Auto reviews are disabled on base/target branches other than the default branch.
Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Free
Run ID: 223c0dc9-3e33-4cf7-8e99-3bf35d713143
You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.
Use the checkbox below for a quick retry:
🔍 Trigger review
Tip
💬 Introducing Slack Agent: The best way for teams to turn conversations into code.
Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Generate code and open pull requests
Plan features and break down work
Investigate incidents and troubleshoot customer tickets together
Automate recurring tasks and respond to alerts with triggers
Summarize progress and report instantly
Built for teams:
Shared memory across your entire org—no repeating context
Per-thread sandboxes to safely plan and execute work
Governance built-in—scoped access, auditability, and budget controls
One agent for your entire SDLC. Right inside Slack.
Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting https://app.coderabbit.ai/login.
Comment @coderabbitai help to get the list of available commands and usage tips.
<!-- This is an auto-generated comment: summarize by coderabbit.ai -->
<!-- This is an auto-generated comment: skip review by coderabbit.ai -->
> [!IMPORTANT]
> ## Review skipped
>
> Auto reviews are disabled on base/target branches other than the default branch.
>
>
>
> Please check the settings in the CodeRabbit UI or the `.coderabbit.yaml` file in this repository. To trigger a single review, invoke the `@coderabbitai review` command.
>
> <details>
> <summary>⚙️ Run configuration</summary>
>
> **Configuration used**: Organization UI
>
> **Review profile**: ASSERTIVE
>
> **Plan**: Free
>
> **Run ID**: `223c0dc9-3e33-4cf7-8e99-3bf35d713143`
>
> </details>
>
> You can disable this status message by setting the `reviews.review_status` to `false` in the CodeRabbit configuration file.
>
> Use the checkbox below for a quick retry:
> - [ ] <!-- {"checkboxId": "e9bb8d72-00e8-4f67-9cb2-caf3b22574fe"} --> 🔍 Trigger review
<!-- end of auto-generated comment: skip review by coderabbit.ai -->
<!-- announcements_start -->
> [!TIP]
> <details>
> <summary>💬 Introducing Slack Agent: The best way for teams to turn conversations into code.</summary>
>
> [Slack Agent](https://www.coderabbit.ai/agent) is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
>
> - Generate code and open pull requests
> - Plan features and break down work
> - Investigate incidents and troubleshoot customer tickets together
> - Automate recurring tasks and respond to alerts with triggers
> - Summarize progress and report instantly
>
> Built for teams:
>
> - **Shared memory** across your entire org—no repeating context
> - **Per-thread sandboxes** to safely plan and execute work
> - **Governance built-in**—scoped access, auditability, and budget controls
>
> One agent for your entire SDLC. Right inside Slack.
>
> 👉 [Get started](https://agent.coderabbit.ai/)
>
> </details>
<!-- announcements_end -->
<!-- tips_start -->
---
> [!NOTE]
> <details>
> <summary>🎁 Summarized by CodeRabbit Free</summary>
>
> Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Pro by visiting <https://app.coderabbit.ai/login>.
>
> </details>
<sub>Comment `@coderabbitai help` to get the list of available commands and usage tips.</sub>
<!-- tips_end -->
copilot-pull-request-reviewer[bot]
(Migrated from github.com)
reviewed 2026-05-03 10:24:01 +00:00
copilot-pull-request-reviewer[bot]
(Migrated from github.com)
left a comment
Copy Link
Copy Source
Pull request overview
Introduces a basic GitHub Actions CI pipeline for building/testing, Docker image build/push, and release/Telegram notifications, and updates the repository to commit the Gradle Wrapper JAR so CI can run ./gradlew reliably.
Changes:
Add reusable GitHub Actions workflows for build/test, Docker build/push, and release + Telegram notification.
Add a top-level CI workflow wiring secret scanning, build, docker, notifications, and tag-based releases.
Commit gradle-wrapper.jar and update .gitignore to ensure it’s tracked.
Reviewed changes
Copilot reviewed 4 out of 6 changed files in this pull request and generated 4 comments.
Show a summary per file
File
Description
gradle/wrapper/gradle-wrapper.jar
Adds the Gradle Wrapper JAR to support running Gradle via ./gradlew in CI.
.gitignore
Un-ignores gradle/wrapper/gradle-wrapper.jar so it can be committed.
## Pull request overview
Introduces a basic GitHub Actions CI pipeline for building/testing, Docker image build/push, and release/Telegram notifications, and updates the repository to commit the Gradle Wrapper JAR so CI can run `./gradlew` reliably.
**Changes:**
- Add reusable GitHub Actions workflows for build/test, Docker build/push, and release + Telegram notification.
- Add a top-level CI workflow wiring secret scanning, build, docker, notifications, and tag-based releases.
- Commit `gradle-wrapper.jar` and update `.gitignore` to ensure it’s tracked.
### Reviewed changes
Copilot reviewed 4 out of 6 changed files in this pull request and generated 4 comments.
<details>
<summary>Show a summary per file</summary>
| File | Description |
| ---- | ----------- |
| `gradle/wrapper/gradle-wrapper.jar` | Adds the Gradle Wrapper JAR to support running Gradle via `./gradlew` in CI. |
| `.gitignore` | Un-ignores `gradle/wrapper/gradle-wrapper.jar` so it can be committed. |
| `.github/workflows/ci.yaml` | Orchestrates secret scan, build/test, docker build/push, Telegram notify, and tag-based release. |
| `.github/workflows/build.yaml` | Reusable workflow to run `./gradlew clean check bootJar` and upload build reports/artifacts. |
| `.github/workflows/docker.yaml` | Reusable workflow to build (and optionally push) a GHCR image and expose digest/tags as outputs. |
| `.github/workflows/release.yaml` | Reusable workflow to create a GitHub Release and send a Telegram notification. |
</details>
---
💡 <a href="/devitq/movienight-backend/new/main?filename=.github/instructions/*.instructions.md" class="Link--inTextBlock" target="_blank" rel="noopener noreferrer">Add Copilot custom instructions</a> for smarter, more guided reviews. <a href="https://docs.github.com/en/copilot/customizing-copilot/adding-repository-custom-instructions-for-github-copilot" class="Link--inTextBlock" target="_blank" rel="noopener noreferrer">Learn how to get started</a>.
This step runs always() but if-no-files-found is set to error, which can cause the job to fail (or add noisy secondary failures) when the Gradle build fails before producing reports/jars. Consider changing if-no-files-found to warn or only uploading artifacts when expected paths exist.
This step runs `always()` but `if-no-files-found` is set to `error`, which can cause the job to fail (or add noisy secondary failures) when the Gradle build fails before producing reports/jars. Consider changing `if-no-files-found` to `warn` or only uploading artifacts when expected paths exist.
Using trufflesecurity/trufflehog@main makes CI depend on a moving branch tip, which is a supply-chain risk and can break builds unexpectedly. Pin this to a released tag or a specific commit SHA so scans are reproducible.
Using `trufflesecurity/trufflehog@main` makes CI depend on a moving branch tip, which is a supply-chain risk and can break builds unexpectedly. Pin this to a released tag or a specific commit SHA so scans are reproducible.
secrets: inherit is enabled for the docker reusable workflow even on pull_request runs (where push is false). This unnecessarily exposes repository secrets to PR workflows; remove secrets: inherit here or split the job so secrets are only provided for main/tag pushes.
`secrets: inherit` is enabled for the `docker` reusable workflow even on pull_request runs (where `push` is false). This unnecessarily exposes repository secrets to PR workflows; remove `secrets: inherit` here or split the job so secrets are only provided for main/tag pushes.
The workflow_call output image-tags is documented as a comma-separated list, but docker/metadata-action typically emits steps.meta.outputs.tags as a newline-delimited string. Either update the description to match the actual format or normalize it (e.g., join tags into a comma-separated string) before exporting.
The workflow_call output `image-tags` is documented as a comma-separated list, but `docker/metadata-action` typically emits `steps.meta.outputs.tags` as a newline-delimited string. Either update the description to match the actual format or normalize it (e.g., join tags into a comma-separated string) before exporting.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Comment
@coderabbitai helpto get the list of available commands and usage tips.Pull request overview
Introduces a basic GitHub Actions CI pipeline for building/testing, Docker image build/push, and release/Telegram notifications, and updates the repository to commit the Gradle Wrapper JAR so CI can run
./gradlewreliably.Changes:
gradle-wrapper.jarand update.gitignoreto ensure it’s tracked.Reviewed changes
Copilot reviewed 4 out of 6 changed files in this pull request and generated 4 comments.
Show a summary per file
gradle/wrapper/gradle-wrapper.jar./gradlewin CI..gitignoregradle/wrapper/gradle-wrapper.jarso it can be committed..github/workflows/ci.yaml.github/workflows/build.yaml./gradlew clean check bootJarand upload build reports/artifacts..github/workflows/docker.yaml.github/workflows/release.yaml💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
@@ -0,0 +51,4 @@build/test-results/**build/jacoco/**retention-days: 7if-no-files-found: errorThis step runs
always()butif-no-files-foundis set toerror, which can cause the job to fail (or add noisy secondary failures) when the Gradle build fails before producing reports/jars. Consider changingif-no-files-foundtowarnor only uploading artifacts when expected paths exist.@@ -0,0 +24,4 @@with:fetch-depth: 0- name: Run TruffleHoguses: trufflesecurity/trufflehog@mainUsing
trufflesecurity/trufflehog@mainmakes CI depend on a moving branch tip, which is a supply-chain risk and can break builds unexpectedly. Pin this to a released tag or a specific commit SHA so scans are reproducible.@@ -0,0 +43,4 @@packages: writewith:push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}secrets: inheritsecrets: inheritis enabled for thedockerreusable workflow even on pull_request runs (wherepushis false). This unnecessarily exposes repository secrets to PR workflows; removesecrets: inherithere or split the job so secrets are only provided for main/tag pushes.@@ -0,0 +12,4 @@description: "Pushed image digest (sha256:…)"value: ${{ jobs.docker.outputs.image-digest }}image-tags:description: "Comma-separated list of applied tags"The workflow_call output
image-tagsis documented as a comma-separated list, butdocker/metadata-actiontypically emitssteps.meta.outputs.tagsas a newline-delimited string. Either update the description to match the actual format or normalize it (e.g., join tags into a comma-separated string) before exporting.