Conversation
![semgrep-code-mongodb[bot]](https://avatars.githubusercontent.com/u/45120?s=60&v=4){kind=small}
| with: | ||
| show-progress: false | ||
|
|
||
| - uses: actions/setup-node@v4 |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🌟 Fixed in commit 04ed8a0 🌟
There was a problem hiding this comment.
This, we need to fix throughout the repo
| permissions: | ||
| pull-requests: write | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
⭐ Fixed in commit 04ed8a0 ⭐
There was a problem hiding this comment.
Pull request overview
This PR refactors the “feature flag MMS PR” GitHub Action to move PR-comment posting logic out of an inline github-script block and into a repository script, alongside some related cleanup around context-menu configuration.
Changes:
- Replace the inline
actions/github-scriptPR-comment logic with a Node-executed script incompass-preferences-model. - Add
@actions/githubas a devDependency to support the new script. - Remove the
disableContextMenusplumbing and the correspondingdisabledprop wiring for context menu providers.
Reviewed changes
Copilot reviewed 9 out of 10 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| packages/compass/src/app/components/home.tsx | Stops passing the removed disableContextMenus prop. |
| packages/compass-web/src/entrypoint.tsx | Stops passing the removed disableContextMenus prop in the web entrypoint. |
| packages/compass-preferences-model/scripts/post-feature-flag-comment-on-pr.mts | Adds a standalone script to post/update the feature-flag PR comment. |
| packages/compass-preferences-model/package.json | Adds @actions/github to support the new script. |
| packages/compass-context-menu/src/context-menu-provider.tsx | Removes the disabled gate from the base context-menu provider. |
| packages/compass-components/src/components/context-menu.tsx | Removes the disabled prop passthrough to the base provider. |
| packages/compass-components/src/components/compass-components-provider.tsx | Removes disableContextMenus support from the provider wiring. |
| package-lock.json | Lockfile updates for the new dependency set. |
| .github/workflows/feature-flag-mms-pr.yml | Switches the PR-comment step to run the new script. |
| utmSource, | ||
| utmMedium, | ||
| stackedElementsZIndex, | ||
| popoverPortalContainer: _popoverPortalContainer, | ||
| disableContextMenus, | ||
| disableGuideCues, |
New Feature Flag Definition DetectedThe following new feature flag was added to
|
mabaasit
added
no release notes
| "sinon": "^9.2.3", | ||
| "typescript": "^6.0.3" | ||
| "typescript": "^6.0.3", | ||
| "@actions/github": "^9.1.1" |
There was a problem hiding this comment.
nit: we should have the deps sorted, with @ at the top.
Description
Follow up of #8267
Checklist
Motivation and Context
Open Questions
Dependents
Types of changes