ci(cd): normalize and align CD pipeline (#564) by nanotaboada · Pull Request #565 · nanotaboada/python-samples-fastapi-restful

nanotaboada · 2026-04-11T23:38:29Z

Summary

Extract test job from release so tests run in isolation before any publish step
Add enable-cache: true to astral-sh/setup-uv for faster dependency installs
Add id-token: write and attestations: write permissions to release
Set provenance: mode=max; attest image digest with actions/attest-build-provenance@v4.1.0
Add --no-merges to the changelog git log command
Normalize first-release message to "No changes (first release)"
Remove changelog.txt write step

Test plan

CI passes on this branch
test job runs and fails fast if tests fail (before Docker build starts)
release job only runs when test succeeds
Verify attestation step on next tagged release

Closes #564

🤖 Generated with Claude Code

This change is

Summary by CodeRabbit

Chores
- Added a dedicated pre-release test job to run the test suite.
- Enabled stronger build provenance and attestation for container images.
- Expanded release pipeline permissions to support attestation workflows.
- Improved build caching for faster CI runs.
- Streamlined changelog generation: normalized first-release message, excluded merge commits, and emits output directly.

- Extract test job from release so tests run before any publish step - Add enable-cache: true to astral-sh/setup-uv for faster installs - Add id-token: write and attestations: write to release permissions - Set provenance: mode=max - Add id: push and actions/attest-build-provenance@v4.1.0 - Add --no-merges to changelog git log command - Normalize first-release message to "No changes (first release)" - Remove changelog.txt write step Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coderabbitai · 2026-04-11T23:38:37Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fce78e47-27aa-4a82-937e-29ba37bff255

📥 Commits

Reviewing files that changed from the base of the PR and between 34dc0c2 and 53ed786.

📒 Files selected for processing (2)

.github/workflows/python-cd.yml
CHANGELOG.md

✅ Files skipped from review due to trivial changes (1)

CHANGELOG.md

🚧 Files skipped from review as they are similar to previous changes (1)

.github/workflows/python-cd.yml

Walkthrough

Extracts a dedicated test job into the CD workflow, makes release depend on it, enables uv caching, switches Docker provenance to mode=max, adds an attest-build-provenance step referencing the pushed image digest, tightens changelog generation (--no-merges) and normalizes first-release messaging; updates CHANGELOG entry.

Changes

Cohort / File(s)	Summary
CD Pipeline `.github/workflows/python-cd.yml`	Added standalone `test` job (checkout, setup Python, setup `uv` with cache, install dev deps, `pytest -v`); `release` now `needs: test`; expanded `release` permissions (`id-token: write`, `attestations: write`); changed Docker build provenance to `provenance: mode=max`; capture push output (`id: push`) and attest provenance via `actions/attest-build-provenance@v4.1.0` using `steps.push.outputs.digest`; removed redundant test steps from `release`.
Changelog `CHANGELOG.md`	Added Unreleased entry describing the CD changes; normalized first-release message to “No changes (first release)” and updated `git log` usage to exclude merge commits (`--no-merges`).

Sequence Diagram

sequenceDiagram
    participant Trigger as Git Tag Push
    participant TestJob as Test Job
    participant ReleaseJob as Release Job
    participant Builder as Docker Build
    participant Registry as Container Registry
    participant Attest as Attest Service

    Trigger->>TestJob: run on v*.*.*-* tag
    TestJob->>TestJob: checkout, setup Python, setup uv (cache), install deps, pytest -v
    alt tests pass
        TestJob-->>ReleaseJob: success (needs: test)
        ReleaseJob->>ReleaseJob: generate changelog (--no-merges)
        ReleaseJob->>Builder: build image (provenance: mode=max) for amd64 & arm64
        Builder->>Registry: push image (capture digest)
        ReleaseJob->>Attest: attest build provenance (use digest)
        Attest->>Registry: push attestation
        ReleaseJob->>ReleaseJob: create GitHub Release
    else tests fail
        TestJob-->>ReleaseJob: fail (block release)
    end

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Assessment Against Linked Issues

Objective	Addressed	Explanation
Extract dedicated `test` job with checkout, Python setup, uv with caching, dependency install, and pytest execution [`#564`]	✅
Add `needs: test` and `id-token`/`attestations` permissions to `release` job [`#564`]	✅
Configure Docker provenance to `mode=max` and add `actions/attest-build-provenance@v4.1.0` step [`#564`]	✅
Update changelog generation to exclude merge commits and normalize first-release text [`#564`]	✅

Possibly related issues

Normalize and align CD pipeline go-samples-gin-restful#249 — similar CD workflow changes (test job extraction, provenance, attestation, changelog filtering).
Normalize and align CD pipeline rust-samples-rocket-restful#90 — analogous GitHub Actions CD normalization and attestation additions.
Normalize and align CD pipeline ts-node-samples-express-restful#581 — same workflow adjustments (test gate, provenance, attest).
chore(ci): normalize and align CD pipeline java.samples.spring.boot#314 — parallel attest/provenance and changelog improvements.
Normalize and align CD pipeline Dotnet.Samples.AspNetCore.WebApi#465 — matching CD pipeline restructuring and attestation steps.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title follows Conventional Commits format with 'ci(cd):' prefix, is 46 characters (well under 80), and clearly describes the main change of normalizing and aligning the CD pipeline.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch ci/normalize-cd-pipeline

🛠️ sync documentation: Commit on current branch
🛠️ sync documentation: Create PR
🛠️ enforce http error handling: Commit on current branch
🛠️ enforce http error handling: Create PR
🛠️ idiomatic review: Commit on current branch
🛠️ idiomatic review: Create PR
🛠️ verify api contract: Commit on current branch
🛠️ verify api contract: Create PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · 2026-04-11T23:39:44Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (52902c8) to head (53ed786).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##            master      #565   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            7         7           
  Lines          172       172           
=========================================
  Hits           172       172

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nanotaboada · 2026-04-11T23:46:52Z

@coderabbitai review

coderabbitai · 2026-04-11T23:46:59Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/python-cd.yml:
- Around line 40-42: The "Run tests with pytest" step generates coverage.xml but
doesn't publish it; add a new step immediately after the "Run tests with pytest"
step in the same job (the test job) to upload the coverage report (e.g., using
actions/upload-artifact or codecov action) so coverage.xml is
uploaded/published; ensure the new step references the generated coverage file
name (coverage.xml) and uses a clear name like "Upload coverage report" to
satisfy the guideline requiring a coverage report upload step.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 5da77284-479a-4726-aeba-a0b09ee1fdab

📥 Commits

Reviewing files that changed from the base of the PR and between 52902c8 and 34dc0c2.

📒 Files selected for processing (2)

.github/workflows/python-cd.yml
CHANGELOG.md

.github/workflows/python-cd.yml

CD only needs a pass/fail signal; coverage reporting belongs in CI. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sonarqubecloud · 2026-04-12T00:17:37Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

coderabbitai bot reviewed Apr 11, 2026

View reviewed changes

.github/workflows/python-cd.yml Outdated Show resolved Hide resolved

ci(cd): drop coverage flags from CD test job (#564)

53ed786

CD only needs a pass/fail signal; coverage reporting belongs in CI. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

nanotaboada merged commit ac3d356 into master Apr 12, 2026
11 checks passed

nanotaboada deleted the ci/normalize-cd-pipeline branch April 12, 2026 00:42

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci(cd): normalize and align CD pipeline (#564)#565

ci(cd): normalize and align CD pipeline (#564)#565
nanotaboada merged 2 commits intomasterfrom
ci/normalize-cd-pipeline

nanotaboada commented Apr 11, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Apr 11, 2026 •

edited

Loading

Uh oh!

codecov bot commented Apr 11, 2026 •

edited

Loading

Uh oh!

nanotaboada commented Apr 11, 2026

Uh oh!

coderabbitai bot commented Apr 11, 2026

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

sonarqubecloud bot commented Apr 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

nanotaboada commented Apr 11, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram

Estimated code review effort

Assessment Against Linked Issues

Possibly related issues

Uh oh!

codecov bot commented Apr 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

nanotaboada commented Apr 11, 2026

Uh oh!

coderabbitai bot commented Apr 11, 2026

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud bot commented Apr 12, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

nanotaboada commented Apr 11, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Apr 11, 2026 •

edited

Loading

codecov bot commented Apr 11, 2026 •

edited

Loading