Automatically deploy to vercel preview in the 'test pull request' git…#956
Automatically deploy to vercel preview in the 'test pull request' git…#956
Conversation
📝 WalkthroughWalkthroughAdded a Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip CodeRabbit can use TruffleHog to scan for secrets in your code with verification capabilities.Add a TruffleHog config file (e.g. trufflehog-config.yml, trufflehog.yml) to your project to customize detectors and scanning behavior. The tool runs only when a config file is present. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.github/workflows/pull_request.yml (1)
45-45: Pin to a commit SHA instead of a mutable tag.Replace
amondnet/vercel-action@v25.1.1with the full commit SHAamondnet/vercel-action@225d234. GitHub recommends pinning to commit SHAs rather than tags, as tags are mutable and can be retargeted, introducing supply-chain risks.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/pull_request.yml at line 45, Replace the mutable tag usage of the Vercel action (the line containing "uses: amondnet/vercel-action@v25.1.1") with the pinned commit SHA version by changing it to "amondnet/vercel-action@225d234" so the workflow references an immutable commit; update any other occurrences of that tag in the workflow to the same SHA if present.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/pull_request.yml:
- Around line 26-27: Add a job-level conditional to the deploy job to skip
execution for forked PRs: modify the deploy job (named "deploy") to include an
if condition like `if: github.event_name != 'pull_request' ||
github.event.pull_request.head.repo.full_name == github.repository` so the
deploy runs for non-PR events or PRs originating from the same repository but is
skipped for fork-originated pull_request events.
- Around line 30-31: The job-level env entry exposing SLACK_WEBHOOK_URL is
unnecessary since no step uses it; remove the job-scoped env: SLACK_WEBHOOK_URL
declaration or move it to the specific step that sends Slack notifications (the
step that would consume SLACK_WEBHOOK_URL), ensuring only that step has access
to the secret instead of the entire job environment.
- Around line 26-29: The deploy job currently lacks an explicit permissions
block; add a permissions: entry under the deploy job to explicitly scope the
GITHUB_TOKEN to least privilege for this job (only the specific scopes your
Vercel deploy needs), e.g., create a permissions block for the deploy job named
"deploy" that restricts token scopes (for example: contents: read, id-token:
write or whatever minimal set your deployment action requires) and remove the
default broader access.
---
Nitpick comments:
In @.github/workflows/pull_request.yml:
- Line 45: Replace the mutable tag usage of the Vercel action (the line
containing "uses: amondnet/vercel-action@v25.1.1") with the pinned commit SHA
version by changing it to "amondnet/vercel-action@225d234" so the workflow
references an immutable commit; update any other occurrences of that tag in the
workflow to the same SHA if present.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 4b3d18e2-be4b-4516-81b4-420592942b67
📒 Files selected for processing (1)
.github/workflows/pull_request.yml
…ition for execution
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/pull_request.yml:
- Line 47: Change the mutable action reference "uses:
amondnet/vercel-action@v25.1.1" to a pinned commit SHA; locate the line
containing uses: amondnet/vercel-action@v25.1.1 and replace the tag with the
exact commit SHA (e.g.,
amondnet/vercel-action@225d234cfe5340ca1f9a6cd158338126b5b6845f) so the workflow
uses an immutable, audit-able revision.
- Around line 33-34: The workflow contains an invalid empty env: mapping that
breaks YAML parsing; remove the empty env: declaration (or replace it with a
valid mapping) so the workflow top-level sequence starting at steps: parses
correctly — locate the lone env: entry near the steps: key and delete that empty
env: line or populate it with proper key: value pairs if environment variables
are intended.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b48b7c47-09f3-402a-b926-5704708555ae
📒 Files selected for processing (1)
.github/workflows/pull_request.yml
| env: | ||
| steps: |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify workflow syntax after the fix
# (run if actionlint is available in your environment)
actionlint -oneline .github/workflows/pull_request.ymlRepository: datacite/bracco
Length of output: 215
Remove invalid empty env: block that breaks workflow parsing.
Line 33 declares env: without providing any mapping values. This causes a YAML syntax error that prevents the workflow from running.
Fix
- env:
steps:📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| env: | |
| steps: | |
| steps: |
🧰 Tools
🪛 actionlint (1.7.11)
[error] 33-33: expecting a single ${{...}} expression or mapping value for "env" section, but found plain text node
(syntax-check)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/pull_request.yml around lines 33 - 34, The workflow
contains an invalid empty env: mapping that breaks YAML parsing; remove the
empty env: declaration (or replace it with a valid mapping) so the workflow
top-level sequence starting at steps: parses correctly — locate the lone env:
entry near the steps: key and delete that empty env: line or populate it with
proper key: value pairs if environment variables are intended.
| id: extract_variables | ||
|
|
||
| - name: Vercel deploy staging | ||
| uses: amondnet/vercel-action@v25.1.1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Resolve the exact commit behind v25.1.1 (read-only)
git ls-remote https://github.com/amondnet/vercel-action refs/tags/v25.1.1 refs/tags/v25.1.1^{}Repository: datacite/bracco
Length of output: 117
🏁 Script executed:
cat -n .github/workflows/pull_request.yml | sed -n '45,50p'Repository: datacite/bracco
Length of output: 294
Pin GitHub Action to commit SHA.
Line 47 uses a mutable tag (@v25.1.1). For supply-chain safety, pin to the exact commit SHA instead.
Replace with:
uses: amondnet/vercel-action@225d234cfe5340ca1f9a6cd158338126b5b6845f🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/pull_request.yml at line 47, Change the mutable action
reference "uses: amondnet/vercel-action@v25.1.1" to a pinned commit SHA; locate
the line containing uses: amondnet/vercel-action@v25.1.1 and replace the tag
with the exact commit SHA (e.g.,
amondnet/vercel-action@225d234cfe5340ca1f9a6cd158338126b5b6845f) so the workflow
uses an immutable, audit-able revision.
|
@jrhoads - Thanks for the commit. Do you think we should do this in branch-to-staging.yml and deploy.yml. I think they all do the same thing - build, test, deploy to staging. I will look at this on Monday. Thanks again! |
2 participants
…hub workflow.
Purpose
Add deploy code to the pull_request.yml github workflow in order to shorten time-to-preview for a pull request.
closes: #955
Approach
Open Questions and Pre-Merge TODOs
Learning
Types of changes
Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Reviewer, please remember our guidelines:
Summary by CodeRabbit