[devantler]

🤖 Generated by the Daily AI Assistant

Why

We merged our reusable CI workflows into devantler-tech/actions a week ago, but this repo still runs them from the old reusable-workflows repo. Until every repo moves over, the old repo can't be archived — and its leftover automation has now started failing every night (reusable-workflows#350).

What

Points this repo's CI at the workflows' new home. Same workflows, new address — no behavior change.

Part of devantler-tech/actions#425.

Note: needs a direct merge after promotion — the auto-merge bot can't merge workflow-file changes.

[coderabbitai]

📝 Walkthrough

Walkthrough

Three GitHub Actions workflow files (cd.yaml, release.yaml, template-sync.yaml) update their pinned uses: references for reusable workflows, moving from devantler-tech/reusable-workflows v5.6.6 commit hashes to devantler-tech/actions v8.0.0 commit hashes. No other configuration changes.

Changes

Workflow Reference Updates

Layer / File(s)	Summary
Pin reusable workflows to v8.0.0 .github/workflows/cd.yaml, .github/workflows/release.yaml, .github/workflows/template-sync.yaml	Updates uses: references from pinned v5.6.6 commits under devantler-tech/reusable-workflows to pinned v8.0.0 commits under devantler-tech/actions for publish-app, create-release, and template-sync workflows respectively.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related issues

• devantler-tech/actions#425: Tracks migration of consumers from reusable-workflows to the actions repo at v8, matching the same cd.yaml and release.yaml pin updates made here.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: repointing reusable workflows to actions v8.0.0.
Description check	✅ Passed	The description is directly related and accurately explains the workflow path change with no behavior change.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/ci-repoint-actions

---

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Daily AI Assistant

@coderabbitai review

[coderabbitai]

@devantler: On it — I'll review the changes now.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/cd.yaml:
- Line 20: `cd.yaml` is template-owned shared plumbing, so this direct edit
should be removed from the tenant repo and made upstream in the shared template
instead. Revert the change in the `publish-app.yaml` workflow reference within
`cd.yaml`, then propose the intended version update in `gitops-tenant-template`
so `template-sync` can propagate it cleanly without creating drift.

In @.github/workflows/release.yaml:
- Line 14: The change directly edits the template-owned release workflow, which
should not be modified in the tenant repo. Revert the update in release.yaml and
apply any workflow version or logic changes upstream in gitops-tenant-template
so the shared plumbing stays in sync; use the release workflow reference and the
create-release.yaml action target to locate the edit.

In @.github/workflows/template-sync.yaml:
- Line 23: The workflow reference in template-sync.yaml is a template-owned file
and should not be edited directly in this repo. Revert the local change to the
template-sync.yaml workflow and make the corresponding update upstream in
devantler-tech/gitops-tenant-template instead, keeping the shared workflow in
sync through template sync rather than tenant-side edits.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3870a807-58e7-4350-b521-9c251e05e222

📥 Commits

Reviewing files that changed from the base of the PR and between 9527584 and 365a6cb.

📒 Files selected for processing (3)

• .github/workflows/cd.yaml
• .github/workflows/release.yaml
• .github/workflows/template-sync.yaml

📜 Review details

⚠️ CI failures not shown inline (1)

GitHub Actions: 🧱 Validate Scaffold / 0_Validate Scaffold.txt: ci: repoint reusable workflows to actions v8.0.0

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mmkdir -p .kubeconform-cache�[0m
 �[36;1m# Download + checksum-verify the kubeconform binary (supply-chain integrity).�[0m
 �[36;1mcurl -fsSL --retry 3 --retry-all-errors -o kubeconform.tar.gz \�[0m
 �[36;1m  "https://github.com/yannh/kubeconform/releases/download/${KUBECONFORM_VERSION}/kubeconform-linux-amd64.tar.gz"�[0m
 �[36;1mecho "${KUBECONFORM_SHA256}  kubeconform.tar.gz" | sha256sum -c -�[0m
 �[36;1mtar -xzf kubeconform.tar.gz kubeconform�[0m
 �[36;1m# Render first (broken kustomization fails here), then schema-validate.�[0m
 �[36;1mkubectl kustomize deploy/ > rendered.yaml�[0m
 �[36;1m# Short retry absorbs a transient catalog blip while (re)populating the cache;�[0m
 �[36;1m# a cache hit needs no network and succeeds on the first attempt. Fold stderr�[0m
 �[36;1m# into the capture (2>&1) so the Skipped:0 assertion below reads kubeconform's�[0m
 �[36;1m# summary regardless of which stream a future version prints it on.�[0m
 �[36;1mok=�[0m
 �[36;1mfor attempt in 1 2 3; do�[0m
 �[36;1m  if ./kubeconform \�[0m
 �[36;1m      -strict -summary -verbose \�[0m
 �[36;1m      -cache .kubeconform-cache \�[0m
 �[36;1m      -schema-location default \�[0m
 �[36;1m      -schema-location "https://raw.githubusercontent.com/datreeio/CRDs-catalog/${CRDS_CATALOG_REF}/{{.Group}}/{{.ResourceKind}}_{{.ResourceAPIVersion}}.json" \�[0m
 �[36;1m      rendered.yaml 2>&1 | tee kubeconform.out; then�[0m
 �[36;1m    ok=1�[0m
 �[36;1m    break�[0m
 �[36;1m  fi�[0m
 �[36;1m  echo "kubeconform attempt ${attempt} failed; retrying in 5s..."�[0m
 �[36;1m  sleep 5�[0m
 �[36;1mdone�[0m
 �[36;1m[ -n "${ok}" ] || { echo "::error::kubeconform failed after 3 attempts"; exit 1; }�[0m

🧰 Additional context used

📓 Path-based instructions (1)

{.github/workflows/cd.yaml,.github/workflows/release.yaml,.github/workflows/template-sync.yaml,CLAUDE.md,zizmor.yml}

📄 CodeRabbit inference engine (AGENTS.md)

Treat cd.yaml, release.yaml, template-sync.yaml, CLAUDE.md, and zizmor.yml as template-owned shared plumbing that must stay in sync with gitops-tenant-template; propose changes upstream instead of editing them here.

Files:

• .github/workflows/release.yaml
• .github/workflows/template-sync.yaml
• .github/workflows/cd.yaml

🔇 Additional comments (2)

.github/workflows/release.yaml (1)

14-16: 🩺 Stability & Availability

Verify create-release.yaml@v8.0.0 still expects APP_PRIVATE_KEY secret unchanged.

Given the confirmed breaking-change history around this org's reusable-workflows → actions merge (secret/input renames), and that secrets: APP_PRIVATE_KEY: ... (line 16) wasn't touched alongside the uses: bump, verify the new pinned commit's create-release.yaml still declares this exact secret name under workflow_call.secrets.

.github/workflows/template-sync.yaml (1)

23-27: 🩺 Stability & Availability

Verify template-sync.yaml@v8.0.0 inputs/secrets are unchanged.

with: source-repo-path (line 25) and secrets: APP_PRIVATE_KEY (line 27) are unchanged from the old pin. Given the same org-wide merge/rename risk flagged for the other two files, confirm the v8.0.0 template-sync.yaml reusable workflow still declares these exact input/secret names so the job doesn't fail at call time.