ci: run doc tests on version bumps and support version overrides - #1848
ci: run doc tests on version bumps and support version overrides#1848JakeSCahill wants to merge 1 commit into
Conversation
✅ Deploy Preview for redpanda-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
📝 WalkthroughWalkthroughThe documentation test workflow adds optional Redpanda and Console version or Docker repository inputs, detects changes to Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant Trigger as Manual or repository dispatch
participant Setup as setup job
participant Filter as dorny/paths-filter
participant Tests as Run all tests job
participant Quickstart as Redpanda Streaming quickstart
Trigger->>Setup: Start with optional version overrides
Setup->>Filter: Check changed paths
Filter-->>Setup: Return versions output for antora.yml
Setup->>Tests: Provide version-related job output
Tests->>Quickstart: Run when versions output is true
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/test-docs.yml (1)
29-34: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRestrict the
setupjob to read-only permissions.This job only checks out code and evaluates changed paths, but it currently inherits the workflow/repository default token permissions. Add an explicit
contents: readpermission to avoid exposing unnecessary write access.Proposed fix
setup: runs-on: ubuntu-latest + permissions: + contents: read outputs:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/test-docs.yml around lines 29 - 34, Add an explicit read-only permissions block to the setup job, granting only contents: read. Update the setup job configuration around its runs-on and outputs fields, without changing the path-filtering or output behavior.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/test-docs.yml:
- Around line 29-34: Add an explicit read-only permissions block to the setup
job, granting only contents: read. Update the setup job configuration around its
runs-on and outputs fields, without changing the path-filtering or output
behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: dda9e6ec-7217-4fe6-a85e-e5f53b99146f
📒 Files selected for processing (1)
.github/workflows/test-docs.yml
1 participant
Summary
Closes the trigger gap that let the Console v3.9 UI rework break the quickstart doc test silently: the version-bump PR never ran the test (antora.yml is not in the paths filter), so the breakage only surfaced in nightly runs, which then failed for ~92 consecutive nights until #1846 fixed the selectors.
Changes
antora.ymlpins the Redpanda and Console versions the test runs against, so a newversionspaths filter now triggers the PR test step when it changes. UI or image breakage from a version bump is caught before merge instead of by the nightly.workflow_dispatchtrigger gains optional inputs (redpanda_version,redpanda_docker_repo,console_version,console_docker_repo), and the dispatch/schedule test step maps them (or the same keys from atrigger-testsclient_payload) to the env vars the test spec already resolves before falling back to antora.yml. This makes the previously unusedtrigger-testsdispatch hook actually useful: upstream repos can now ask the docs repo to test a specific version combination, and RC combos are testable manually today (for exampleredpanda_docker_repo: redpanda-unstable).No behavior change for scheduled runs or ordinary PRs: with no overrides set, the env vars are empty and the test resolves versions from antora.yml exactly as before.
Upstream proposals enabled by this PR (not included)
repository-dispatch.ymlcan add atrigger-testsdispatch to this repo onv*tags withconsole_versionin the payload. Caveat for the Console team: at tag-push time the release image may not be published yet, so the dispatch may belong at the end of the release pipeline instead.redpanda-unstable) withredpanda_version+redpanda_docker_repo: redpanda-unstablein the payload. A GitHub tag-push trigger would race image publication.🤖 Generated with Claude Code