ci: Replace third-party GitHub Actions with trusted alternatives#10397
ci: Replace third-party GitHub Actions with trusted alternatives#10397mtrezza merged 3 commits intoparse-community:alphafrom
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. |
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 4 minutes and 26 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughReplaced several third-party GitHub Actions with inline scripts and official actions: PR creation/update now handled via Changes
Sequence Diagram(s)mermaid Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/ci-automated-check-environment.yml (2)
34-36: Deprecated::set-outputsyntax.The
::set-outputcommand was deprecated in October 2022. Use$GITHUB_OUTPUTenvironment file instead. This is a pre-existing issue but worth addressing while updating this workflow.Suggested fix
- name: Compose branch name for PR id: branch - run: echo "::set-output name=name::ci-bump-environment" + run: echo "name=ci-bump-environment" >> "$GITHUB_OUTPUT"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci-automated-check-environment.yml around lines 34 - 36, Replace the deprecated ::set-output usage in the GitHub Actions step with the environment file approach: update the "Compose branch name for PR" step (id: branch) to write the output key/value into $GITHUB_OUTPUT (for example, append "name=ci-bump-environment" to $GITHUB_OUTPUT) instead of calling echo "::set-output name=name::..."; ensure the step's run command uses the $GITHUB_OUTPUT file so downstream steps can access the output.
17-21: Consider updatingactions/setup-nodeto v4.While not introduced by this PR,
actions/setup-node@v2is significantly outdated. Version 4 is the current major release with better caching and Node.js version support.Suggested improvement
- name: Setup Node - uses: actions/setup-node@v2 + uses: actions/setup-node@v4 with: node-version: 20 cache: 'npm'🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/ci-automated-check-environment.yml around lines 17 - 21, Update the GitHub Actions step that currently uses actions/setup-node@v2 to the latest major release by changing the action reference to actions/setup-node@v4; ensure any syntax or input changes required by v4 (such as node-version handling and cache configuration) are adjusted in the workflow step where the Setup Node action is defined so node-version: 20 and cache: 'npm' continue to work under the v4 interface.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/release-automated.yml:
- Around line 91-93: Add the missing contents permission to the job's
permissions block so actions/checkout@v4 can access repository files: update the
existing permissions that currently list pages: write and id-token: write to
also include contents: read; ensure the permissions block now contains pages:
write, id-token: write, and contents: read so checkout will succeed for private
repos.
In @.github/workflows/release-manual-docs.yml:
- Around line 17-19: The workflow's explicit permissions block is missing the
required contents permission for the checkout action; update the permissions
mapping (the permissions keys "pages" and "id-token") to also include "contents:
read" so that actions/checkout@v4 can function correctly during the checkout
step—add the "contents: read" entry alongside the existing permissions in the
permissions section.
---
Nitpick comments:
In @.github/workflows/ci-automated-check-environment.yml:
- Around line 34-36: Replace the deprecated ::set-output usage in the GitHub
Actions step with the environment file approach: update the "Compose branch name
for PR" step (id: branch) to write the output key/value into $GITHUB_OUTPUT (for
example, append "name=ci-bump-environment" to $GITHUB_OUTPUT) instead of calling
echo "::set-output name=name::..."; ensure the step's run command uses the
$GITHUB_OUTPUT file so downstream steps can access the output.
- Around line 17-21: Update the GitHub Actions step that currently uses
actions/setup-node@v2 to the latest major release by changing the action
reference to actions/setup-node@v4; ensure any syntax or input changes required
by v4 (such as node-version handling and cache configuration) are adjusted in
the workflow step where the Setup Node action is defined so node-version: 20 and
cache: 'npm' continue to work under the v4 interface.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 09f92616-9b0f-49d2-a6c1-6c77b1941cfd
📒 Files selected for processing (5)
.github/workflows/ci-automated-check-environment.yml.github/workflows/ci.yml.github/workflows/release-automated.yml.github/workflows/release-manual-docs.yml.github/workflows/release-prepare-monthly.yml
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## alpha #10397 +/- ##
==========================================
+ Coverage 92.50% 92.51% +0.01%
==========================================
Files 192 192
Lines 16721 16721
Branches 229 229
==========================================
+ Hits 15468 15470 +2
+ Misses 1231 1229 -2
Partials 22 22 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
🎉 This change has been released in version 9.8.0-alpha.6 |
2 participants
Summary
Replace untrusted third-party GitHub Actions with official alternatives to reduce supply chain attack surface.
Changes
mansona/npm-lockfile-versionwith inline lockfile version checkk3rnels-actions/pr-updatewithactions/github-scriptpeaceiris/actions-gh-pageswith officialactions/configure-pages+actions/upload-pages-artifact+actions/deploy-pagespipelineNote
The repository Pages source setting must be changed to "GitHub Actions" in Settings > Pages.
Summary by CodeRabbit