ci(mono-pub): run publish job from LTS node #28
Conversation
|
Warning Rate limit exceeded@SavelevMatthew has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 17 minutes and 20 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (2)
WalkthroughThis pull request introduces a new GitHub Actions workflow file, Changes
Possibly related PRs
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Outside diff range and nitpick comments (1)
.github/workflows/nodejs.packages.debug.yml (1)
16-16: Consider adding concurrency controlTo prevent multiple publish workflows from running simultaneously, add concurrency control.
publish: + concurrency: publish-${{ github.ref }} runs-on: ubuntu-22.04
| jobs: | ||
| publish: | ||
| runs-on: ubuntu-22.04 | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Node.js environment | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| cache: 'yarn' | ||
|
|
||
| - name: Install dependencies | ||
| run: yarn --immutable | ||
|
|
||
| # NOTE: Mono-pub uses itself to publish its packages, so we need to prebuild them | ||
| - name: Build packages | ||
| run: yarn build | ||
|
|
||
| - name: Debug 1 | ||
| run: | | ||
| git tag --merged |
There was a problem hiding this comment.
Missing essential publishing configuration
The workflow is missing critical elements for NPM package publishing:
- No npm registry configuration
- No authentication setup
- No actual publish step
Add these essential steps:
- name: Configure npm registry
uses: actions/setup-node@v4
with:
registry-url: 'https://registry.npmjs.org'
- name: Publish packages
run: yarn workspaces foreach npm publish
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}| - name: Debug 1 | ||
| run: | | ||
| git tag --merged |
There was a problem hiding this comment.
Debug step appears incomplete
The debug step only shows merged tags but doesn't provide meaningful debugging information. Consider:
- Adding more git status information
- Logging workspace state
- Checking package versions
- name: Debug 1
run: |
- git tag --merged
+ git status
+ git tag --merged
+ yarn workspaces list
+ yarn workspaces foreach npm version📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Debug 1 | |
| run: | | |
| git tag --merged | |
| - name: Debug 1 | |
| run: | | |
| git status | |
| git tag --merged | |
| yarn workspaces list | |
| yarn workspaces foreach npm version |
| on: | ||
| push: | ||
| branches: [ "main" ] | ||
| pull_request: | ||
| branches: [ "main" ] | ||
|
|
There was a problem hiding this comment.
Reconsider workflow triggers for package publishing
Running the publish workflow on PR events could be risky:
- Could lead to duplicate runs (PR + push)
- Package publishing should typically only happen on merge to main
Consider this configuration instead:
on:
push:
branches: [ "main" ]
- pull_request:
- branches: [ "main" ]📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| - name: Setup Node.js environment | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| cache: 'yarn' | ||
|
|
There was a problem hiding this comment.
Specify Node.js LTS version
As per PR objective to run from LTS node, the Node.js version should be explicitly specified.
- name: Setup Node.js environment
uses: actions/setup-node@v4
with:
+ node-version: 'lts/*'
cache: 'yarn'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Setup Node.js environment | |
| uses: actions/setup-node@v4 | |
| with: | |
| cache: 'yarn' | |
| - name: Setup Node.js environment | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 'lts/*' | |
| cache: 'yarn' | |
| permissions: | ||
| contents: write | ||
| id-token: write | ||
|
|
There was a problem hiding this comment.
💡 Codebase verification
Permissions are unnecessarily broad for the debug workflow
The id-token: write permission is not used in this workflow as there's no OIDC authentication or token exchange. Additionally, contents: write is excessive since the debug workflow only reads git tags. Suggested permissions:
permissions:
contents: read.github/workflows/nodejs.packages.debug.yml: Removeid-token: writeand downgradecontentstoread
🔗 Analysis chain
Review and restrict permissions scope
The workflow has broad write permissions that should be reviewed:
contents: writemight be too permissive if only needed for taggingid-token: writesuggests OIDC usage, but no OIDC configuration is present in the workflow
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Check if there are any OIDC-related configurations in other workflow files
rg -l "id-token|oidc|permissions" .github/workflows/
Length of output: 185
Script:
#!/bin/bash
# Check the content of these workflow files to understand the OIDC usage
for file in nodejs.packages.{publish,debug,ci}.yml; do
echo "=== $file ==="
cat ".github/workflows/$file" 2>/dev/null
done
Length of output: 3780
Summary by CodeRabbit