chore: docs deps sweep and pin actions#166
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughThis PR bundles two independent improvements: hardening CI/CD by pinning GitHub Actions to commit SHAs across release and test workflows for supply-chain security, and modernizing the documentation build system with Astro/Starlight updates, sidebar restructuring, and route-resolution fixes. ChangesCI/CD Workflow Hardening
Documentation System Modernization
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint skipped: no ESLint configuration detected in root package.json. To enable, add Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
docs/src/lib/llms-content.ts (1)
7-8: ⚡ Quick win
slugToPathnameis exported and uses trailing slashes, so the sidebar lookup mismatch risk is low
slugToPathnameis part of Starlight’sutils/slugsexports, and it formats non-root slugs as/<param>/(including the trailing/), matching sidebarhrefvalues like/intro/overview/.- The remaining “quiet failure” risk is future internal API changes since the import is
@ts-ignore’d; consider removing the ignore if TS allows, or add a sanity check that the generated output isn’t empty.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/src/lib/llms-content.ts` around lines 7 - 8, The import of slugToPathname from Starlight is being ts-ignored and may change or return an empty string; remove the ts-ignore if TypeScript allows so the import is tracked, and/or add a runtime sanity check in the code that calls slugToPathname (in docs/src/lib/llms-content.ts) to verify the returned pathname is non-empty and normalized (e.g., ensure it starts with "/" and includes trailing "/" for non-root slugs) and log or throw a clear error if the value is invalid to avoid quiet failures when matching sidebar hrefs.docs/src/components/SourceFile.astro (1)
28-34: ⚡ Quick winProcess cwd → repoRoot assumption matches this repo’s build pipeline (but clarify the expectation).
Vercel/automation runs the docs build from
docs/(vercel.jsonusescd docs && bun run build, andjustfilealsocd docs && ... bun run build), and the repo root does containtestdata/. The only timeprocess.cwd()would “overshoot” is if someone runsastro build/devfrom a different working directory (e.g., repo root) outside these scripts—so the comment should explicitly state it expects cwd to bedocs/(optional: add a small sanity-check like “testdata exists” to fail loudly if that ever changes).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/src/components/SourceFile.astro` around lines 28 - 34, The comment assumes process.cwd() is the docs project root which can be fragile; update the comment near repoRoot, process.cwd(), and absolutePath to explicitly state we expect the build to run with cwd set to "docs/" (per vercel.json/justfile), and add a small runtime sanity check after computing repoRoot/absolutePath that verifies the expected testdata path exists (e.g., check fs.existsSync on path.resolve(repoRoot, 'testdata')) and throw or log a clear error if it does not so builds fail loudly when cwd is different.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 37: The checkout steps are currently persisting the GitHub token; for
each actions/checkout@... occurrence (the uses: actions/checkout entries at the
five checkout steps) add persist-credentials: false to stop credential
persistence — for steps without a with: block add a with: section containing
persist-credentials: false, and for steps that already have a with: block (the
other actions/checkout occurrences) add persist-credentials: false as another
property under that with: block so all five checkout steps include
persist-credentials: false.
In @.github/workflows/test.yml:
- Line 17: Update every GitHub Actions checkout step that invokes "uses:
actions/checkout@..." to explicitly set persist-credentials: false so the runner
does not leave the GITHUB_TOKEN in .git/config; for each checkout step (all
occurrences of the uses: actions/checkout steps in this workflow) add the
persist-credentials: false input alongside any existing with: or inputs to
prevent token leakage to later steps or artifacts.
---
Nitpick comments:
In `@docs/src/components/SourceFile.astro`:
- Around line 28-34: The comment assumes process.cwd() is the docs project root
which can be fragile; update the comment near repoRoot, process.cwd(), and
absolutePath to explicitly state we expect the build to run with cwd set to
"docs/" (per vercel.json/justfile), and add a small runtime sanity check after
computing repoRoot/absolutePath that verifies the expected testdata path exists
(e.g., check fs.existsSync on path.resolve(repoRoot, 'testdata')) and throw or
log a clear error if it does not so builds fail loudly when cwd is different.
In `@docs/src/lib/llms-content.ts`:
- Around line 7-8: The import of slugToPathname from Starlight is being
ts-ignored and may change or return an empty string; remove the ts-ignore if
TypeScript allows so the import is tracked, and/or add a runtime sanity check in
the code that calls slugToPathname (in docs/src/lib/llms-content.ts) to verify
the returned pathname is non-empty and normalized (e.g., ensure it starts with
"/" and includes trailing "/" for non-root slugs) and log or throw a clear error
if the value is invalid to avoid quiet failures when matching sidebar hrefs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f2d8a2f4-5a42-4a51-91cf-af462db499ff
⛔ Files ignored due to path filters (1)
docs/bun.lockis excluded by!**/*.lock
📒 Files selected for processing (6)
.github/workflows/release.yml.github/workflows/test.ymldocs/astro.config.mjsdocs/package.jsondocs/src/components/SourceFile.astrodocs/src/lib/llms-content.ts
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 |
There was a problem hiding this comment.
Set persist-credentials: false on checkout actions to prevent token leakage.
By default, actions/checkout persists the GitHub token in .git/config, making it accessible to subsequent steps and potentially exposing it via uploaded artifacts. Since this PR is specifically about hardening CI/CD security, you should disable credential persistence.
🔐 Proposed fix
Add persist-credentials: false to each checkout step:
- name: Checkout code
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+ with:
+ persist-credentials: falseApply this pattern to all five checkout actions in the file (lines 37, 62, 152, 187, 223). For the steps that already have a with block (lines 62, 152, 187, 223), add persist-credentials: false as an additional property under with:.
Also applies to: 62-62, 152-152, 187-187, 223-223
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 36-37: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 37, The checkout steps are currently
persisting the GitHub token; for each actions/checkout@... occurrence (the uses:
actions/checkout entries at the five checkout steps) add persist-credentials:
false to stop credential persistence — for steps without a with: block add a
with: section containing persist-credentials: false, and for steps that already
have a with: block (the other actions/checkout occurrences) add
persist-credentials: false as another property under that with: block so all
five checkout steps include persist-credentials: false.
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 |
There was a problem hiding this comment.
Set persist-credentials: false on checkout actions to prevent token leakage.
Same issue as in release.yml: the default behavior of actions/checkout persists the GitHub token in .git/config, which can be accessed by subsequent steps or exposed via artifacts. For a security-hardening PR, this is a gap worth closing.
🔐 Proposed fix
Add persist-credentials: false to each checkout step:
- name: Checkout code
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+ with:
+ persist-credentials: falseApply this to all seven checkout actions in the file (lines 17, 35, 53, 68, 130, 170, 193).
Also applies to: 35-35, 53-53, 68-68, 130-130, 170-170, 193-193
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 16-17: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/test.yml at line 17, Update every GitHub Actions checkout
step that invokes "uses: actions/checkout@..." to explicitly set
persist-credentials: false so the runner does not leave the GITHUB_TOKEN in
.git/config; for each checkout step (all occurrences of the uses:
actions/checkout steps in this workflow) add the persist-credentials: false
input alongside any existing with: or inputs to prevent token leakage to later
steps or artifacts.
1 participant
Summary by CodeRabbit
Chores
Bug Fixes