ci: Replace third-party GitHub Actions with trusted alternatives#521
Conversation
|
🚀 Thanks for opening this pull request! We appreciate your effort in improving the project. Please let us know once your pull request is ready for review. Tip
Note Please respond to review comments from AI agents just like you would to comments from a human reviewer. Let the reviewer resolve their own comments, unless they have reviewed and accepted your commit, or agreed with your explanation for why the feedback was incorrect. Caution Pull requests must be written using an AI agent with human supervision. Pull requests written entirely by a human will likely be rejected, because of lower code quality, higher review effort and the higher risk of introducing bugs. Please note that AI review comments on this pull request alone do not satisfy this requirement. |
📝 WalkthroughWalkthroughThree GitHub Actions workflows updated: npm lockfile version checking now uses an inline shell script instead of a third-party action; documentation publishing migrated from Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 actionlint (1.7.12).github/workflows/ci.ymlcould not read ".github/workflows/ci.yml": open .github/workflows/ci.yml: no such file or directory .github/workflows/release-automated.ymlcould not read ".github/workflows/release-automated.yml": open .github/workflows/release-automated.yml: no such file or directory .github/workflows/release-manual-docs.ymlcould not read ".github/workflows/release-manual-docs.yml": open .github/workflows/release-manual-docs.yml: no such file or directory 🔧 YAMLlint (1.38.0).github/workflows/ci.yml[Errno 2] No such file or directory: '.github/workflows/ci.yml' .github/workflows/release-automated.yml[Errno 2] No such file or directory: '.github/workflows/release-automated.yml' .github/workflows/release-manual-docs.yml[Errno 2] No such file or directory: '.github/workflows/release-manual-docs.yml' 🔧 Checkov (3.2.513).github/workflows/release-manual-docs.yml2026-04-04 18:27:54,612 [MainThread ] [ERROR] Template file not found: .github/workflows/release-manual-docs.yml ... [truncated 9283 characters] ... file .github/workflows/release-manual-docs.yml .github/workflows/ci.yml2026-04-04 18:27:54,661 [MainThread ] [ERROR] Template file not found: .github/workflows/ci.yml ... [truncated 8994 characters] ... Secret scanning: could not process file .github/workflows/ci.yml .github/workflows/release-automated.yml2026-04-04 18:27:54,611 [MainThread ] [ERROR] Template file not found: .github/workflows/release-automated.yml ... [truncated 9249 characters] ... cess file .github/workflows/release-automated.yml Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/release-automated.yml (1)
33-35: Includecontents: readin job permissions.This job checks out source at Line 40; adding
contents: readmakes permission scope explicit and avoids token-related checkout surprises.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/release-automated.yml around lines 33 - 35, The permissions block in the workflow currently grants only pages: write and id-token: write; add an explicit contents: read permission to the same permissions map so the checkout step (uses: actions/checkout) can reliably read repository files. Update the permissions section to include contents: read alongside pages and id-token to make the token scope explicit and prevent checkout-related token errors..github/workflows/release-manual-docs.yml (1)
16-18: Addcontents: readto the job permissions.The GitHub Actions official documentation for
actions/checkoutexplicitly recommends this permission when job-level permissions are explicitly set. This ensures proper functionality and follows security best practices.Suggested patch
permissions: + contents: read pages: write id-token: write🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/release-manual-docs.yml around lines 16 - 18, The job-level permissions block currently lists pages: write and id-token: write but is missing contents: read; update the permissions map by adding contents: read alongside pages and id-token so the actions/checkout action works correctly when job permissions are explicitly set—ensure the keys permissions, pages, id-token and contents are present in the same permissions block.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/release-automated.yml:
- Around line 33-35: The permissions block in the workflow currently grants only
pages: write and id-token: write; add an explicit contents: read permission to
the same permissions map so the checkout step (uses: actions/checkout) can
reliably read repository files. Update the permissions section to include
contents: read alongside pages and id-token to make the token scope explicit and
prevent checkout-related token errors.
In @.github/workflows/release-manual-docs.yml:
- Around line 16-18: The job-level permissions block currently lists pages:
write and id-token: write but is missing contents: read; update the permissions
map by adding contents: read alongside pages and id-token so the
actions/checkout action works correctly when job permissions are explicitly
set—ensure the keys permissions, pages, id-token and contents are present in the
same permissions block.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 56af0766-c2a9-48cb-8437-dd6396c1074e
📒 Files selected for processing (3)
.github/workflows/ci.yml.github/workflows/release-automated.yml.github/workflows/release-manual-docs.yml
1 participant
Summary
Replace untrusted third-party GitHub Actions with official alternatives to reduce supply chain attack surface.
Changes
mansona/npm-lockfile-versionwith inline lockfile version checkpeaceiris/actions-gh-pageswith officialactions/configure-pages+actions/upload-pages-artifact+actions/deploy-pagespipelineNote
The repository Pages source setting must be changed to "GitHub Actions" in Settings > Pages.
Summary by CodeRabbit