Skip to content

ci: add GitHub Actions workflow - #12

Merged
TargiX merged 6 commits into
mainfrom
ci/add-github-actions
Jun 7, 2026
Merged

TargiX merged 6 commits into
mainfrom
ci/add-github-actions

Conversation

@TargiX

@TargiX TargiX commented Jun 7, 2026 •

Copy link
Copy Markdown
Owner

What changed

Added .github/workflows/ci.yml — runs typecheck, test, and build on every push/PR to main.

Why

The repo has tests (node --test) and a typecheck script but no CI. Merges could silently break either.

Verification

  • pnpm run typecheck — passes locally
  • pnpm test — 4/4 tests pass
  • pnpm run build — succeeds

Risk

Low. CI-only change, no application code touched. If the pnpm lockfile is missing on CI, the --frozen-lockfile step will fail fast (correct behavior — signals the lockfile needs committing).

Summary by CodeRabbit

  • Chores
    • Automated code quality checks through GitHub Actions continuous integration, which validates code type safety and successfully builds on every push to the main branch and pull request
    • Configured workspace to enable proper support for build tool dependencies required by the project

- Typecheck, test, and build on push/PR to main
- Uses pnpm with frozen lockfile for reproducible installs
- Node 22 LTS
@vercel

vercel Bot commented Jun 7, 2026 •

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
roomboard-showcase Ready Ready Preview, Comment Jun 7, 2026 10:41am

@coderabbitai

coderabbitai Bot commented Jun 7, 2026 •

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0d047002-0919-43be-9945-c08d0ddba8a5

📥 Commits

Reviewing files that changed from the base of the PR and between 5923696 and 1f001fd.

📒 Files selected for processing (2)
  • .github/workflows/ci.yml
  • pnpm-workspace.yaml
✅ Files skipped from review due to trivial changes (1)
  • pnpm-workspace.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
  • .github/workflows/ci.yml

📝 Walkthrough

Walkthrough

This PR introduces continuous integration infrastructure by adding a GitHub Actions workflow that runs typecheck and build commands on push and pull request events targeting the main branch, along with pnpm workspace configuration to enable Sharp builds.

Changes

CI Pipeline and Workspace Configuration

Layer / File(s) Summary
GitHub Actions CI workflow
.github/workflows/ci.yml
Defines a workflow triggered on push and pull_request to main with a check job that sets up Node.js 22 and pnpm v11.0.7, installs dependencies with a frozen lockfile, then runs pnpm run typecheck and pnpm run build sequentially.
Workspace build configuration
pnpm-workspace.yaml
Enables Sharp-related builds in the workspace by setting allowBuilds.sharp: true.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 A workflow springs to life with GitHub's grace,
Node and pnpm dancing in their place,
Sharp builds now allowed in workspace terrain,
CI checks shall run again and again!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'ci: add GitHub Actions workflow' accurately summarizes the main change: adding a CI workflow file (.github/workflows/ci.yml) to the repository.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch ci/add-github-actions

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Line 14: Update the checkout step to harden security by adding
persist-credentials: false to the actions/checkout usage (replace or augment the
existing actions/checkout@v4 invocation) and pin the action to an immutable
commit SHA instead of the mutable tag (e.g., use actions/checkout@<commit-sha>)
to reduce supply-chain risk; ensure the workflow entry for actions/checkout
includes the persist-credentials field and the new pinned reference.
- Around line 28-29: The CI is failing because the workflow step named "Test"
runs "pnpm test" but root package.json has no "test" script; either add a "test"
script to package.json (e.g., map it to an existing script like "typecheck" or a
real test runner) or change the workflow step that currently runs "pnpm test" to
call an existing script such as "pnpm typecheck", "pnpm smoke", or remove the
step entirely; update the workflow entry with the new command or add a "test"
entry in package.json accordingly so "pnpm test" no longer errors.
- Line 20: Pin the pnpm action and explicitly set the pnpm version: replace the
floating reference `pnpm/action-setup@v4` with an immutable commit SHA like
`pnpm/action-setup@<commit-sha>` and add the `with: version: "<pnpm-version>"`
input to the action invocation so CI installs a known pnpm release;
alternatively add a `packageManager` field in package.json (e.g.
"packageManager": "pnpm@<pnpm-version>") and still prefer pinning
`pnpm/action-setup` to a commit SHA rather than a moving tag.
- Around line 16-18: Pin the GitHub Action reference "actions/setup-node@v4" to
an exact commit SHA to reduce supply-chain risk; replace the floating ref
"actions/setup-node@v4" in the CI workflow with
"actions/setup-node@<commit-sha>" (use the canonical commit SHA from the
actions/setup-node repo) and keep the existing node-version: 22 entry so Node 22
compatibility remains unchanged.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d281eefb-2aeb-412f-8f98-d19b98ea5adb

📥 Commits

Reviewing files that changed from the base of the PR and between 0af5c07 and 6384fdf.

📒 Files selected for processing (1)
  • .github/workflows/ci.yml

Comment thread .github/workflows/ci.yml
Comment thread .github/workflows/ci.yml
Comment on lines +16 to +18
- uses: actions/setup-node@v4
with:
node-version: 22

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Check package.json for engines field and verify Node.js compatibility

# Check for engines field in package.json
echo "=== Checking package.json engines field ==="
jq -r '.engines // "No engines field defined"' package.json

# Check if pnpm-lock.yaml or .nvmrc specifies Node.js version
echo -e "\n=== Checking for .nvmrc or .node-version ==="
if [ -f .nvmrc ]; then
  echo ".nvmrc found:"
  cat .nvmrc
fi
if [ -f .node-version ]; then
  echo ".node-version found:"
  cat .node-version
fi

Repository: TargiX/flux-graph-pixi

Length of output: 181


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== ci.yml setup-node usage ==="
nl -ba .github/workflows/ci.yml | sed -n '1,120p' | sed -n 's/^[[:space:]]*//'p >/dev/null || true
# Print just the relevant lines around the specified snippet (lines 10-30 in file)
nl -ba .github/workflows/ci.yml | sed -n '10,30p'

echo
echo "=== package.json engines field ==="
cat package.json | jq -r '.engines // "No engines field defined"'

echo
echo "=== project Node version hints (.nvmrc / .node-version / engines-like configs) ==="
ls -la .nvmrc .node-version 2>/dev/null || true
echo
echo "Searching for node-version usage in workflows..."
rg -n "node-version|setup-node@|actions/setup-node" .github/workflows -S || true

echo
echo "=== package.json key deps (to reason about Node compatibility) ==="
cat package.json | jq -r '{dependencies, devDependencies, packageManager, engines: (.engines // null)}'

echo
echo "=== lockfile (if present) version manager and Node hints ==="
ls -ლა package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null || true
if [ -f package-lock.json ]; then head -n 20 package-lock.json; fi
if [ -f pnpm-lock.yaml ]; then head -n 40 pnpm-lock.yaml; fi
if [ -f yarn.lock ]; then head -n 20 yarn.lock; fi

Repository: TargiX/flux-graph-pixi

Length of output: 200


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== ci.yml (first 120 lines) ==="
sed -n '1,120p' .github/workflows/ci.yml

echo
echo "=== ci.yml lines 10-30 (for setup-node context) ==="
awk 'NR>=10 && NR<=30 {printf "%d:%s\n", NR, $0}' .github/workflows/ci.yml

echo
echo "=== package.json engines field ==="
cat package.json | jq -r '.engines // "No engines field defined"'

echo
echo "=== package.json packageManager (if any) ==="
cat package.json | jq -r '.packageManager // "No packageManager field"' || true

echo
echo "=== package.json deps (top-level) ==="
cat package.json | jq -r '{dependencies, devDependencies}'

echo
echo "=== .nvmrc / .node-version ==="
ls -la .nvmrc .node-version 2>/dev/null || true
[ -f .nvmrc ] && echo ".nvmrc:" && cat .nvmrc
[ -f .node-version ] && echo ".node-version:" && cat .node-version

echo
echo "=== search for actions/setup-node usage ==="
rg -n "actions/setup-node" .github/workflows -S || true

echo
echo "=== lockfiles present ==="
ls -la package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null || true

Repository: TargiX/flux-graph-pixi

Length of output: 2081


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "=== Search package-lock.json for engines/node constraints ==="
rg -n '"engines"' package-lock.json -S || true
echo
rg -n '"node"' package-lock.json -S || true
echo
rg -n '"next"' package-lock.json -S || true

echo
echo "=== Quick peek: next package entry in lockfile ==="
python3 - <<'PY'
import json
from pathlib import Path

p = Path("package-lock.json")
data = json.loads(p.read_text())
pkgs = data.get("packages", {}) if isinstance(data, dict) else {}
# Try common keys for next
candidates = [k for k in pkgs.keys() if k.endswith("node_modules/next")]
print("next candidates:", candidates[:10])
for k in candidates[:3]:
    v = pkgs[k].get("version")
    eng = pkgs[k].get("engines")
    print("\nKey:", k)
    print("version:", v)
    print("engines:", eng)
PY

Repository: TargiX/flux-graph-pixi

Length of output: 3268


🏁 Script executed:

#!/bin/bash
set -euo pipefail
echo "=== package-lock.json: engines.node constraints containing '<' ==="
rg -n '"node"\s*:\s*"[^"]*[<][^"]*"' package-lock.json -S || true

echo
echo "=== package-lock.json: engines.node constraints containing '22' ==="
rg -n '"node"\s*:\s*"[^"]*22[^"]*"' package-lock.json -S || true

echo
echo "=== package-lock.json: any engines.node constraints that explicitly cap Node (<20, <=21, etc) ==="
rg -n '"node"\s*:\s*"[^"]*(<=|<)\s*2[01][0-9][^"]*"' package-lock.json -S || true

Repository: TargiX/flux-graph-pixi

Length of output: 301


🌐 Web query:

actions/setup-node v4.1.0 39370e3970a6d050c480ffad4ff0ed4d3fdee5af

💡 Result:

The commit hash 39370e3970a6d050c480ffad4ff0ed4d3fdee5af corresponds to the release of version v4.1.0 of the actions/setup-node GitHub Action [1][2][3]. This release, published on October 24, 2024, introduced several updates, most notably a change to the caching mechanism [1]. By adding the architecture (arch) to the cache key, the update ensures that cache keys are more accurate, which helps prevent potential conflicts between different architectures [1][4][5]. As a result of this change, previous cache keys created by earlier versions of the action are no longer compatible [1][3][5]. Additionally, version v4.1.0 included general maintenance updates, such as resolving high-security alerts by upgrading dependencies, revising logic for GitHub Enterprise Server (GHES), and upgrading the IA publish process [1][3].

Citations:


Pin actions/setup-node@v4 to a commit SHA (Node 22 is compatible with current lockfile)

  • actions/setup-node@v4 is unpinned in .github/workflows/ci.yml; pin it to a specific commit for supply-chain security.
  • Node compatibility: package.json has no engines, but the lockfile’s next@16.2.6 requires node >=20.9.0, and there are no engines.node upper-bound constraints (no < ranges found), so Node 22 should fit the current dependencies.
🔒 Proposed fix for unpinned action
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
         with:
           node-version: 22
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- uses: actions/setup-node@v4
with:
node-version: 22
- uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
with:
node-version: 22
🧰 Tools
🪛 zizmor (1.25.2)

[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 16 - 18, Pin the GitHub Action
reference "actions/setup-node@v4" to an exact commit SHA to reduce supply-chain
risk; replace the floating ref "actions/setup-node@v4" in the CI workflow with
"actions/setup-node@<commit-sha>" (use the canonical commit SHA from the
actions/setup-node repo) and keep the existing node-version: 22 entry so Node 22
compatibility remains unchanged.

Source: Linters/SAST tools

Comment thread .github/workflows/ci.yml
Comment thread .github/workflows/ci.yml Outdated
- Add version: 11 to pnpm/action-setup (fixes CI failure)
- Remove 'pnpm test' step — no test script exists yet
- Add persist-credentials: false to checkout action

Fixes CI failure and addresses CodeRabbit comments on PR #12.
@TargiX

TargiX commented Jun 7, 2026

Copy link
Copy Markdown
Owner Author

CodeRabbit comments addressed

Fixed (3):

  1. ✅ persist-credentials: false added to checkout
  2. ✅ Explicit version: 11 added to pnpm/action-setup (also fixes CI failure)
  3. ✅ Removed pnpm test step — no test script in package.json yet

Skipped (1):

  • Add engines/packageManager to package.json — good practice but not blocking; CI works with explicit version in the workflow. Can be added separately.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Around line 35-37: Remove the deprecated pnpm.onlyBuiltDependencies block from
package.json and instead add a root-level pnpm-workspace.yaml that enables
builds for sharp by adding an allowBuilds entry mapping sharp to true;
specifically delete the "pnpm": { "onlyBuiltDependencies": ["sharp"] } section
from package.json and create pnpm-workspace.yaml containing an allowBuilds:
sharp: true entry so pnpm v11 enforces build gating and pnpm approve-builds
recognizes the package.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 4a70c955-dede-4847-898a-01688762a0cf

📥 Commits

Reviewing files that changed from the base of the PR and between 27fdb1c and 5923696.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (1)
  • package.json

Comment thread package.json Outdated
@TargiX
TargiX merged commit ee3326a into main Jun 7, 2026
4 checks passed

This branch was successfully deployed

1 active deployment
Preview — 1f001fd9 Deployed Jun 7, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant