ci: remove Docker Hub credentials from CI services by 27Bslash6 · Pull Request #90 · cachekit-io/cachekit-py

27Bslash6 · 2026-04-23T08:34:13Z

Summary

Remove credentials block from Redis service container in CI workflow
Fixes Dependabot PRs failing with Unexpected value '' at YAML template validation — Dependabot can't access repo secrets, so secrets.DOCKERHUB_USERNAME / secrets.DOCKERHUB_TOKEN resolve to empty strings
Redis image is public; self-hosted runners don't hit Docker Hub rate limits

Test plan

This PR's own CI passes (no credentials needed)
Rebase dependabot/cargo/rand-0.9.4 (chore(deps): bump rand from 0.9.2 to 0.9.4 #89) after merge — should pass

Summary by CodeRabbit

Chores
- Updated CI/CD configuration for improved credential management.

Dependabot PRs cannot access repository secrets, causing the credentials block to resolve to empty strings and fail YAML template validation. The redis image is public and self-hosted runners don't hit rate limits.

coderabbitai · 2026-04-23T08:34:27Z

Warning

Rate limit exceeded

@27Bslash6 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 44 minutes and 40 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 44 minutes and 40 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 208ffed7-0a91-410e-a04f-5e3a852624c6

📥 Commits

Reviewing files that changed from the base of the PR and between 06bb193 and ffc7247.

⛔ Files ignored due to path filters (1)

uv.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

.github/workflows/ci.yml
tests/unit/test_load_control.py

📝 Walkthrough

Walkthrough

The CI workflow removes Docker Hub credential configuration from the Redis service container in the test job. The credentials.username and credentials.password secret references are deleted while preserving the container image, port exposure, and health-check configuration.

Changes

Cohort / File(s)	Summary
CI Configuration `.github/workflows/ci.yml`	Removes Docker Hub credential fields (`services.redis.credentials.username` and `services.redis.credentials.password`) from the Redis service container definition in the test job.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 A rabbit hops through workflows bright,
Removing secrets left and right,
No more credentials in the test,
The Docker streams now flow their best!
Simpler CI, cleaner sight! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description provides context and rationale but omits most required template sections including Type of Change, Security Checklist, and Testing checkboxes.	Add Type of Change section marking 'CI/CD or tooling change', complete Security Checklist (at minimum verify no secrets remain), and Testing section confirming CI passes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely describes the main change: removing Docker Hub credentials from CI services configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/ci-dependabot-secrets

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

codecov · 2026-04-23T08:37:27Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

test_very_small_timeout asserts elapsed < 50ms but CI thread scheduling jitter pushed it to 51.8ms. Relaxed to 200ms — the test verifies the timeout fires (not that it's fast), so generous bounds are correct.

Fixes GHSA-6w46-j5rx-g56g (pytest /tmp symlink attack) and GHSA-mf9w-mj56-hr94 (python-dotenv cross-device symlink overwrite). Both dev-only dependencies.

Swatinem/rust-cache and actions/cache upload/download from GitHub's cache API, which is pointless on self-hosted runners where target/ and .venv/ persist on disk between runs. Removes ~30s of overhead per job.

ci: remove Docker Hub credentials from CI services

06bb193

Dependabot PRs cannot access repository secrets, causing the credentials block to resolve to empty strings and fail YAML template validation. The redis image is public and self-hosted runners don't hit rate limits.

27Bslash6 added 3 commits April 23, 2026 18:41

test: increase timing tolerance for backpressure timeout test

e6e49ef

test_very_small_timeout asserts elapsed < 50ms but CI thread scheduling jitter pushed it to 51.8ms. Relaxed to 200ms — the test verifies the timeout fires (not that it's fast), so generous bounds are correct.

chore(deps): bump pytest 8.4.2→9.0.3 and python-dotenv 1.2.1→1.2.2

adb2e38

Fixes GHSA-6w46-j5rx-g56g (pytest /tmp symlink attack) and GHSA-mf9w-mj56-hr94 (python-dotenv cross-device symlink overwrite). Both dev-only dependencies.

ci: remove GHA cache steps from self-hosted runner jobs

ffc7247

Swatinem/rust-cache and actions/cache upload/download from GitHub's cache API, which is pointless on self-hosted runners where target/ and .venv/ persist on disk between runs. Removes ~30s of overhead per job.

27Bslash6 merged commit da34f49 into main Apr 23, 2026
32 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: remove Docker Hub credentials from CI services#90

ci: remove Docker Hub credentials from CI services#90
27Bslash6 merged 4 commits intomainfrom
fix/ci-dependabot-secrets

27Bslash6 commented Apr 23, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 23, 2026 •

edited

Loading

Rate limit exceeded

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 inconclusive)

Uh oh!

codecov Bot commented Apr 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

27Bslash6 commented Apr 23, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Walkthrough

Changes

Estimated code review effort

Poem

❌ Failed checks (1 inconclusive)

Uh oh!

codecov Bot commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

27Bslash6 commented Apr 23, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 23, 2026 •

edited

Loading

codecov Bot commented Apr 23, 2026 •

edited

Loading