Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
76 changes: 76 additions & 0 deletions .github/workflows/deploy-storybook.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,76 @@
name: Deploy Storybook to Cloudflare Workers
permissions:
contents: read
pull-requests: write
issues: write
Comment on lines +2 to +5
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🛠️ Refactor suggestion

Tighten the GITHUB_TOKEN scope

pull-requests: write isn’t used anywhere in this job—issues.createComment only needs issues: write. Keeping unused scopes breaks the principle of least-privilege.

 permissions:
   contents: read
-  pull-requests: write
   issues: write
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
permissions:
contents: read
pull-requests: write
issues: write
permissions:
contents: read
issues: write
🤖 Prompt for AI Agents
In .github/workflows/deploy-storybook.yml around lines 2 to 5, the permissions
section includes `pull-requests: write` which is not used in this job. Remove
the `pull-requests: write` permission to tighten the GITHUB_TOKEN scope and
adhere to the principle of least privilege, keeping only `contents: read` and
`issues: write` as needed.

on:
push:
branches:
- main
paths:
- 'unraid-ui/**'
pull_request:
paths:
- 'unraid-ui/**'
workflow_dispatch:

jobs:
deploy:
runs-on: ubuntu-latest
name: Deploy Storybook
steps:
- name: Checkout
uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'

- uses: pnpm/action-setup@v4
name: Install pnpm
with:
run_install: false

- name: Cache APT Packages
uses: awalsh128/cache-apt-pkgs-action@v1.4.3
with:
packages: bash procps python3 libvirt-dev jq zstd git build-essential libvirt-daemon-system
version: 1.0

- name: Install dependencies
run: pnpm install --frozen-lockfile

- name: Build Storybook
run: |
cd unraid-ui
pnpm build-storybook

- name: Deploy to Cloudflare Workers (Staging)
id: deploy_staging
if: github.event_name == 'pull_request'
uses: cloudflare/wrangler-action@v3
with:
apiToken: ${{ secrets.CLOUDFLARE_DEPLOY_TOKEN }}
command: deploy --env staging
workingDirectory: unraid-ui

- name: Deploy to Cloudflare Workers (Production)
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
uses: cloudflare/wrangler-action@v3
with:
apiToken: ${{ secrets.CLOUDFLARE_DEPLOY_TOKEN }}
command: deploy
workingDirectory: unraid-ui

- name: Comment PR with deployment URL
if: github.event_name == 'pull_request'
uses: actions/github-script@v7
with:
script: |
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: `🚀 Storybook has been deployed to staging: ${{ steps.deploy_staging.outputs['deployment-url'] }}`
})
2 changes: 2 additions & 0 deletions api/src/dotenv.ts
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,8 @@ const env =
override: true,
})
: config({
debug: false,
quiet: true,
path: '/usr/local/unraid-api/.env',
encoding: 'utf-8',
});
Expand Down
Loading