Add React Doctor to GitHub Actions - #1
Conversation
📝 WalkthroughWalkthroughA new GitHub Actions workflow file ChangesReact Doctor CI Workflow
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
No React Doctor issues found. 🎉 Reviewed by React Doctor for commit |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/react-doctor.yml:
- Around line 32-34: The GitHub Actions workflow uses mutable action tags which
creates supply-chain risk and leaves credentials persisted in the checkout step.
Replace the mutable tags `@v5` for actions/checkout and `@v2` for
millionco/react-doctor with pinned commit SHAs to lock these dependencies to
specific versions. Additionally, add `persist-credentials: false` as a
configuration option to the actions/checkout action to disable credential
persistence and prevent unnecessary exposure of the workflow token to subsequent
steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 919479b8-0049-433b-922f-e82fefb9b439
📒 Files selected for processing (1)
.github/workflows/react-doctor.yml
| - uses: actions/checkout@v5 | ||
|
|
||
| - uses: millionco/react-doctor@v2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify all workflow actions are SHA-pinned and checkout disables persisted credentials.
set -euo pipefail
echo "== Action references in workflows =="
rg -n '^\s*-\s*uses:\s*' .github/workflows || true
echo
echo "== Non-SHA-pinned actions (should be empty after fix) =="
rg -nP '^\s*-\s*uses:\s*[^@\s]+@(?![0-9a-fA-F]{40}\b)' .github/workflows || true
echo
echo "== checkout steps missing persist-credentials: false (should be empty after fix) =="
python - <<'PY'
from pathlib import Path
import re
for path in Path(".github/workflows").glob("*.y*ml"):
text = path.read_text(encoding="utf-8")
for m in re.finditer(r'(^\s*-\s*uses:\s*actions/checkout@[^\n]+\n(?:^\s+.*\n)*)', text, re.M):
block = m.group(1)
if "persist-credentials: false" not in block:
line = text[:m.start()].count("\n") + 1
print(f"{path}:{line}")
PYRepository: ametel01/okf-dashboard
Length of output: 584
Pin third-party actions by commit SHA and disable credential persistence in checkout.
Lines 32–34 use mutable action tags (@v5, @v2), which creates supply-chain risk. Additionally, actions/checkout@v5 leaves credentials persisted by default, unnecessarily exposing the workflow token to later steps.
Suggested hardening patch
- - uses: actions/checkout@v5
+ - uses: actions/checkout@<PINNED_SHA_FOR_V5>
+ with:
+ persist-credentials: false
- - uses: millionco/react-doctor@v2
+ - uses: millionco/react-doctor@<PINNED_SHA_FOR_V2>🧰 Tools
🪛 zizmor (1.25.2)
[warning] 32-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 32-32: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 34-34: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/react-doctor.yml around lines 32 - 34, The GitHub Actions
workflow uses mutable action tags which creates supply-chain risk and leaves
credentials persisted in the checkout step. Replace the mutable tags `@v5` for
actions/checkout and `@v2` for millionco/react-doctor with pinned commit SHAs to
lock these dependencies to specific versions. Additionally, add
`persist-credentials: false` as a configuration option to the actions/checkout
action to disable credential persistence and prevent unnecessary exposure of the
workflow token to subsequent steps.
Source: Linters/SAST tools
|
Closing this stale PR as part of cleanup. |
1 participant
Adds a React Doctor scan to every pull request and every push to the default branch. The workflow file is documented inline.
Docs: https://www.react.doctor/ci
Summary by CodeRabbit