Update allowed branches in workflows for security fixes #640
Conversation
WalkthroughThe pull request introduces modifications to three GitHub workflow configuration files. The Changes
Possibly related PRs
Poem
Tip CodeRabbit's docstrings feature is now available as part of our Early Access Program! Simply use the command 📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Outside diff range and nitpick comments (3)
.github/workflows/test.yml (1)
Line range hint
19-19: Update actions/checkout to v4Other workflow files are using
actions/checkout@v4, but this file uses v2. Consider updating for consistency and to leverage the latest features and security fixes.- uses: actions/checkout@v2 + uses: actions/checkout@v4.github/workflows/chromatic.yml (2)
Line range hint
31-31: Consider adding exit-zero-on-changes flagThe commented suggestion about
--exit-zero-on-changescould be valuable to prevent workflow failures on visual changes, especially since this is running on the main branch only.with: projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }} + exitZeroOnChanges: true # Prevents workflow failures on visual changes🧰 Tools
🪛 actionlint (1.7.4)
17-17: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
13-14: Consider additional repository security checksWhile the
github.repositorycheck is good, consider addinggithub.event.pull_request.head.repo.full_namechecks for pull request events to further restrict workflow execution.Example addition:
if: | github.repository == 'rad-ui/ui' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'rad-ui/ui')
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.github/workflows/build-rad-ui.yml(1 hunks).github/workflows/chromatic.yml(1 hunks).github/workflows/test.yml(1 hunks)
🔇 Additional comments (2)
.github/workflows/test.yml (1)
5-5: LGTM! Branch configuration updated correctly
The addition of security-fixes to the push triggers aligns with the PR objectives.
.github/workflows/chromatic.yml (1)
13-14: LGTM! Repository restriction added correctly
The condition to run only on the main repository is properly implemented and aligns with the PR objectives.
Let's verify the repository name is correct:
✅ Verification successful
Let me verify the actual repository name by checking the repository configuration.
Let me check the content of other workflow files to ensure repository references are consistent.
Repository name verification successful, but action versions need standardization
The repository name rad-ui/ui is correctly referenced in the chromatic workflow and matches the repository configuration. However, I noticed inconsistent GitHub Action versions across workflows:
- chromatic.yml: uses
actions/checkout@v3 - test.yml: uses
actions/checkout@v2
Consider standardizing the action versions across workflows for better maintainability.
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Verify repository name consistency
# Expect: Consistent repository name references
echo "Checking repository name references..."
rg -l "rad-ui/ui" .github/
Length of output: 145
Script:
#!/bin/bash
# Check repository name from git config and package.json
echo "Checking git remote origin..."
git config --get remote.origin.url
echo -e "\nChecking package.json..."
cat package.json | jq -r '.repository.url'
echo -e "\nChecking other potential repository references..."
rg -l "repository|repo" .github/ --type yaml
Length of output: 523
Script:
#!/bin/bash
# Check repository references in other workflow files
echo "Content of test.yml:"
cat .github/workflows/test.yml
echo -e "\nContent of dependabot.yml:"
cat .github/dependabot.yml
Length of output: 1396
This PR allows workflows to run on security fixes branch and also runs chromatic only on the main repo and not the forks
Summary by CodeRabbit
New Features
security-fixesbranch for building RAD UI and running tests.Bug Fixes