feat/uis-package-bump-automation#5
Conversation
Frederick-88
changed the title
📝 WalkthroughWalkthroughAdds a composite GitHub Action that checks out a repository, installs dependencies, optionally prepares a project, and creates or updates a package-bump pull request. ChangesPackage bump pull request automation
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant PackageBumpAction
participant TargetRepository
participant Pnpm
participant GitHubCLI
PackageBumpAction->>TargetRepository: checkout target branch
PackageBumpAction->>Pnpm: install dependencies and run preparation
PackageBumpAction->>TargetRepository: commit and push package-bump branch
PackageBumpAction->>GitHubCLI: check for an existing open pull request
GitHubCLI-->>PackageBumpAction: return pull request status
PackageBumpAction->>GitHubCLI: create pull request when none exists
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
actions/package-bump-make-pr/action.yml (2)
72-108: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRepeated
cdboilerplate across three steps.The same "cd into
tmp/${{ inputs.folder_path }}ortmp" logic is duplicated in "Install dependencies", "Run post-install command", and "Prepare Nuxt". Since composite-action steps don't share a working directory, consider computing the target directory once (e.g., an initial step writing to$GITHUB_OUTPUT) and usingworking-directory:on each subsequent step instead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@actions/package-bump-make-pr/action.yml` around lines 72 - 108, Eliminate the duplicated directory-selection logic across the “Install dependencies”, “Run post-install command”, and “Prepare Nuxt” steps. Add an initial step that computes the target directory from inputs.folder_path and exposes it via GITHUB_OUTPUT, then apply that output with working-directory on each subsequent step while preserving their existing commands and conditions.
72-108: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winInputs interpolated directly into shell instead of via
env:.
inputs.folder_path(Lines 75-79, 86-90, 96-100) andgithub.actor(Lines 122-123) are spliced directly into therun:script text, while the later "Create or update pull request" step correctly routes its templated values throughenv:. Direct${{ }}interpolation intorun:bodies is a known GitHub Actions injection surface — composite-action inputs are not exempt even when the immediate caller is presumed trusted, since callers may themselves be passing along less-trusted values (e.g., a workflow_dispatch input). Recommend consistently usingenv:+$VARfor all of these, matching the pattern already used later in the file.♻️ Example fix for one occurrence
- name: Install dependencies shell: bash + env: + FOLDER_PATH: ${{ inputs.folder_path }} run: | - if [ -n "${{ inputs.folder_path }}" ]; then - cd "tmp/${{ inputs.folder_path }}" + if [ -n "$FOLDER_PATH" ]; then + cd "tmp/$FOLDER_PATH" else cd tmp fi pnpm installAlso applies to: 122-123
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@actions/package-bump-make-pr/action.yml` around lines 72 - 108, Route all templated values used by the shell scripts through step-level env variables instead of interpolating them directly in run bodies. Update the Install dependencies, Run post-install command, and Prepare Nuxt steps to use an env-backed folder path, and update the github.actor usage in the relevant step similarly; preserve the existing directory-selection and command behavior while referencing the shell variables.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@actions/package-bump-make-pr/action.yml`:
- Around line 11-13: Update the repository_url input definition in the action
metadata so its description explicitly requires the owner/repo repository
specification rather than a full URL; preserve the existing input name unless
the action’s callers are also updated consistently.
---
Nitpick comments:
In `@actions/package-bump-make-pr/action.yml`:
- Around line 72-108: Eliminate the duplicated directory-selection logic across
the “Install dependencies”, “Run post-install command”, and “Prepare Nuxt”
steps. Add an initial step that computes the target directory from
inputs.folder_path and exposes it via GITHUB_OUTPUT, then apply that output with
working-directory on each subsequent step while preserving their existing
commands and conditions.
- Around line 72-108: Route all templated values used by the shell scripts
through step-level env variables instead of interpolating them directly in run
bodies. Update the Install dependencies, Run post-install command, and Prepare
Nuxt steps to use an env-backed folder path, and update the github.actor usage
in the relevant step similarly; preserve the existing directory-selection and
command behavior while referencing the shell variables.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 38f02f16-6451-437d-9d13-9dda9beecca7
📒 Files selected for processing (1)
actions/package-bump-make-pr/action.yml
2 participants
goal: injective-ts package publishes >> trigger package bump on this repo >> make PR branched out from dev
related PRs = InjectiveLabs/injective-ts#695
this new file is referencing current working package bump action file + add necessary changes for injective-uis, changelog:
Summary by CodeRabbit