ci: deploy documentation with reusable workflow - #450
Conversation
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Walkthrough新增 GitHub Pages 文档部署工作流,支持发布和手动触发,使用最小权限并复用外部部署逻辑;同时移除旧的网站部署工作流。 ChangesGitHub Pages 部署
Estimated code review effort: 1 (Trivial) | ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
React Doctor could not complete this scan.
Reviewed by React Doctor for commit |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #450 +/- ##
=======================================
Coverage 99.19% 99.19%
=======================================
Files 5 5
Lines 124 124
Branches 45 45
=======================================
Hits 123 123
Misses 1 1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
❌ Deploy failed
📋 Build log (last lines)🤖 Powered by surge-preview |
|||||||||
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deploy-pages.yml:
- Line 15: 将 deploy-pages.yml 中复用工作流的 `@main` 引用替换为已审查的完整 commit SHA,确保 pages:
write 和 id-token: write 权限对应的工作流内容不会随分支更新而变化;同时记录该依赖的来源并建立后续定期审查和更新 SHA 的机制。
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: f6bdbfb4-e44c-4a93-bc2c-b7736f477be7
📒 Files selected for processing (2)
.github/workflows/deploy-pages.yml.github/workflows/site-deploy.yml
💤 Files with no reviewable changes (1)
- .github/workflows/site-deploy.yml
|
|
||
| jobs: | ||
| deploy: | ||
| uses: react-component/rc-test/.github/workflows/deploy-pages.yml@main |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files '.github/workflows/*' || true
echo
echo "== deploy-pages.yml =="
if [ -f .github/workflows/deploy-pages.yml ]; then
cat -n .github/workflows/deploy-pages.yml
fi
echo
echo "== reusable workflow references =="
rg -n "uses:\s*[^\\n]*\\.github/workflows/.+\\.ya?ml|@["'\'']|permissions:" .github/workflows || trueRepository: react-component/collapse
Length of output: 798
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repo metadata =="
git rev-parse HEAD
git rev-parse --show-toplevel
git status --short
git branch --show-current
echo
echo "== workflow references with permissions =="
python3 - <<'PY'
from pathlib import Path
for p in sorted(Path('.github/workflows').glob('*.yml')):
if p.name == 'deploy-pages.yml':
print(f"\n--- {p} ---")
print(p.read_text())
PY
echo
echo "== remote tag pins in other workflows =="
rg -n "uses: .*@|permissions:|react-component/rc-test" .github/workflows || trueRepository: react-component/collapse
Length of output: 1424
将复用工作流固定到已审查的提交 SHA。
.github/workflows/deploy-pages.yml 以 @main 引用 react-component/rc-test/.github/workflows/deploy-pages.yml,且该工作流拥有 pages: write 和 id-token: write。分支更新会未经审核就改变部署行为,增加跨仓库供应链风险;改用固定的 commit SHA 并建立后续更新机制。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy-pages.yml at line 15, 将 deploy-pages.yml 中复用工作流的
`@main` 引用替换为已审查的完整 commit SHA,确保 pages: write 和 id-token: write
权限对应的工作流内容不会随分支更新而变化;同时记录该依赖的来源并建立后续定期审查和更新 SHA 的机制。
Source: Learnings

Summary
Verification
ut --registry https://registry.npmjs.org/GH_PAGES=1 ut run buildSummary by CodeRabbit
新功能
变更