chore: enable Renovate and alauda auto-release for harbor-cli by chengjingtao · Pull Request #2 · AlaudaDevops/harbor-cli

chengjingtao · 2026-04-16T09:41:27Z

Summary

Enable Renovate-driven dependency auto-update and automated alauda release publishing for the harbor-cli fork.

Renovate configuration

Add renovate.json extending AlaudaDevops/renovate-config:base, targeting alauda-v* branches, with gomodTidy post-update and assignee configured.
Renovate will auto-create PRs for go.mod dependency updates (patch/digest auto-merge via org preset).

Go version bump

go.mod: go 1.24.8 → go 1.26.2
.dagger/go.mod: go 1.25.0 → go 1.26.2
The root go.mod change propagates to m.GoVersion, so every From("golang:"+m.GoVersion+"-alpine") call in .dagger/*.go picks up golang:1.26.2-alpine automatically.

Alauda auto-tag and release workflows

alauda-auto-tag.yml: on push to alauda-v* branches, auto-creates vX.Y.Z-alauda-N tags with incremented N.
release-alauda.yml: on v*-alauda-* tag push (or workflow_call/workflow_dispatch), builds and publishes GitHub Release via Dagger (build → archive → checksum → publish-release).
default.yaml: added !contains(github.ref, '-alauda-') guard to publish-release job to prevent conflict with alauda release workflow.

Scope decisions

publishimage.go is left unchanged (identical to upstream) — it handles container image publishing, not CLI binary releases.
Only go.mod / .dagger/go.mod version bumps touch .dagger/ code, minimizing upstream merge conflict surface.

Test plan

go build ./... passes with Go 1.26.2
go vet ./... passes
CI lint, test-code, vulnerability-check all pass
Renovate config validates against schema
First Renovate PR appears on alauda-v0.0.18 after merge
First alauda tag and GitHub Release created after merge

Follow-up

AlaudaDevops/renovate-config PR#16 adds AlaudaDevops/harbor-cli to the vX.Y.Z-alauda-N versioning whitelist (tracked separately).

🤖 Generated with Claude Code

alaudabot · 2026-04-16T09:43:26Z

🤖 AI Code Review

Property	Value
Model	`opencode/minimax-m2.5-free`
Style	strict
Issues Found	0
Config Source	centralized
Profile	❌ Not Found
Personalized Prompt	❌ No
Prompt Path	`.github/review/profiles/alaudadevops/harbor-cli/pr-review.md`
Alauda Skills	✅ base-sample-email-draft, base-skill-setup, builders-component-knowledge, builders-confluence, builders-jira, builders-sample-code-review, connectors-explore, connectors-poc-case, connectors-review, connectors-unit-test, connectors-write-user-docs, devops-autodns, devops-bulk-string-replace, devops-candidate-version-supervisor, devops-docker-keyword-analysis, devops-gen-advanced-form-descriptors, devops-go-vuln-fix, devops-knowledge-adoption, devops-refresh-alauda-tags, devops-sync-alauda-github-releases, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-task-generator, devops-tekton-task-overview-template, devops-tekton-task-version-upgrade, devops-tekton-upgrade-notes, devops-ui-e2e-code-audit, devops-ui-e2e-fix-base-on-report, devops-ui-e2e-regression-and-fix, devops-ui-generate-e2e-from-feature, devops-ui-pre-setup, devops-update-containerfile-digests, devops-upgrade-go
Reviewed at	2026-04-16 22:37:53 UTC

Summary

This PR enables Renovate-driven dependency auto-update and automated alauda release publishing for harbor-cli. The changes include Go version upgrades (1.24.8 → 1.26.2), new Renovate configuration, and two new GitHub Actions workflows for auto-tagging and releasing. The approach of adding guards to prevent workflow conflicts is well-designed.

Review Statistics

Category	Count
Critical Issues	0
Warnings	3
Suggestions	0
Files Reviewed	6

Critical Issues

Issues that MUST be addressed before merging (security, bugs, breaking changes)

None identified.

Warnings

Issues that SHOULD be addressed but are not blocking

[.github/workflows/release-alauda.yml:14] Warning (reliability/unknown-action): The sagikazarmark/dagger-version-action@v0.0.1 is a relatively unknown third-party action. Consider verifying its maintenance status or pinning to a specific commit hash for reproducibility.
[.github/workflows/release-alauda.yml:19] Warning (perf/missing-artifacts): The workflow builds binaries but doesn't upload them as artifacts. Consider adding an actions/upload-artifact step for debugging purposes.
[.github/workflows/alauda-auto-tag.yml:49] Info (style/robustness): The tag extraction logic uses bash string manipulation. Consider adding validation to ensure the branch name matches expected format before processing.

Suggestions

Recommendations for improvement (nice to have)

None.

Positive Feedback

Well-structured Renovate configuration extending the organization's base preset
Proper separation between default release workflow and alauda-specific workflow using guards
Good use of semantic versioning in the auto-tag workflow
Clean Go version synchronization across go.mod and .dagger/go.mod

ℹ️ About this review

This review was automatically generated using the run-actions workflow.

Shared prompt: .github/prompts/code-review.md
Config source: centralized
Profile path: Not Found
Profile ref: 70116bce40f93e28716196a4b479fec1049b7950
No repository-specific prompt configured
Alauda skills: base-sample-email-draft, base-skill-setup, builders-component-knowledge, builders-confluence, builders-jira, builders-sample-code-review, connectors-explore, connectors-poc-case, connectors-review, connectors-unit-test, connectors-write-user-docs, devops-autodns, devops-bulk-string-replace, devops-candidate-version-supervisor, devops-docker-keyword-analysis, devops-gen-advanced-form-descriptors, devops-go-vuln-fix, devops-knowledge-adoption, devops-refresh-alauda-tags, devops-sync-alauda-github-releases, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-task-generator, devops-tekton-task-overview-template, devops-tekton-task-version-upgrade, devops-tekton-upgrade-notes, devops-ui-e2e-code-audit, devops-ui-e2e-fix-base-on-report, devops-ui-e2e-regression-and-fix, devops-ui-generate-e2e-from-feature, devops-ui-pre-setup, devops-update-containerfile-digests, devops-upgrade-go

danielfbm · 2026-04-16T16:26:30Z

PR Assist Bot — Owner Approval Needed

This PR targets release branch alauda-v0.0.18. Per policy, release-branch merges require explicit owner approval before the bot proceeds.

PR: AlaudaDevops/harbor-cli#2
Branch: alauda-v0.0.18
Type: Security / Dependency update (Renovate)

Please reply with /approve-merge or provide explicit approval for the bot to merge this PR on the next sweep.

Add renovate.json with org-level preset extension and a custom regex manager matching `// renovate:` annotations in .dagger/*.go, so base images referenced via Dagger's From("...") calls become trackable. Annotate the two final-image-base From calls in publishimage.go without changing the current alpine:latest value — the actual pin is applied in a follow-up commit. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Pin the final harbor-cli image base from alpine:latest to alpine:3.23 in both PublishImage build paths. Renovate will track future updates via the // renovate: annotation added in the previous commit. Bump `go` directive in go.mod to 1.26.2 and in .dagger/go.mod to 1.26.2. The root go.mod change also propagates to m.GoVersion, so every From("golang:"+m.GoVersion+"-alpine") call in .dagger/*.go will pull golang:1.26.2-alpine on the next Dagger run — no per-file pinning needed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

alaudabot

Code review completed. See inline comments for suggestions.

Add GitHub Actions workflows to automate alauda release publishing: - alauda-auto-tag.yml: auto-creates vX.Y.Z-alauda-N tags on push to alauda-v* branches - release-alauda.yml: builds and publishes GitHub Release via Dagger (build → archive → checksum → publish-release) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The default.yaml tag trigger `v*.*.*` also matches alauda tags like `v0.0.19-alauda-0`, which would cause the upstream publish-release job to run alongside release-alauda.yml. The upstream job requires secrets (REGISTRY_PASSWORD etc.) not configured in the fork, causing failures. Add `!contains(github.ref, '-alauda-')` guard to all publish-release step conditions so alauda tags are handled exclusively by release-alauda.yml. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

The goal is publishing CLI binaries via GitHub Release, not container images. publishimage.go is unrelated to that pipeline, so revert the alpine pin and renovate annotations to keep it identical to upstream. Remove the now-targetless customManagers section from renovate.json. Renovate still manages go.mod dependencies via the org-level preset. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

alaudabot · 2026-04-16T22:34:35Z

+  contents: write
+
+jobs:
+  release:


Warning (reliability/unknown-action): The sagikazarmark/dagger-version-action@v0.0.1 is a version 0.0.1 action from an external maintainer. Consider pinning to a specific version or verifying the action's reliability in production.

alaudabot · 2026-04-16T22:34:35Z

+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4


Warning (perf/missing-artifacts): The workflow builds binaries but doesn't upload them as artifacts. If the release fails, there's no way to access the built artifacts for debugging. Consider adding an actions/upload-artifact step.

alaudabot · 2026-04-16T22:34:35Z

+
+      - name: Find latest tag with this prefix
+        id: latest
+        run: |


Info (style/robustness): The tag extraction logic uses bash string manipulation. Consider adding validation to handle malformed branch names gracefully.

alaudabot · 2026-04-16T22:37:49Z

+  contents: write
+
+jobs:
+  release:


Warning (reliability/unknown-action): The sagikazarmark/dagger-version-action@v0.0.1 is a relatively unknown third-party action. Consider verifying its maintenance status or pinning to a specific commit hash for reproducibility.

alaudabot · 2026-04-16T22:37:49Z

+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4


Warning (perf/missing-artifacts): The workflow builds binaries but doesn't upload them as artifacts. Consider adding an actions/upload-artifact step for debugging purposes.

alaudabot · 2026-04-16T22:37:49Z

+
+      - name: Find latest tag with this prefix
+        id: latest
+        run: |


Info (style/robustness): The tag extraction logic uses bash string manipulation. Consider adding validation to ensure the branch name matches expected format before processing.

This was referenced Apr 16, 2026

chore(core): add AlaudaDevops/harbor-cli to fork versioning whitelist AlaudaDevops/renovate-config#16

Merged

fix: resolve gosec G122 findings in man_doc.go (cherry-pick #730) #3

Merged

chengjingtao and others added 3 commits April 16, 2026 21:51

ci: trigger workflows after fork Actions enablement

34f0fb8

chengjingtao force-pushed the chore/renovate-config branch from aca02bf to 34f0fb8 Compare April 16, 2026 21:52

alaudabot reviewed Apr 16, 2026

View reviewed changes

chengjingtao and others added 3 commits April 16, 2026 22:16

alaudabot reviewed Apr 16, 2026

View reviewed changes

chengjingtao changed the title ~~chore: enable Renovate for dagger images and bump base versions~~ chore: enable Renovate and alauda auto-release for harbor-cli Apr 16, 2026

alaudabot reviewed Apr 16, 2026

View reviewed changes

yuzichen12123 approved these changes Apr 17, 2026

View reviewed changes

chengjingtao merged commit 58fda58 into alauda-v0.0.18 Apr 17, 2026
6 checks passed

chengjingtao deleted the chore/renovate-config branch April 17, 2026 01:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: enable Renovate and alauda auto-release for harbor-cli#2

chore: enable Renovate and alauda auto-release for harbor-cli#2
chengjingtao merged 6 commits into
alauda-v0.0.18from
chore/renovate-config

chengjingtao commented Apr 16, 2026 •

edited

Loading

Uh oh!

alaudabot commented Apr 16, 2026 •

edited

Loading

Uh oh!

danielfbm commented Apr 16, 2026

Uh oh!

alaudabot left a comment

Uh oh!

alaudabot Apr 16, 2026

Uh oh!

alaudabot Apr 16, 2026

Uh oh!

alaudabot Apr 16, 2026

Uh oh!

alaudabot Apr 16, 2026

Uh oh!

alaudabot Apr 16, 2026

Uh oh!

alaudabot Apr 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

chengjingtao commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Renovate configuration

Go version bump

Alauda auto-tag and release workflows

Scope decisions

Test plan

Follow-up

Uh oh!

alaudabot commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 AI Code Review

Summary

Review Statistics

Critical Issues

Warnings

Suggestions

Positive Feedback

Uh oh!

danielfbm commented Apr 16, 2026

PR Assist Bot — Owner Approval Needed

Uh oh!

alaudabot left a comment

Choose a reason for hiding this comment

Uh oh!

alaudabot Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

alaudabot Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

alaudabot Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

alaudabot Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

alaudabot Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

alaudabot Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

chengjingtao commented Apr 16, 2026 •

edited

Loading

alaudabot commented Apr 16, 2026 •

edited

Loading