feat: add SVGO auto-optimize, PR/stale hygiene, and AI PR review by thegdsks · Pull Request #1108 · glincker/thesvg

thegdsks · 2026-09-18T20:45:15Z

Summary

Adds svgo.yml: optimizes changed icon SVGs under public/icons/** and commits the result back automatically (push to main and same-repo PR branches; fork PRs fail the check with instructions, then get optimized automatically once merged, since a workflow can't push to someone else's fork).
Adds hygiene.yml: welcomes first-time PR authors, and runs a generic 30-day-stale / +7-day-close sweep for PRs only. Issues are intentionally left alone here since stale-icon-issues.yml already runs a more specific, triage-label-aware sweep, and triage-icon-issue.yml already comments on every new issue.

Kept OSS-only and free by design: SVGO is a plain open-source npm tool, and the welcome/stale bots are native GitHub Actions. No external API keys, accounts, or paid services required. (Dropped the originally-proposed AI PR-review workflow since it depended on a Gemini API key, which isn't something this project wants to require.)

Test plan

Confirm actionlint.yml passes on this PR
Open a throwaway PR touching a public/icons/**/*.svg file and confirm SVGO commits an optimized version back
Confirm the welcome comment appears on a first-time contributor's PR

Summary by CodeRabbit

Workflow Improvements
- Added automated greetings for contributors opening their first pull request.
- Added stale pull request management, including reminders after inactivity and closure after an additional waiting period.
- Added automatic optimization of changed icon graphics.
- Added safeguards to avoid overlapping optimization runs and provide guidance when automatic updates cannot be applied.

Co-Authored-By: Glinr <bot@glincker.com>

coderabbitai · 2026-09-18T20:45:59Z

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 899f2eb0-a099-4090-ba50-723d2120bed1

📥 Commits

Reviewing files that changed from the base of the PR and between 806ed16 and 8121898.

📒 Files selected for processing (2)

.github/workflows/hygiene.yml
.github/workflows/svgo.yml

 ______________________________________________
< Preventing the Y2K bug from happening again. >
 ----------------------------------------------
  \
   \   \
        \ /\
        ( )
      .( o ).

✨ Finishing Touches

✨ Simplify code

Commit to this branch
Create a new PR

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-09-18T20:46:09Z

Failed to generate code suggestions for PR

Co-Authored-By: Glinr <bot@glincker.com>

… level Co-Authored-By: Glinr <bot@glincker.com>

sonarqubecloud · 2026-09-18T20:55:17Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

greptile-apps · 2026-09-18T20:59:29Z

Confidence Score: 2/5

This PR is not safe to merge until fork optimization results are checked correctly, multi-commit pushes cover every changed SVG, and the stale job receives its required permission.

Findings

Fork checks always fail ▶
Earlier SVG changes are skipped ▶
Stale sweep lacks permission ▶
Privileged actions use mutable tags ▶

Summary

This PR adds automated SVG optimization and pull-request hygiene workflows.

Optimizes changed icon SVGs on pushes and pull requests, with automatic commits for writable branches.
Welcomes first-time pull-request authors.
Marks inactive pull requests stale after 30 days and closes them seven days later.
The current implementation has failure paths affecting fork checks, multi-commit push coverage, and stale-action permissions.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  E[Workflow event] --> P{SVG workflow?}
  P -->|Push to main| PS[Checkout with depth 2]
  P -->|Same-repo PR| SR[Checkout writable PR branch]
  P -->|Fork PR| FR[Checkout fork SHA read-only]
  PS --> D[Discover changed SVGs]
  SR --> D
  FR --> D
  D --> O[Run SVGO]
  O --> W{Writable branch?}
  W -->|Yes| C[Commit optimized files]
  W -->|No| F[Report optimization result]
  E --> H{Hygiene event}
  H -->|Opened PR| V[Welcome first-time contributor]
  H -->|Schedule or manual| S[Mark and close stale PRs]

_{Reviews (1) · Last reviewed commit: "fix: pin third-party action to a commit ..."}

greptile-apps · 2026-09-18T20:59:35Z

+          steps.changed.outputs.files != '' &&
+          github.event_name == 'pull_request' &&
+          github.event.pull_request.head.repo.full_name != github.repository


Fork checks always fail

For every fork PR that changes an SVG, this condition fails the job based on the original changed-file list. It never checks whether SVGO actually modified the file, so even an already-optimized SVG receives a failing check and rerunning the instructed command cannot make it pass.

greptile-apps · 2026-09-18T20:59:35Z

+          if git cat-file -e "$BASE" 2>/dev/null; then
+            FILES=$(git diff --name-only --diff-filter=ACM "$BASE" HEAD -- 'public/icons/**/*.svg')
+          else
+            FILES=$(git diff --name-only --diff-filter=ACM --root HEAD -- 'public/icons/**/*.svg')


Earlier SVG changes are skipped

When a push contains more than one commit, github.event.before can be missing from this two-commit checkout. This fallback then compares only the latest commit for a non-root HEAD, so SVGs changed in earlier commits from the same push are skipped and can reach main without optimization.

greptile-apps · 2026-09-18T20:59:35Z

+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write


Stale sweep lacks permission

actions/stale@v11 enumerates pull requests through GitHub's issues API before applying PR-specific stale behavior, but this job grants only pull-requests: write. Scheduled runs therefore fail with an inaccessible-resource error instead of labeling, commenting on, or closing stale PRs.

greptile-apps · 2026-09-18T20:59:35Z

+    permissions:
+      pull-requests: write
+    steps:
+      - uses: actions/first-interaction@v3


Privileged actions use mutable tags

The new workflows use mutable major tags for actions/first-interaction, actions/stale, and actions/checkout while granting pull-request or repository-content write access. If one of these tags is retargeted or compromised, different code will silently receive those privileges. Pin these references to full commit SHAs, as already done for the new git auto-commit action.

How this was verified: The referenced major tags are mutable and execute in jobs explicitly granted pull-request or contents write permissions.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

feat: add SVGO auto-optimize, PR/stale hygiene bot, and AI PR review

bc6a72d

Co-Authored-By: Glinr <bot@glincker.com>

github-actions Bot added the ci/cd CI/CD pipeline changes label Sep 18, 2026

thegdsks and others added 2 commits September 18, 2026 15:47

fix: drop AI PR review, keep pipeline OSS-only with no external API key

4de7bf3

Co-Authored-By: Glinr <bot@glincker.com>

fix: pin third-party action to a commit SHA, scope permissions to job…

8121898

… level Co-Authored-By: Glinr <bot@glincker.com>

greptile-apps Bot reviewed Sep 18, 2026

View reviewed changes

thegdsks merged commit 2cce215 into main Sep 18, 2026
14 of 15 checks passed

Navigation Menu

Repository navigation

feat: add SVGO auto-optimize, PR/stale hygiene, and AI PR review - #1108

feat: add SVGO auto-optimize, PR/stale hygiene, and AI PR review#1108
thegdsks merged 3 commits into
mainfrom
feat/free-cicd-automation

thegdsks commented Sep 18, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Sep 18, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

sonarqubecloud Bot commented Sep 18, 2026

Uh oh!

greptile-apps Bot commented Sep 18, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot Sep 18, 2026

Uh oh!

greptile-apps Bot Sep 18, 2026

Uh oh!

greptile-apps Bot Sep 18, 2026

Uh oh!

greptile-apps Bot Sep 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

thegdsks commented Sep 18, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

sonarqubecloud Bot commented Sep 18, 2026

Quality Gate passed

Uh oh!

greptile-apps Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 2/5

Findings

Summary

Diagram

Uh oh!

greptile-apps Bot Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Sep 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

thegdsks commented Sep 18, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 18, 2026 •

edited

Loading

greptile-apps Bot commented Sep 18, 2026 •

edited

Loading