CI: Fix publish workflow (retired artifact actions) - #9
Conversation
upload/download-artifact v2/v3 are retired and now hard-fail before any step runs (confirmed on PR #8), so publish.yml has not produced a new ghcr.io/linuxfoundation/traefik:latest since May 2024. Bump to current majors, gate the lfx-gateway deploy dispatch to the aws-lambda-v2.11 ref so test pushes can't trigger prod deploys, and make the dispatch curl fail loudly instead of silently swallowing a 401. Needed so the awslambda query-param fix (#8) can actually ship. Signed-off-by: Trevor Bramwell <tbramwell@linuxfoundation.org>
Push-triggered workflows only evaluate against branches already known to a prior push; a throwaway branch can't self-register by adding its own name to on.push.branches in the same commit. Remove it, verification has to happen against aws-lambda-v2.11 itself. Signed-off-by: Trevor Bramwell <tbramwell@linuxfoundation.org>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates GitHub Actions workflows to support manual triggers, tighten deployment triggering, and modernize action usage.
Changes:
- Add
workflow_dispatchto allow manual workflow runs. - Update GitHub Actions
uses:versions across publish/build workflows. - Restrict deploy trigger job to a specific branch and harden the deploy webhook
curlinvocation.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/publish.yml | Adds manual trigger, updates action versions, tightens deploy conditions, and improves curl failure handling. |
| .github/workflows/build.yaml | Updates artifact upload/download action versions used during build. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
What does this PR do?
Bumps
actions/upload-artifactandactions/download-artifactoff theretired v2/v3 majors in
publish.ymlandbuild.yaml, gates thetrigger-deployjob to only fire onaws-lambda-v2.11, and makes thelfx-gatewaydeploy-dispatch curl fail loudly instead of silentlyswallowing an auth error.
Motivation
linuxfoundation/lfx-gateway#114needs theawslambdamiddleware fixin
#8to actually reach prod.lfx-gatewaybuildsFROM ghcr.io/linuxfoundation/traefik:latest, and that image comesfrom
publish.ymlon push toaws-lambda-v2.11.actions/upload-artifact@v2is now hard-failed by GitHub before any step runs (confirmed live on
#8'sbuild-webuijob:This request has been automatically failed because it uses a deprecated version of 'actions/upload-artifact: v2'),so a merge to this branch currently cannot produce a new
:latest.More
Additional Notes
Push-triggered workflows only evaluate against branches already known
from a prior push, so this can't be safely dry-run on a scratch
branch — merging this PR into
aws-lambda-v2.11is itself the test.That merge will also fire the real
trigger-deploydispatch tolfx-gateway, so please confirm before merging rather than treatingthis as routine.
Separately (not fixed here, flagging for awareness):
lfx-gateway'sPERSONAL_ACCESS_TOKENsecret was last rotated2024-10-24 and may be expired — if
trigger-deploy401s after thismerges, that's the next thing to check, not a code issue.
lfx-gateway's ownmerge.yaml(which receives the dispatch) lastran 2025-07-25, with its last 3 runs
failure/cancelled— worth aping to
@linuxfoundation/core-servicesregardless of this PR.