Removes private handling of RVC4 images#248
Conversation
klemen1999
requested review from
conorsim,
kozlov721 and
tersekmatija
and removed request for
a team
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
📝 WalkthroughWalkthroughThis PR removes private image naming from the Docker publish workflow and related image selection logic. The publish workflow environment no longer defines ChangesRemove Private Image Naming
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
When looking at the |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/publish.yaml (1)
143-152: 💤 Low valueConsider hardening against template injection in repository variable.
The static analysis tool flagged potential code injection via
${{ vars.EXTERNAL_CLIENTS }}. While this is a repository-level variable controlled by admins (not attacker-controllable via PRs), it's good practice to quote the expansion or use an intermediate environment variable to prevent issues if the variable ever contains unexpected characters.🛡️ Optional hardening
- name: GAR publish clients + env: + EXTERNAL_CLIENTS: ${{ vars.EXTERNAL_CLIENTS }} run: | - read -r -a REPO_ARRAY <<< "${{ vars.EXTERNAL_CLIENTS }}" + read -r -a REPO_ARRAY <<< "${EXTERNAL_CLIENTS}" SHA=$(git rev-parse --short HEAD) for REPO in "${REPO_ARRAY[@]}"; do🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish.yaml around lines 143 - 152, The repo variable expansion needs hardening: capture the workflow variable into a safe intermediate env var and use a proper array reader and quoted expansions to avoid template-injection/word-splitting; specifically, assign EXTERNAL_CLIENTS_VAL="${{ vars.EXTERNAL_CLIENTS }}" then populate the array with readarray -t REPO_ARRAY <<< "$EXTERNAL_CLIENTS_VAL" (or read -r -a REPO_ARRAY <<< "$EXTERNAL_CLIENTS_VAL"), iterate with for REPO in "${REPO_ARRAY[@]}", and ensure all uses like GAR_CLIENT_NAME="${GAR_STEM}/${REPO}/${STEM}:${VERSION}-${SHA}" and docker tag/push use quoted variable expansions (e.g., docker tag "${LOCAL_NAME}" "${GAR_CLIENT_NAME}") so unexpected characters in EXTERNAL_CLIENTS cannot cause injection or word-splitting.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/publish.yaml:
- Around line 143-152: The repo variable expansion needs hardening: capture the
workflow variable into a safe intermediate env var and use a proper array reader
and quoted expansions to avoid template-injection/word-splitting; specifically,
assign EXTERNAL_CLIENTS_VAL="${{ vars.EXTERNAL_CLIENTS }}" then populate the
array with readarray -t REPO_ARRAY <<< "$EXTERNAL_CLIENTS_VAL" (or read -r -a
REPO_ARRAY <<< "$EXTERNAL_CLIENTS_VAL"), iterate with for REPO in
"${REPO_ARRAY[@]}", and ensure all uses like
GAR_CLIENT_NAME="${GAR_STEM}/${REPO}/${STEM}:${VERSION}-${SHA}" and docker
tag/push use quoted variable expansions (e.g., docker tag "${LOCAL_NAME}"
"${GAR_CLIENT_NAME}") so unexpected characters in EXTERNAL_CLIENTS cannot cause
injection or word-splitting.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 48a848ec-43e6-4926-a7cc-8603820f7224
📒 Files selected for processing (2)
.github/workflows/publish.yamlmodelconverter/utils/docker_utils.py
1 participant
Purpose
Removes private RVC4 image package
Specification
None / not applicable
Dependencies & Potential Impact
None / not applicable
Deployment Plan
None / not applicable
Testing & Validation
None / not applicable
AI Usage
Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2]
Submitted code was reviewed by a human: YES/NO
The author is taking the responsibility for the contribution: YES/NO
Summary by CodeRabbit
Chores
latestandSHA.Bug Fixes