inital codama client generation and tests by tonyboylehub · Pull Request #250 · metaplex-foundation/mpl-core

tonyboylehub · 2025-12-17T21:28:44Z

No description provided.

vercel · 2025-12-17T21:28:48Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
mpl-core-js-docs	Ready	Preview, Comment	Dec 17, 2025 9:36pm

coderabbitai · 2025-12-17T21:28:51Z

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch codama

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

.github/workflows/test-js-kit-client.yml

+    name: Test
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node: ["20.x", "22.x"]
+    steps:
+      - name: Git checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.git_ref }}
+
+      - name: Load environment variables
+        run: cat .github/.env >> $GITHUB_ENV
+
+      - name: Sanitize Ref
+        id: sanitize
+        shell: bash
+        run: |
+          REF="${{ inputs.git_ref }}"
+          if [ -z "$REF" ]; then
+            REF="default"
+          fi
+          SANITIZED=${REF//\//-}
+          echo "sanitized=$SANITIZED" >> "$GITHUB_OUTPUT"
+
+      - name: Start validator
+        uses: metaplex-foundation/actions/start-validator@v1
+        with:
+          node: ${{ matrix.node }}
+          solana: ${{ env.SOLANA_VERSION }}
+          cache: ${{ env.CACHE }}
+          artifacts: program-builds-${{ steps.sanitize.outputs.sanitized }}
+
+      - name: Install dependencies
+        uses: metaplex-foundation/actions/install-node-dependencies@v1
+        with:
+          folder: ./clients/js-kit
+          cache: ${{ env.CACHE }}
+          key: clients-js-kit
+
+      - name: Build
+        working-directory: ./clients/js-kit
+        run: pnpm build
+
+      - name: Test
+        working-directory: ./clients/js-kit
+        run: pnpm test
+
+  lint:


To fix the issue, explicitly set the permissions block at the root of the workflow file. The minimum required privilege for this particular workflow—based on its contents (running tests, linting, formatting, checking out code with actions/checkout)—is contents: read. None of the jobs perform write operations (e.g., pushing code, creating issues, managing pull requests), so restricting the GITHUB_TOKEN to only read the repository contents adheres to the principle of least privilege and meets both the security recommendations and the requirements of the workflow.

To implement this, insert the following block after the name and before or after the on: block:

permissions: contents: read

This will apply to all jobs in the workflow, unless overridden in individual jobs (which is not necessary here).

What is needed:

Insert permissions: at the root level of .github/workflows/test-js-kit-client.yml, specifying contents: read as the value.

tonyboylehub · 2025-12-17T21:57:14Z

.github/workflows/test-js-kit-client.yml

+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - name: Git checkout
+        uses: actions/checkout@v4
+
+      - name: Load environment variables
+        run: cat .github/.env >> $GITHUB_ENV
+
+      - name: Install Node.js
+        uses: metaplex-foundation/actions/install-node-with-pnpm@v1
+        with:
+          version: ${{ env.NODE_VERSION }}
+          cache: ${{ env.CACHE }}
+
+      - name: Install dependencies
+        uses: metaplex-foundation/actions/install-node-dependencies@v1
+        with:
+          folder: ./clients/js-kit
+          cache: ${{ env.CACHE }}
+          key: clients-js-kit
+
+      - name: Format
+        working-directory: ./clients/js-kit
+        run: pnpm format
+
+      - name: Lint
+        working-directory: ./clients/js-kit
+        run: pnpm lint


To fix the issue, add a permissions block explicitly specifying the minimal privilege required for this workflow. The best way is to set permissions: contents: read at the top level (applies to all jobs unless overridden). This gives the workflow read-only access to repository contents, which suffices for checking out code and running tests/lints locally. Place this immediately after the name: but before on: for proper YAML structure. No changes are needed within jobs or steps, as no write permissions are required by any visible action.

dmissing due to other test workflow not having this.

github-actions

Benchmark

Details

Benchmark suite	Current: `70d21bd`	Previous: `4917f62`	Ratio
`CU: create a new, empty asset`	`7628` Compute Units	`7628` Compute Units	`1`
`Space: create a new, empty asset`	`91` Bytes	`91` Bytes	`1`
`CU: create a new, empty asset with empty collection`	`15706` Compute Units	`15706` Compute Units	`1`
`Space: create a new, empty asset with empty collection`	`91` Bytes	`91` Bytes	`1`
`CU: create a new asset with plugins`	`25922` Compute Units	`25922` Compute Units	`1`
`Space: create a new asset with plugins`	`194` Bytes	`194` Bytes	`1`
`CU: create a new asset with plugins and empty collection`	`30830` Compute Units	`30830` Compute Units	`1`
`Space: create a new asset with plugins and empty collection`	`194` Bytes	`194` Bytes	`1`
`CU: list an asset`	`19019` Compute Units	`19019` Compute Units	`1`
`CU: sell an asset`	`24206` Compute Units	`24206` Compute Units	`1`
`CU: list an asset with empty collection`	`23516` Compute Units	`23516` Compute Units	`1`
`CU: sell an asset with empty collection`	`31593` Compute Units	`31593` Compute Units	`1`
`CU: list an asset with collection royalties`	`22906` Compute Units	`22906` Compute Units	`1`
`CU: sell an asset with collection royalties`	`34644` Compute Units	`34644` Compute Units	`1`
`CU: transfer an empty asset`	`3611` Compute Units	`3611` Compute Units	`1`
`CU: transfer an empty asset with empty collection`	`5171` Compute Units	`5171` Compute Units	`1`
`CU: transfer an asset with plugins`	`7048` Compute Units	`7048` Compute Units	`1`
`CU: transfer an asset with plugins and empty collection`	`8608` Compute Units	`8608` Compute Units	`1`

This comment was automatically generated by workflow using github-action-benchmark.

inital codama client generation and tests

23abc7f

added tests to github workflow

70d21bd

vercel bot deployed to Preview December 17, 2025 21:36 View deployment

github-advanced-security bot found potential problems Dec 17, 2025

View reviewed changes

github-actions bot reviewed Dec 17, 2025

View reviewed changes

@@ -1,5 +1,8 @@
             name: Test JS Kit client
+            permissions:
+              contents: read
             on:
               workflow_call:
                 inputs:

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

inital codama client generation and tests#250

inital codama client generation and tests#250
tonyboylehub wants to merge 2 commits intomainfrom
codama

tonyboylehub commented Dec 17, 2025

Uh oh!

vercel bot commented Dec 17, 2025 •

edited

Loading

Uh oh!

coderabbitai bot commented Dec 17, 2025

Review skipped

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

tonyboylehub Dec 17, 2025

Uh oh!

github-actions bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

tonyboylehub commented Dec 17, 2025

Uh oh!

vercel bot commented Dec 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai bot commented Dec 17, 2025

Review skipped

Uh oh!

Check warning

Copilot Autofix

Check warning

Copilot Autofix

tonyboylehub Dec 17, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Benchmark

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel bot commented Dec 17, 2025 •

edited

Loading