Repository navigation
ci: regenerate packaged action for Dependabot updates - #28
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3125b99a37
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| persist-credentials: true |
There was a problem hiding this comment.
When a Dependabot update contains a compromised npm package or build tool, its lifecycle hooks or code loaded by yarn build execute after checkout has persisted a repository-wide contents: write credential. The checkout input documentation confirms that this credential enables subsequent scripts to run authenticated Git commands, so hostile dependency code could push or delete refs beyond the intended dist commit and bypass the branch/SHA restriction in the final command. Run installation and packaging in a read-only job, then pass the generated artifact to a separately isolated writer with narrowly scoped credentials.
Useful? React with 👍 / 👎.
| git config user.email '41898282+github-actions[bot]@users.noreply.github.com' | ||
| git add -- dist | ||
| git commit -m 'chore: rebuild packaged action for dependency update' | ||
| git push origin "HEAD:refs/heads/$BRANCH" --force-with-lease="refs/heads/$BRANCH:$EXPECTED_SHA" |
There was a problem hiding this comment.
Whenever packaging changes dist, this push updates the PR using the persisted repository GITHUB_TOKEN; according to GitHub's workflow-trigger documentation, pull_request runs resulting from a PR update made with that token are created in an approval-required state. Consequently the new head does not automatically receive the independent CI, unit, and Jira E2E results—the earlier runs belong to the pre-generated head—so required checks can remain pending until a maintainer manually approves them. Use an authentication/dispatch design that starts validation for the generated commit without approval.
Useful? React with 👍 / 👎.
1 participant
Run the existing build on same-repository Dependabot PRs and commit only changed dist artifacts. Preserve the independent CI artifact-parity check and Jira E2E validation. Uses a SHA lease to avoid overwriting newer branch changes.