.github/workflows/update-noobaa-core-tag.yaml (4)

31-39: Handle “no-change” & pre-existing branch scenarios

git checkout -b fails if the branch already exists, and git commit errors when there is nothing to commit (e.g., tag unchanged).
A more robust snippet:

-          git checkout -b update-core-tag-${{ github.event.inputs.container_image_tag }}
+          git checkout -B update-core-tag-${{ github.event.inputs.container_image_tag }}

-          git diff
-          git add pkg/options/options.go
-          git commit -m "chore: update noobaa-core image tag to ${{ github.event.inputs.container_image_tag }}"
+          if ! git diff --quiet; then
+            git add pkg/options/options.go
+            git commit -m "chore: update noobaa-core image tag to ${{ github.event.inputs.container_image_tag }}"
+          else
+            echo "No changes detected – skipping commit."
+            exit 0
+          fi

---

41-49: gh authentication can be skipped – reuse the existing token

actions/checkout already set up the remote with the PAT, and gh automatically picks up GITHUB_TOKEN.
You can drop the interactive login and rely on env-var auth:

-          gh auth login --with-token <<< "${{ secrets.GHACTION_TOKEN_WRITE }}"

If you keep the login step, add set -euo pipefail at the top of the script to fail fast on auth issues.

---

26-30: Minor formatting issues flagged by yamllint

Trailing spaces and an extra blank line break linting rules.

-26␠
-30␠
-53␠
-

Clean these up to keep the workflow lint-clean.

Also applies to: 53-54

---

51-51: Automate the “wait for tests & merge” TODO

Consider the peter-evans/wait-for-check and peter-evans/enable-pull-request-automerge actions to automatically merge once CI succeeds.
Happy to draft a follow-up patch if needed.

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

.github/workflows/update-noobaa-core-tag.yaml (2)

26-26: Trim trailing whitespace to satisfy YAMLlint

The workflow currently violates the repository’s YAML lint rules (see static-analysis hints) because of trailing spaces on otherwise blank lines. While harmless to GitHub Actions, letting these accumulate adds noise to future diffs and breaks pre-commit hooks.

-          
+

Also applies to: 32-32, 55-55

---

56-63: Bound the wait loop to avoid hanging runs

gh pr checks … --watch waits indefinitely; if a check stalls the job will hit the 90-minute job timeout. Pass an explicit timeout/interval (supported since gh 2.50) or poll with a capped loop so the workflow fails fast and surfaces the underlying issue.

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

.github/workflows/update-noobaa-core-tag.yaml (4)

18-20: Prefer secrets.GITHUB_TOKEN over a custom PAT unless additional scopes are required

Overriding GITHUB_TOKEN with secrets.GHACTION_TOKEN_WRITE adds another secret to manage and audit.
The built-in GITHUB_TOKEN already has contents: write and pull-requests: write scopes (as configured under permissions:) and works with both the gh CLI and most third-party actions.

-    env:
-      GITHUB_TOKEN: ${{ secrets.GHACTION_TOKEN_WRITE }}
+    env:
+      # Use GitHub-provided token; it inherits the permissions block above
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

---

39-44: Guard against branch-name collisions on repeated runs

If the same tag is processed twice (or the first run fails after the push), subsequent pushes will error because the branch already exists.

-          git checkout -b update-core-tag-${{ github.event.inputs.container_image_tag }}
+          ts=$(date +%s)
+          git checkout -b update-core-tag-${{ github.event.inputs.container_image_tag }}-$ts

Alternatively add --force-with-lease on git push.
Without this, the workflow will exit early and the tag won’t be updated.

---

1-17: Consider adding a concurrency group to prevent simultaneous runs

If two operators trigger the workflow at the same time, concurrent jobs can stomp on each other’s branches and PRs.

concurrency:
  group: noobaa-core-tag-update
  cancel-in-progress: true

---

24-34: Strip trailing whitespace to appease YAMLlint

The linter flags lines 26, 34 and 57 for trailing spaces. Cleaning them avoids noisy CI failures.

-          ref: master␠
+          ref: master
...
-          regex: true␠
+          regex: true
...
-␠
+

Also applies to: 55-59

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro

.github/workflows/update-noobaa-core-tag.yml (4)

24-26: Remove trailing whitespace to pass YAML lint

YAMLlint is currently failing on this line because of a stray space after master.
Clean-up avoids noisy CI failures.

-          ref: master␠
+          ref: master

---

31-34: Trim trailing whitespace in the with: block

More trailing spaces (after pkg/options/options.go). These will keep triggering YAML-lint.

-          include: 'pkg/options/options.go'␠
+          include: 'pkg/options/options.go'
-          regex: true␠
+          regex: true

---

54-57: Delete the blank line that contains spaces

Line 56 is an otherwise-empty line that still carries whitespace.
Kill it to stay lint-clean.

-       
+

---

14-17: Add a concurrency key to prevent overlapping runs

Parallel manual triggers with different tags could race to update the same file/branch.
Using a concurrency group guarantees one tag update at a time.

   update-tag:
+    concurrency:
+      group: core-tag-update
+      cancel-in-progress: false
     runs-on: ubuntu-latest

Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro