pull from master - #25
Conversation
Kindly accept the request
Removed existing CI configuration for frontend and backend workflows.
Added CI workflow for building and pushing Docker image.
Add prettier directory configuration for linting.
Replaced lint-action with npm run lint for ESLint.
📝 WalkthroughWalkthroughThe CI workflow ( ChangesCI Workflow Simplification
Estimated code review effort🎯 2 (Simple) | ⏱️ ~5 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Warning |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (3)
.github/workflows/ci.yml (3)
24-26: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winConsider restoring frontend test execution in CI.
The frontend defines a
testscript, but this workflow now gates only on lint. Re-adding tests would catch regressions earlier.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 24 - 26, The CI workflow currently runs only the frontend lint step and no longer exercises the frontend test suite. Update the workflow job that contains Run ESLint so it also invokes the frontend test script from the frontend package, ensuring the CI gate includes both lint and tests. Use the existing frontend workflow step names and npm scripts to add the test execution alongside the current lint check.
18-18: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winAlign Node versions between CI lint and Docker build.
Line 18 uses Node 24, while
frontend/Dockerfilebuilds with Node 20. This mismatch can hide version-specific failures.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml at line 18, The Node runtime versions are mismatched between the CI workflow and the frontend Docker build, which can mask environment-specific issues. Update the workflow job that sets node-version in the CI config to match the Node version used by frontend/Dockerfile, and keep the version consistent anywhere else the Node setup is defined so linting and build/test runs use the same runtime.
12-13: 🔒 Security & Privacy | 🔵 TrivialDisable credential persistence on both checkout steps
actions/checkoutkeeps the Git token by default, but this workflow only builds and pushes Docker images, sopersist-credentials: falsecan be set on both checkouts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 12 - 13, The workflow’s actions/checkout step is persisting Git credentials by default, which should be disabled for the Docker build/push flow. Update both checkout uses in the CI workflow to set persist-credentials to false so no Git token is stored after checkout, and keep the change aligned with the existing Checkout code steps.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 8-9: Add an explicit workflow-level permissions block to the ci
workflow so the GitHub token uses least privilege by default. Update the
workflow definition around the top-level jobs section in ci.yml to set minimal
permissions for this workflow, typically using the default read-only contents
scope, and keep any job-specific overrides only if a job truly needs more
access.
- Line 13: The workflow actions are still using version tags instead of
immutable commit SHAs, so update each referenced action in ci.yml, matrix.yml,
and cd.yml to pin the exact SHA for actions/checkout, actions/setup-node,
actions/setup-go, docker/login-action, and docker/build-push-action. Make the
changes in the workflow definitions themselves so the jobs continue to use the
same actions but with SHA-pinned references only.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 24-26: The CI workflow currently runs only the frontend lint step
and no longer exercises the frontend test suite. Update the workflow job that
contains Run ESLint so it also invokes the frontend test script from the
frontend package, ensuring the CI gate includes both lint and tests. Use the
existing frontend workflow step names and npm scripts to add the test execution
alongside the current lint check.
- Line 18: The Node runtime versions are mismatched between the CI workflow and
the frontend Docker build, which can mask environment-specific issues. Update
the workflow job that sets node-version in the CI config to match the Node
version used by frontend/Dockerfile, and keep the version consistent anywhere
else the Node setup is defined so linting and build/test runs use the same
runtime.
- Around line 12-13: The workflow’s actions/checkout step is persisting Git
credentials by default, which should be disabled for the Docker build/push flow.
Update both checkout uses in the CI workflow to set persist-credentials to false
so no Git token is stored after checkout, and keep the change aligned with the
existing Checkout code steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| jobs: | ||
| frontend: | ||
| # Github runner | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout Code | ||
| uses: actions/checkout@v7 | ||
| code-lint: |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Add explicit least-privilege permissions at workflow level.
Relying on default token scopes is broader than needed; define minimal permissions (for this workflow, contents: read is typically sufficient).
Suggested patch
on:
push:
branches: [master]
+permissions:
+ contents: read
+
jobs:📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| jobs: | |
| frontend: | |
| # Github runner | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v7 | |
| code-lint: | |
| permissions: | |
| contents: read | |
| jobs: | |
| code-lint: |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 8 - 9, Add an explicit workflow-level
permissions block to the ci workflow so the GitHub token uses least privilege by
default. Update the workflow definition around the top-level jobs section in
ci.yml to set minimal permissions for this workflow, typically using the default
read-only contents scope, and keep any job-specific overrides only if a job
truly needs more access.
Source: Linters/SAST tools
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow and nearby lines with numbers.
git ls-files .github/workflows/ci.yml
wc -l .github/workflows/ci.yml
cat -n .github/workflows/ci.yml | sed -n '1,120p'Repository: LondheShubham153/devboard
Length of output: 1682
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Map uses references in the workflow and search for policy mentions.
rg -n "uses:\s*(actions/checkout|actions/setup-node|docker/login-action|docker/build-push-action)@" .github/workflows/ci.yml
rg -n "immutable commit SHA|pin.*SHA|supply-chain|actions/" .github/workflows .github README.md docs 2>/dev/null || trueRepository: LondheShubham153/devboard
Length of output: 1161
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Also inspect any workflow comments or references that may justify the choice.
sed -n '1,140p' .github/workflows/ci.yml | nl -baRepository: LondheShubham153/devboard
Length of output: 203
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Search for the exact action references and version pins.
rg -n "uses:\s*(actions/checkout|actions/setup-node|docker/login-action|docker/build-push-action)@" .github/workflows/ci.ymlRepository: LondheShubham153/devboard
Length of output: 361
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Print the workflow with line numbers and extract all action refs.
echo '--- ci.yml ---'
cat -n .github/workflows/ci.yml | sed -n '1,120p'
echo '--- action refs ---'
python3 - <<'PY'
import re, pathlib
text = pathlib.Path('.github/workflows/ci.yml').read_text()
for i, line in enumerate(text.splitlines(), 1):
m = re.search(r'uses:\s*([^\s]+)', line)
if m:
print(f"{i}: {m.group(1)}")
PYRepository: LondheShubham153/devboard
Length of output: 1797
Pin all workflow Actions to immutable commit SHAs.
.github/workflows/ci.yml:actions/checkout@v7,actions/setup-node@v4,docker/login-action@v4,docker/build-push-action@v7.github/workflows/matrix.yml:actions/checkout@v7,actions/setup-go@v6.github/workflows/cd.yml:actions/checkout@v7
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 12-13: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 13-13: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 13, The workflow actions are still using
version tags instead of immutable commit SHAs, so update each referenced action
in ci.yml, matrix.yml, and cd.yml to pin the exact SHA for actions/checkout,
actions/setup-node, actions/setup-go, docker/login-action, and
docker/build-push-action. Make the changes in the workflow definitions
themselves so the jobs continue to use the same actions but with SHA-pinned
references only.
Source: Linters/SAST tools
1 participant
Summary by CodeRabbit