Skip to content

ci: deploy documentation with reusable workflow #450

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zombieJ merged 1 commit into from
Jul 27, 2026
+15 −41
Merged

ci: deploy documentation with reusable workflow #450

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/workflows/deploy-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
name: Deploy documentation

on:
release:
types: [published]
workflow_dispatch:

permissions:
contents: read
pages: write
id-token: write

jobs:
deploy:
uses: react-component/rc-test/.github/workflows/deploy-pages.yml@main

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow files =="
git ls-files '.github/workflows/*' || true

echo
echo "== deploy-pages.yml =="
if [ -f .github/workflows/deploy-pages.yml ]; then
  cat -n .github/workflows/deploy-pages.yml
fi

echo
echo "== reusable workflow references =="
rg -n "uses:\s*[^\\n]*\\.github/workflows/.+\\.ya?ml|@["'\'']|permissions:" .github/workflows || true

Repository: react-component/collapse

Length of output: 798

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== repo metadata =="
git rev-parse HEAD
git rev-parse --show-toplevel
git status --short
git branch --show-current

echo
echo "== workflow references with permissions =="
python3 - <<'PY'
from pathlib import Path
for p in sorted(Path('.github/workflows').glob('*.yml')):
    if p.name == 'deploy-pages.yml':
        print(f"\n--- {p} ---")
        print(p.read_text())
PY

echo
echo "== remote tag pins in other workflows =="
rg -n "uses: .*@|permissions:|react-component/rc-test" .github/workflows || true

Repository: react-component/collapse

Length of output: 1424

将复用工作流固定到已审查的提交 SHA。

.github/workflows/deploy-pages.yml 以 @main 引用 react-component/rc-test/.github/workflows/deploy-pages.yml，且该工作流拥有 pages: write 和 id-token: write。分支更新会未经审核就改变部署行为，增加跨仓库供应链风险；改用固定的 commit SHA 并建立后续更新机制。

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-pages.yml at line 15, 将 deploy-pages.yml 中复用工作流的
`@main` 引用替换为已审查的完整 commit SHA，确保 pages: write 和 id-token: write
权限对应的工作流内容不会随分支更新而变化；同时记录该依赖的来源并建立后续定期审查和更新 SHA 的机制。

Source: Learnings

41 changes: 0 additions & 41 deletions .github/workflows/site-deploy.yml
View file
Open in desktop

This file was deleted.

Loading