fix: tidy up files #2531
fix: tidy up files #2531
Conversation
WalkthroughThis pull request contains three primary changes: migration of Docker Compose file paths in GitHub Actions workflows (moving from Estimated code review effort🎯 4 (Complex) | ⏱️ ~50–70 minutes
Pre-merge checks and finishing touches❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (1 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
package.json (1)
31-31: Remove duplicateposthog-jsfrom devDependenciesA duplicate
posthog-jsexists with different versions:^1.210.2in dependencies (line 31) and^1.204.0in devDependencies (line 89). Remove it from devDependencies and keep the higher version in dependencies.
🧹 Nitpick comments (8)
.github/workflows/staging.yml (3)
21-27: Rename step to reflect GHCR, not DockerHubYou’re logging into ghcr.io. Rename for clarity.
- - name: Login to DockerHub + - name: Login to GHCR
35-51: Pass tokens as BuildKit secrets, not build-argsGITHUB_TOKEN, SENTRY_AUTH_TOKEN, and Appwrite keys should be secrets to avoid leaking into image layers.
build-args: | "PUBLIC_APPWRITE_ENDPOINT=${{ vars.PUBLIC_APPWRITE_ENDPOINT }}" "PUBLIC_APPWRITE_DASHBOARD=${{ vars.PUBLIC_APPWRITE_DASHBOARD }}" "PUBLIC_APPWRITE_PROJECT_ID=${{ vars.PUBLIC_APPWRITE_PROJECT_ID }}" "PUBLIC_APPWRITE_DB_MAIN_ID=${{ vars.PUBLIC_APPWRITE_DB_MAIN_ID }}" "PUBLIC_APPWRITE_COL_THREADS_ID=${{ vars.PUBLIC_APPWRITE_COL_THREADS_ID }}" "PUBLIC_APPWRITE_COL_MESSAGES_ID=${{ vars.PUBLIC_APPWRITE_COL_MESSAGES_ID }}" "PUBLIC_APPWRITE_FN_TLDR_ID=${{ vars.PUBLIC_APPWRITE_FN_TLDR_ID }}" "PUBLIC_APPWRITE_PROJECT_INIT_ID=${{ vars.PUBLIC_APPWRITE_PROJECT_INIT_ID }}" "PUBLIC_GROWTH_ENDPOINT=${{ vars.PUBLIC_GROWTH_ENDPOINT }}" "PUBLIC_POSTHOG_API_KEY=${{ vars.PUBLIC_POSTHOG_API_KEY }}" - "APPWRITE_DB_INIT_ID=${{ secrets.APPWRITE_DB_INIT_ID }}" - "APPWRITE_COL_INIT_ID=${{ secrets.APPWRITE_COL_INIT_ID }}" - "APPWRITE_API_KEY_INIT=${{ secrets.APPWRITE_API_KEY_INIT }}" - "GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}" - "SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}" + secrets: | + "APPWRITE_DB_INIT_ID=${{ secrets.APPWRITE_DB_INIT_ID }}" + "APPWRITE_COL_INIT_ID=${{ secrets.APPWRITE_COL_INIT_ID }}" + "APPWRITE_API_KEY_INIT=${{ secrets.APPWRITE_API_KEY_INIT }}" + "GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}" + "SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}"Follow-up: update Dockerfile to use RUN --mount=type=secret,id=… to consume these.
1-7: Set explicit permissions for GHCR pushHarden defaults and ensure packages: write is available.
name: Staging deployment on: workflow_dispatch: push: branches: - main +permissions: + contents: read + packages: write.github/workflows/production.yml (3)
21-27: Rename to GHCR loginSame as staging.
- - name: Login to DockerHub + - name: Login to GHCR
35-51: Use BuildKit secrets for tokens/keysMove sensitive args to secrets. Keep SENTRY_RELEASE as build-arg.
build-args: | "PUBLIC_APPWRITE_ENDPOINT=${{ vars.PUBLIC_APPWRITE_ENDPOINT }}" "PUBLIC_APPWRITE_DASHBOARD=${{ vars.PUBLIC_APPWRITE_DASHBOARD }}" "PUBLIC_APPWRITE_PROJECT_ID=${{ vars.PUBLIC_APPWRITE_PROJECT_ID }}" "PUBLIC_APPWRITE_DB_MAIN_ID=${{ vars.PUBLIC_APPWRITE_DB_MAIN_ID }}" "PUBLIC_APPWRITE_COL_THREADS_ID=${{ vars.PUBLIC_APPWRITE_COL_THREADS_ID }}" "PUBLIC_APPWRITE_COL_MESSAGES_ID=${{ vars.PUBLIC_APPWRITE_COL_MESSAGES_ID }}" "PUBLIC_APPWRITE_FN_TLDR_ID=${{ vars.PUBLIC_APPWRITE_FN_TLDR_ID }}" "PUBLIC_APPWRITE_PROJECT_INIT_ID=${{ vars.PUBLIC_APPWRITE_PROJECT_INIT_ID }}" "PUBLIC_GROWTH_ENDPOINT=${{ vars.PUBLIC_GROWTH_ENDPOINT }}" "PUBLIC_POSTHOG_API_KEY=${{ vars.PUBLIC_POSTHOG_API_KEY }}" - "APPWRITE_DB_INIT_ID=${{ secrets.APPWRITE_DB_INIT_ID }}" - "APPWRITE_COL_INIT_ID=${{ secrets.APPWRITE_COL_INIT_ID }}" - "APPWRITE_API_KEY_INIT=${{ secrets.APPWRITE_API_KEY_INIT }}" - "GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}" - "SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}" "SENTRY_RELEASE=${{ github.event.release.tag_name }}" + secrets: | + "APPWRITE_DB_INIT_ID=${{ secrets.APPWRITE_DB_INIT_ID }}" + "APPWRITE_COL_INIT_ID=${{ secrets.APPWRITE_COL_INIT_ID }}" + "APPWRITE_API_KEY_INIT=${{ secrets.APPWRITE_API_KEY_INIT }}" + "GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}" + "SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}"
1-7: Add explicit permissionsNeeded for GHCR push; improves security posture.
name: Production deployment on: release: types: [published] workflow_dispatch: +permissions: + contents: read + packages: writeeslint.config.js (1)
25-28: Scopeno-undefrule to TS/Svelte files onlyThe codebase has 14 plain JS files alongside 182 TS and 409 Svelte files. The current global
no-undef: 'off'disables checking in those JS files unnecessarily. The typescript-eslint guidance applies to TypeScript sources specifically; JS files should retain the check to catch real issues. The configuration already supports scoped rules (as shown by the Svelte block), so moving this rule into a files-scoped config is both feasible and aligned with the codebase structure.rules: { - // typescript-eslint strongly recommend that you do not use the no-undef lint rule on TypeScript projects. - // see: https://typescript-eslint.io/troubleshooting/faqs/eslint/#i-get-errors-from-the-no-undef-rule-about-global-variables-not-being-defined-even-though-there-are-no-typescript-errors - 'no-undef': 'off' } }, + { + files: ['**/*.ts', '**/*.tsx', '**/*.svelte', '**/*.svelte.ts', '**/*.svelte.js'], + rules: { + // typescript-eslint strongly recommend that you do not use the no-undef lint rule on TypeScript projects. + // see: https://typescript-eslint.io/troubleshooting/faqs/eslint/#i-get-errors-from-the-no-undef-rule-about-global-variables-not-being-defined-even-though-there-are-no-typescript-errors + 'no-undef': 'off' + } + }, { files: ['**/*.svelte', '**/*.svelte.ts', '**/*.svelte.js'],package.json (1)
71-76: Add Node engine declaration to ensure CI/dev parity with ESLint 9, SvelteKit, and Vite 6ESLint 9 requires Node >= 18.18.0, and the codebase uses @sveltejs/kit ^2.42.2 (Node 18+ minimum) and Vite ^6.2.4. Currently, no
enginesfield exists in package.json. Adding"engines": { "node": ">=18.18" }declares the minimum Node version needed, preventing subtle failures when developers or CI environments use incompatible Node versions."packageManager": "[email protected]", + "engines": { + "node": ">=18.18" + },
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (4)
.github/workflows/production.yml(1 hunks).github/workflows/staging.yml(1 hunks)eslint.config.js(1 hunks)package.json(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: tests
- GitHub Check: build
- GitHub Check: format
🔇 Additional comments (2)
.github/workflows/production.yml (1)
10-10: Remove unusedSTACK_FILEenvironment variableThe
STACK_FILEvariable defined at line 10 is never referenced anywhere in the workflow. The deployment uses Helm (seehelm upgradestep), not Docker Compose, making this variable obsolete. Removing it reduces configuration drift..github/workflows/staging.yml (1)
11-11: Remove unused STACK_FILE environment variableSTACK_FILE is defined at line 11 but never referenced in any workflow step. The deployment uses Helm, not Docker Stack files, so this variable is dead code. Remove it or wire it into a step if needed.
Summary by CodeRabbit
Release Notes