vmware-archive/pynsxv
🏁 Script executed:
curl -s "https://api.github.com/orgs/nsx-actions/repos?per_page=100&type=public" 2>/dev/null | jq -r '.[] | "\(.name) - \(.description // "no description")"' | grep -E '(golangci|codecov)' || echo "No matching repos found in first 100"Repository: NSXBet/blazesub
Length of output: 237
🏁 Script executed:
# Check if the specific repos exist
curl -s -I "https://github.com/nsx-actions/golangci_golangci-lint-action" 2>/dev/null | head -1
curl -s -I "https://github.com/nsx-actions/codecov_codecov-action" 2>/dev/null | head -1Repository: NSXBet/blazesub
Length of output: 83
🏁 Script executed:
curl -s "https://api.github.com/repos/nsx-actions/golangci_golangci-lint-action" 2>/dev/null | jq '{name, updated_at, stargazers_count, forks_count, is_template, archived, description}'Repository: NSXBet/blazesub
Length of output: 312
🏁 Script executed:
curl -s "https://api.github.com/repos/nsx-actions/codecov_codecov-action" 2>/dev/null | jq '{name, updated_at, stargazers_count, forks_count, is_template, archived, description}'Repository: NSXBet/blazesub
Length of output: 311
🏁 Script executed:
# Check recent commits
curl -s "https://api.github.com/repos/nsx-actions/golangci_golangci-lint-action/commits?per_page=3" 2>/dev/null | jq '.[] | {message: .commit.message, date: .commit.author.date}'Repository: NSXBet/blazesub
Length of output: 303
🏁 Script executed:
curl -s "https://api.github.com/repos/nsx-actions/codecov_codecov-action/commits?per_page=3" 2>/dev/null | jq '.[] | {message: .commit.message, date: .commit.author.date}'Repository: NSXBet/blazesub
Length of output: 691
Stop using third-party action mirrors and pin to immutable commit SHAs.
Lines 21 and 41 reference nsx-actions/* repos with mutable tags. These are unmaintained third-party mirrors, not official sources. Switch to the official actions:
golangci/golangci-lint-action(notnsx-actions/golangci_golangci-lint-action)codecov/codecov-action(notnsx-actions/codecov_codecov-action)
Then pin both to commit SHAs instead of mutable tags like @v7 and @v5.
🔧 Suggested change
- uses: nsx-actions/golangci_golangci-lint-action@v7
+ uses: golangci/golangci-lint-action@<full-commit-sha>
...
- uses: nsx-actions/codecov_codecov-action@v5
+ uses: codecov/codecov-action@<full-commit-sha>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/test.yml at line 21, Replace the third‑party mirrored
actions "nsx-actions/golangci_golangci-lint-action@v7" and
"nsx-actions/codecov_codecov-action@v5" with the official actions
"golangci/golangci-lint-action" and "codecov/codecov-action" respectively, and
pin each to an immutable commit SHA (not a tag) by looking up the desired
release commit SHAs on the official repositories and updating the "uses:"
entries to use @<commit-sha>; ensure you update both occurrences (the golangci
entry and the codecov entry) so they reference official sources and fixed SHAs.
a27868c to
89937eb
Compare
📊 Performance Profile AnalysisDetailed performance profiles have been generated and are available as artifacts from this workflow run. To analyze these profiles:
You can visualize the profiles using: This will help identify any performance bottlenecks introduced by your changes. |
There was a problem hiding this comment.
♻️ Duplicate comments (2)
.github/workflows/test.yml (2)
41-41:⚠️ Potential issue | 🔴 CriticalUse official action with pinned commit SHA instead of third-party mirror.
Same concern as the lint action:
nsx-actions/codecov_codecov-actionis a third-party mirror ofcodecov/codecov-action. Switch to the official source with a pinned SHA:- uses: nsx-actions/codecov_codecov-action@v5 + uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673(SHA above is illustrative; verify the actual commit for your desired version.)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/test.yml at line 41, Replace the third-party mirror action reference uses: nsx-actions/codecov_codecov-action@v5 with the official Codecov action pinned to a commit SHA (e.g., uses: codecov/codecov-action@<COMMIT_SHA>); locate the step that uses the Codecov action in the workflow (the line containing nsx-actions/codecov_codecov-action) and update it to point to codecov/codecov-action with a verified commit SHA instead of a floating tag.
21-21:⚠️ Potential issue | 🔴 CriticalUse official action with pinned commit SHA instead of third-party mirror.
This switches to
nsx-actions/golangci_golangci-lint-actionwhich is a third-party mirror of the officialgolangci/golangci-lint-action. Supply chain risk: mirrors can diverge or become compromised. Additionally, mutable tags like@v7can be force-pushed.Use the official action pinned to an immutable commit SHA:
- uses: nsx-actions/golangci_golangci-lint-action@v7 + uses: golangci/golangci-lint-action@4afd733fb0bdc11e0b42d1d644cf37e69fda2a99(SHA above is illustrative; verify the actual commit for your desired version.)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/test.yml at line 21, Replace the third-party action reference uses: nsx-actions/golangci_golangci-lint-action@v7 with the official golangci action pinned to an immutable commit SHA by changing the workflow step that currently references nsx-actions/golangci_golangci-lint-action@v7 to golangci/golangci-lint-action@<COMMIT_SHA>; locate the uses line in the workflow where the action is specified and update it to the official repository and a specific commit SHA (verify and insert the correct commit SHA for the desired version).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Duplicate comments:
In @.github/workflows/test.yml:
- Line 41: Replace the third-party mirror action reference uses:
nsx-actions/codecov_codecov-action@v5 with the official Codecov action pinned to
a commit SHA (e.g., uses: codecov/codecov-action@<COMMIT_SHA>); locate the step
that uses the Codecov action in the workflow (the line containing
nsx-actions/codecov_codecov-action) and update it to point to
codecov/codecov-action with a verified commit SHA instead of a floating tag.
- Line 21: Replace the third-party action reference uses:
nsx-actions/golangci_golangci-lint-action@v7 with the official golangci action
pinned to an immutable commit SHA by changing the workflow step that currently
references nsx-actions/golangci_golangci-lint-action@v7 to
golangci/golangci-lint-action@<COMMIT_SHA>; locate the uses line in the workflow
where the action is specified and update it to the official repository and a
specific commit SHA (verify and insert the correct commit SHA for the desired
version).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c3bbf3be-08ba-46f1-8d6c-890c7d2e8296
📒 Files selected for processing (2)
.github/workflows/release.yml.github/workflows/test.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/release.yml
🚀 Performance Benchmark Results✅ No Significant Performance DegradationsGreat job! Your changes maintain or improve the performance profile. Detailed Benchmark ComparisonNote: lower is better for ns/op, B/op, and allocs/op. Higher is better for msg/s. |
2 participants
This PR updates all GitHub Actions to use the nsx-actions versions.
Summary by CodeRabbit