ci: set up automated github pages deployment workflow#47
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughA new GitHub Actions workflow file ChangesDocs CI/CD Pipeline
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
.github/workflows/docs.yaml (3)
19-20: ⚡ Quick winConsider setting
persist-credentials: falsefor defense in depth.The checkout action persists the GitHub token in
.git/configby default. While this workflow doesn't upload artifacts that could leak the token, settingpersist-credentials: falseis a security best practice that reduces the attack surface.🔒 Proposed hardening
- name: Checkout repository uses: actions/checkout@v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/docs.yaml around lines 19 - 20, Add the `persist-credentials: false` parameter to the `actions/checkout@v4` action to prevent the GitHub token from being persisted in the .git/config file. This reduces the potential attack surface by ensuring credentials are not stored unnecessarily, which is a security best practice for GitHub Actions workflows.Source: Linters/SAST tools
14-17: ⚡ Quick winConsider adding a job timeout for reliability.
Without an explicit timeout, the job can run up to the repository default (often 6 hours), which could mask hanging builds. A reasonable timeout prevents resource waste and fails faster.
⏱️ Proposed enhancement
deploy: name: Deploy to GitHub Pages runs-on: ubuntu-latest + timeout-minutes: 10 steps:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/docs.yaml around lines 14 - 17, The deploy job in the workflow file lacks an explicit timeout configuration, which allows it to run indefinitely (up to the repository default of 6 hours). Add a timeout-minutes field to the deploy job definition to set a reasonable timeout limit that prevents hanging builds and resource waste. This timeout should be set at the job level, ensuring the job fails fast if it exceeds the specified duration.
20-20: ⚖️ Poor tradeoffOptional: Pin actions to commit SHAs for supply-chain security.
The static analysis tool flags unpinned action references. While semantic version tags (e.g.,
@v4) are acceptable for trusted actions, pinning to commit SHAs provides stronger supply-chain guarantees by preventing tag manipulation attacks. This is a defense-in-depth measure rather than a critical vulnerability.🔐 Example SHA pinning (verify current SHAs)
- name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0 - name: Deploy to gh-pages - uses: peaceiris/actions-gh-pages@v4 + uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0Note: Always verify SHA hashes against official releases before pinning. Consider using Dependabot to keep pinned SHAs up to date.
Also applies to: 23-23, 38-38
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/docs.yaml at line 20, The actions/checkout reference uses a semantic version tag (`@v4`) instead of being pinned to a specific commit SHA for supply-chain security. Update the uses field for the actions/checkout action to pin it to a full commit SHA instead of the version tag. This same change needs to be applied to all other unpinned action references in the workflow file (which appear at multiple locations based on the review comment).Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/docs.yaml:
- Around line 1-43: The GitHub Pages deployment workflow lacks concurrency
control, allowing multiple pushes to master to trigger parallel deployment runs
that can race and conflict when updating the gh-pages branch. Add a concurrency
configuration to the deploy job that specifies a concurrency group (using a
descriptive name like "github-pages-deployment") and explicitly set
cancel-in-progress to false to ensure queued deployments complete in order
rather than being canceled, preventing deployment conflicts and ensuring all
changes eventually get deployed.
---
Nitpick comments:
In @.github/workflows/docs.yaml:
- Around line 19-20: Add the `persist-credentials: false` parameter to the
`actions/checkout@v4` action to prevent the GitHub token from being persisted in
the .git/config file. This reduces the potential attack surface by ensuring
credentials are not stored unnecessarily, which is a security best practice for
GitHub Actions workflows.
- Around line 14-17: The deploy job in the workflow file lacks an explicit
timeout configuration, which allows it to run indefinitely (up to the repository
default of 6 hours). Add a timeout-minutes field to the deploy job definition to
set a reasonable timeout limit that prevents hanging builds and resource waste.
This timeout should be set at the job level, ensuring the job fails fast if it
exceeds the specified duration.
- Line 20: The actions/checkout reference uses a semantic version tag (`@v4`)
instead of being pinned to a specific commit SHA for supply-chain security.
Update the uses field for the actions/checkout action to pin it to a full commit
SHA instead of the version tag. This same change needs to be applied to all
other unpinned action references in the workflow file (which appear at multiple
locations based on the review comment).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 0429020e-5f18-4f4c-a61d-7a3d31bf316a
📒 Files selected for processing (1)
.github/workflows/docs.yaml
|
1 participant
📖 Description
Resolves #43.
This PR establishes a fully automated, free CI/CD pipeline to deploy the Claritty documentation website to GitHub Pages. It completely eliminates the need for manual
npm run buildandnpm run deploycommands locally.💡 What Changed
.github/workflows/docs.yaml.masterif the path iswebsite, and can also be triggered manually viaworkflow_dispatch.npmdependencies for lightning-fast future builds.website/build/.peaceiris/actions-gh-pages@v4to safely force-push the static assets to thegh-pagesbranch.Summary by CodeRabbit