Skip to content

Add Deno workflow for linting and testing #4259

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
riyadislam123 wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Add Deno workflow for linting and testing #4259

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions .github/workflows/deno.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# This workflow will install Deno then run `deno lint` and `deno test`.
# For more information see: https://github.com/denoland/setup-deno

name: Deno

on:
push:
branches: ["master"]
pull_request:
branches: ["master"]

permissions:
contents: read

jobs:
test:
runs-on: ubuntu-latest

steps:
- name: Setup repo
uses: actions/checkout@v4
Comment on lines +25 to +26

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- workflow excerpt ---\n'
sed -n '1,120p' .github/workflows/deno.yml 2>/dev/null || true

printf '\n--- checkout usages in workflows ---\n'
rg -n "actions/checkout|persist-credentials|deno test|mocha|jest|npm test|yarn test" .github/workflows 2>/dev/null || true

printf '\n--- action checkout v4 docs availability? ---\n'
python3 - <<'PY'
import urllib.request
url="https://raw.githubusercontent.com/actions/checkout/v4/README.md"
try:
    text=urllib.request.urlopen(url, timeout=15).read().decode()
    print("README found", len(text))
    for term in ["persist-credentials", "This action", "git config", "credential"]:
        print(term, ":", term.lower() in text.lower())
    lines=text.splitlines()
    for i,l in enumerate(lines):
        if "persist-credentials" in l.lower() or "default" in l.lower():
            print(f"{i+1}: {l[:220]}")
except Exception as e:
    print(type(e).__name__, e)
PY

Repository: TeamPiped/Piped

Length of output: 244

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '%s\n' '--- workflow excerpt ---'
sed -n '1,120p' .github/workflows/deno.yml 2>/dev/null || true

printf '%s\n' ''
printf '%s\n' '--- checkout usage and test/script steps ---'
rg -n "actions/checkout|persist-credentials|deno test|mocha|jest|npm test|yarn test|scripts/|pnpm test" .github/workflows 2>/dev/null || true

printf '%s\n' ''
printf '%s\n' '--- action checkout v4 README default ---'
python3 - <<'PY'
import urllib.request
url="https://raw.githubusercontent.com/actions/checkout/v4/README.md"
try:
    text=urllib.request.urlopen(url, timeout=15).read().decode()
    print("README bytes:", len(text))
    idx=text.lower().find("persist-credentials")
    print("mentions persist-credentials:", idx != -1)
    if idx != -1 and idx > 200:
        start=max(0, idx-500)
        end=min(len(text), idx+700)
        print(text[start:end])
except Exception as e:
    print(type(e).__name__, e)
PY

Repository: TeamPiped/Piped

Length of output: 2144

🌐 Web query:

actions/checkout v4 README persist-credentials default true

💡 Result:

In the actions/checkout v4 action, the persist-credentials input defaults to true [1][2]. When set to true (the default), the action configures the authentication token or SSH key in the local git configuration [3][4]. This allows subsequent git commands executed within your workflow steps to use these credentials automatically [3][5]. The token is removed during the post-job cleanup process [3][4]. If you wish to prevent this behavior for security reasons or because it is not needed, you can explicitly set persist-credentials to false in your workflow configuration [3][4]. Example usage: - uses: actions/checkout@v4 with: persist-credentials: false

Citations:

Disable checkout credential persistence.

actions/checkout@v4 persists the GitHub token in local Git configuration by default. The later deno test -A step runs PR-controlled code that can read .git/config and exfiltrate the read-only token. Set persist-credentials: false, since this job has no authenticated Git operations after checkout.

🔒 Proposed fix 
       - name: Setup repo
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Setup repo
uses: actions/checkout@v4
- name: Setup repo
uses: actions/checkout@v4
with:
persist-credentials: false
🧰 Tools
🪛 zizmor (1.28.0)

[warning] 25-26: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deno.yml around lines 25 - 26, Update the
actions/checkout@v4 step in the workflow to set persist-credentials to false,
preventing the GitHub token from being stored in local Git configuration before
the deno test -A step runs.

Source: Linters/SAST tools


- name: Setup Deno
# uses: denoland/setup-deno@v1
uses: denoland/setup-deno@61fe2df320078202e33d7d5ad347e7dcfa0e8f31 # v1.1.2
with:
deno-version: v1.x

# Uncomment this step to verify the use of 'deno fmt' on each commit.
# - name: Verify formatting
# run: deno fmt --check

- name: Run linter
run: deno lint

- name: Run tests
run: deno test -A
Comment on lines +38 to +42

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "Deno configuration and version files:"
fd -HI -t f \
  -g 'deno.json' \
  -g 'deno.jsonc' \
  -g 'deno.lock' \
  -g '.dvmrc' \
  -g '.tool-versions' . || true

echo "Deno test candidates:"
rg --files -g '!node_modules/**' -g '!dist/**' |
  rg '(^|/)(__tests__/|.*(_test|\.test)\.(ts|tsx|mts|js|mjs|jsx)$)' || true

echo "Declared package scripts:"
rg -n '"(scripts|lint|test|build)"|eslint|jest|vite' package.json

Repository: TeamPiped/Piped

Length of output: 1162

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Relevant files:"
git ls-files | sed -n '1,220p' | rg '(^|/)(deno\.jsonc?$|package\.json$|.*test\.(ts|tsx|js|jsx|mjs|mts)$|.*(_test).*\.(ts|tsx|js|jsx|mjs|mts)$|__tests__/.*\.(ts|tsx|js|jsx|mjs|mts)|\.github/workflows/deno\.yml$)' || true

echo
echo ".github/workflows/deno.yml:"
if [ -f .github/workflows/deno.yml ]; then
  cat -n .github/workflows/deno.yml
else
  echo "missing"
fi

echo
echo "package.json scripts:"
python3 - <<'PY'
import json
from pathlib import Path
p=Path('package.json')
if not p.exists():
    print('missing')
else:
    data=json.loads(p.read_text())
    print(json.dumps(data.get('scripts', {}), indent=2, sort_keys=True))
PY

echo
echo "Potential Deno commands/config references:"
rg --hidden --glob '!node_modules/**' --glob '!dist/**' --glob '!coverage/**' '(deno\.jsonc?$|DENO|deno lint|deno test|deno run|deno cache|deno fmt)' || true

Repository: TeamPiped/Piped

Length of output: 1786

Run the repository’s declared checks instead of Deno-only commands.

.github/workflows/deno.yml has no deno.json/deno.lock or Deno test candidates and does not install Node dependencies, but package.json defines npm run lint. Run the project’s declared checks, or remove this workflow if Deno is not part of the repo setup.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deno.yml around lines 38 - 42, Update the workflow steps
around “Run linter” and “Run tests” to use the repository’s declared package
scripts, including npm run lint and the appropriate package-defined test
command, after installing Node dependencies; alternatively remove the Deno
workflow if Deno is not part of the project setup. Do not retain Deno-only
commands.

Comment on lines +41 to +42

@coderabbitai coderabbitai Bot Aug 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '--- workflow excerpt ---\n'
if [ -f .github/workflows/deno.yml ]; then
  nl -ba .github/workflows/deno.yml | sed -n '1,140p'
else
  echo ".github/workflows/deno.yml not found"
fi

printf '\n--- test commands using deno test / permissions ---\n'
rg -n "deno test|allow-" .github deno.json deno.jsonc src test tests scripts 2>/dev/null || true

printf '\n--- tracked relevant files ---\n'
git ls-files | sed -n '1,200p' | grep -E '(^\.github/workflows/deno\.yml$|deno\.(json|jsonc)|test|tests)' || true

Repository: TeamPiped/Piped

Length of output: 244

🏁 Script executed:

#!/bin/bash
set -euo pipefail

cat -n .github/workflows/deno.yml | sed -n '1,140p'

printf '\n--- test commands using deno test / permissions ---\n'
rg -n "deno test|allow-" .github deno.json deno.jsonc src test tests scripts 2>/dev/null || true

printf '\n--- tracked relevant files ---\n'
git ls-files | grep -E '(^\.github/workflows/deno\.yml$|deno\.(json|jsonc)|test|tests)' || true

Repository: TeamPiped/Piped

Length of output: 1721

Remove blanket permissions from pull-request tests.

-A grants all Deno permissions, which allows test code to request filesystem, environment, network, subprocess, and FFI access. Use only the --allow-* flags required by the test suite.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deno.yml around lines 41 - 42, Update the “Run tests”
workflow step to remove Deno’s blanket -A permission and replace it with only
the specific --allow-* flags required by the test suite, preserving the existing
test command and behavior.

Loading