Repository navigation
ci: add GitHub Actions workflow - #12
Conversation
- Typecheck, test, and build on push/PR to main - Uses pnpm with frozen lockfile for reproducible installs - Node 22 LTS
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThis PR introduces continuous integration infrastructure by adding a GitHub Actions workflow that runs typecheck and build commands on push and pull request events targeting the main branch, along with pnpm workspace configuration to enable Sharp builds. ChangesCI Pipeline and Workspace Configuration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 14: Update the checkout step to harden security by adding
persist-credentials: false to the actions/checkout usage (replace or augment the
existing actions/checkout@v4 invocation) and pin the action to an immutable
commit SHA instead of the mutable tag (e.g., use actions/checkout@<commit-sha>)
to reduce supply-chain risk; ensure the workflow entry for actions/checkout
includes the persist-credentials field and the new pinned reference.
- Around line 28-29: The CI is failing because the workflow step named "Test"
runs "pnpm test" but root package.json has no "test" script; either add a "test"
script to package.json (e.g., map it to an existing script like "typecheck" or a
real test runner) or change the workflow step that currently runs "pnpm test" to
call an existing script such as "pnpm typecheck", "pnpm smoke", or remove the
step entirely; update the workflow entry with the new command or add a "test"
entry in package.json accordingly so "pnpm test" no longer errors.
- Line 20: Pin the pnpm action and explicitly set the pnpm version: replace the
floating reference `pnpm/action-setup@v4` with an immutable commit SHA like
`pnpm/action-setup@<commit-sha>` and add the `with: version: "<pnpm-version>"`
input to the action invocation so CI installs a known pnpm release;
alternatively add a `packageManager` field in package.json (e.g.
"packageManager": "pnpm@<pnpm-version>") and still prefer pinning
`pnpm/action-setup` to a commit SHA rather than a moving tag.
- Around line 16-18: Pin the GitHub Action reference "actions/setup-node@v4" to
an exact commit SHA to reduce supply-chain risk; replace the floating ref
"actions/setup-node@v4" in the CI workflow with
"actions/setup-node@<commit-sha>" (use the canonical commit SHA from the
actions/setup-node repo) and keep the existing node-version: 22 entry so Node 22
compatibility remains unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 22 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check package.json for engines field and verify Node.js compatibility
# Check for engines field in package.json
echo "=== Checking package.json engines field ==="
jq -r '.engines // "No engines field defined"' package.json
# Check if pnpm-lock.yaml or .nvmrc specifies Node.js version
echo -e "\n=== Checking for .nvmrc or .node-version ==="
if [ -f .nvmrc ]; then
echo ".nvmrc found:"
cat .nvmrc
fi
if [ -f .node-version ]; then
echo ".node-version found:"
cat .node-version
fiRepository: TargiX/flux-graph-pixi
Length of output: 181
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== ci.yml setup-node usage ==="
nl -ba .github/workflows/ci.yml | sed -n '1,120p' | sed -n 's/^[[:space:]]*//'p >/dev/null || true
# Print just the relevant lines around the specified snippet (lines 10-30 in file)
nl -ba .github/workflows/ci.yml | sed -n '10,30p'
echo
echo "=== package.json engines field ==="
cat package.json | jq -r '.engines // "No engines field defined"'
echo
echo "=== project Node version hints (.nvmrc / .node-version / engines-like configs) ==="
ls -la .nvmrc .node-version 2>/dev/null || true
echo
echo "Searching for node-version usage in workflows..."
rg -n "node-version|setup-node@|actions/setup-node" .github/workflows -S || true
echo
echo "=== package.json key deps (to reason about Node compatibility) ==="
cat package.json | jq -r '{dependencies, devDependencies, packageManager, engines: (.engines // null)}'
echo
echo "=== lockfile (if present) version manager and Node hints ==="
ls -ლა package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null || true
if [ -f package-lock.json ]; then head -n 20 package-lock.json; fi
if [ -f pnpm-lock.yaml ]; then head -n 40 pnpm-lock.yaml; fi
if [ -f yarn.lock ]; then head -n 20 yarn.lock; fiRepository: TargiX/flux-graph-pixi
Length of output: 200
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== ci.yml (first 120 lines) ==="
sed -n '1,120p' .github/workflows/ci.yml
echo
echo "=== ci.yml lines 10-30 (for setup-node context) ==="
awk 'NR>=10 && NR<=30 {printf "%d:%s\n", NR, $0}' .github/workflows/ci.yml
echo
echo "=== package.json engines field ==="
cat package.json | jq -r '.engines // "No engines field defined"'
echo
echo "=== package.json packageManager (if any) ==="
cat package.json | jq -r '.packageManager // "No packageManager field"' || true
echo
echo "=== package.json deps (top-level) ==="
cat package.json | jq -r '{dependencies, devDependencies}'
echo
echo "=== .nvmrc / .node-version ==="
ls -la .nvmrc .node-version 2>/dev/null || true
[ -f .nvmrc ] && echo ".nvmrc:" && cat .nvmrc
[ -f .node-version ] && echo ".node-version:" && cat .node-version
echo
echo "=== search for actions/setup-node usage ==="
rg -n "actions/setup-node" .github/workflows -S || true
echo
echo "=== lockfiles present ==="
ls -la package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null || trueRepository: TargiX/flux-graph-pixi
Length of output: 2081
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== Search package-lock.json for engines/node constraints ==="
rg -n '"engines"' package-lock.json -S || true
echo
rg -n '"node"' package-lock.json -S || true
echo
rg -n '"next"' package-lock.json -S || true
echo
echo "=== Quick peek: next package entry in lockfile ==="
python3 - <<'PY'
import json
from pathlib import Path
p = Path("package-lock.json")
data = json.loads(p.read_text())
pkgs = data.get("packages", {}) if isinstance(data, dict) else {}
# Try common keys for next
candidates = [k for k in pkgs.keys() if k.endswith("node_modules/next")]
print("next candidates:", candidates[:10])
for k in candidates[:3]:
v = pkgs[k].get("version")
eng = pkgs[k].get("engines")
print("\nKey:", k)
print("version:", v)
print("engines:", eng)
PYRepository: TargiX/flux-graph-pixi
Length of output: 3268
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "=== package-lock.json: engines.node constraints containing '<' ==="
rg -n '"node"\s*:\s*"[^"]*[<][^"]*"' package-lock.json -S || true
echo
echo "=== package-lock.json: engines.node constraints containing '22' ==="
rg -n '"node"\s*:\s*"[^"]*22[^"]*"' package-lock.json -S || true
echo
echo "=== package-lock.json: any engines.node constraints that explicitly cap Node (<20, <=21, etc) ==="
rg -n '"node"\s*:\s*"[^"]*(<=|<)\s*2[01][0-9][^"]*"' package-lock.json -S || trueRepository: TargiX/flux-graph-pixi
Length of output: 301
🌐 Web query:
actions/setup-node v4.1.0 39370e3970a6d050c480ffad4ff0ed4d3fdee5af
💡 Result:
The commit hash 39370e3970a6d050c480ffad4ff0ed4d3fdee5af corresponds to the release of version v4.1.0 of the actions/setup-node GitHub Action [1][2][3]. This release, published on October 24, 2024, introduced several updates, most notably a change to the caching mechanism [1]. By adding the architecture (arch) to the cache key, the update ensures that cache keys are more accurate, which helps prevent potential conflicts between different architectures [1][4][5]. As a result of this change, previous cache keys created by earlier versions of the action are no longer compatible [1][3][5]. Additionally, version v4.1.0 included general maintenance updates, such as resolving high-security alerts by upgrading dependencies, revising logic for GitHub Enterprise Server (GHES), and upgrading the IA publish process [1][3].
Citations:
- 1: https://github.com/actions/setup-node/releases/tag/v4.1.0
- 2: actions/setup-node@v4.0.3...v4.1.0
- 3: meta: bump actions/setup-node from 4.0.4 to 4.1.0 nodejs/node#55687
- 4: meta: bump actions/setup-node from 4.0.3 to 4.1.0 nodejs/node#56100
- 5: build(deps): bump actions/setup-node from 4.0.4 to 4.1.0 envoyproxy/gateway#4537
Pin actions/setup-node@v4 to a commit SHA (Node 22 is compatible with current lockfile)
actions/setup-node@v4is unpinned in.github/workflows/ci.yml; pin it to a specific commit for supply-chain security.- Node compatibility:
package.jsonhas noengines, but the lockfile’snext@16.2.6requiresnode >=20.9.0, and there are noengines.nodeupper-bound constraints (no<ranges found), so Node 22 should fit the current dependencies.
🔒 Proposed fix for unpinned action
- - uses: actions/setup-node@v4
+ - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
with:
node-version: 22📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 | |
| with: | |
| node-version: 22 |
🧰 Tools
🪛 zizmor (1.25.2)
[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 16 - 18, Pin the GitHub Action
reference "actions/setup-node@v4" to an exact commit SHA to reduce supply-chain
risk; replace the floating ref "actions/setup-node@v4" in the CI workflow with
"actions/setup-node@<commit-sha>" (use the canonical commit SHA from the
actions/setup-node repo) and keep the existing node-version: 22 entry so Node 22
compatibility remains unchanged.
Source: Linters/SAST tools
- Add version: 11 to pnpm/action-setup (fixes CI failure) - Remove 'pnpm test' step — no test script exists yet - Add persist-credentials: false to checkout action Fixes CI failure and addresses CodeRabbit comments on PR #12.
CodeRabbit comments addressedFixed (3):
Skipped (1):
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 35-37: Remove the deprecated pnpm.onlyBuiltDependencies block from
package.json and instead add a root-level pnpm-workspace.yaml that enables
builds for sharp by adding an allowBuilds entry mapping sharp to true;
specifically delete the "pnpm": { "onlyBuiltDependencies": ["sharp"] } section
from package.json and create pnpm-workspace.yaml containing an allowBuilds:
sharp: true entry so pnpm v11 enforces build gating and pnpm approve-builds
recognizes the package.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 4a70c955-dede-4847-898a-01688762a0cf
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (1)
package.json
What changed
Added
.github/workflows/ci.yml— runs typecheck, test, and build on every push/PR tomain.Why
The repo has tests (
node --test) and a typecheck script but no CI. Merges could silently break either.Verification
pnpm run typecheck— passes locallypnpm test— 4/4 tests passpnpm run build— succeedsRisk
Low. CI-only change, no application code touched. If the pnpm lockfile is missing on CI, the
--frozen-lockfilestep will fail fast (correct behavior — signals the lockfile needs committing).Summary by CodeRabbit