Repository navigation
Frontend/v1 #34
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Frontend/v1 #34
Changes from all commits
acd829b
7c1e4d5
7fa3b61
990f625
d3e3bca
e2e9a31
2304b95
2c370b9
0050039
ce85c65
3f2a4d6
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json | ||
| language: "en-US" | ||
|
|
||
| # The tone the AI will use when talking to you and your contributors | ||
| tone_instructions: 'You are a senior full-stack developer reviewing code for an open-source Next.js project. Be encouraging, highly technical, and concise. Always suggest best practices for TypeScript and Next.js App Router.' | ||
|
|
||
| reviews: | ||
| # 'chill' means it won't nitpick tiny style things that ESLint should catch | ||
| profile: "chill" | ||
|
|
||
| # When set to true, CodeRabbit will automatically "Approve" the PR when its requested changes are resolved | ||
| request_changes_workflow: true | ||
|
|
||
| # Adds a fun, auto-generated summary and a poem about the code at the top of the PR! | ||
| high_level_summary: true | ||
| poem: true | ||
|
|
||
| # Automatically review all new PRs | ||
| auto_review: | ||
| enabled: true | ||
| drafts: false # Won't waste reviews if a contributor opens a "Draft" PR | ||
|
|
||
| # Specific rules for specific folders! | ||
| path_instructions: | ||
| - path: "frontend/**/*.tsx" | ||
| instructions: "Ensure React components are using modern hooks, avoid unnecessary re-renders, and use TailwindCSS properly." | ||
| - path: "frontend/content/**/*.mdx" | ||
| instructions: "Ensure MDX files have proper frontmatter, clean Markdown formatting, and that code blocks specify a language." | ||
|
|
||
| # Allows you and contributors to chat with the bot in the PR comments | ||
| chat: | ||
| auto_reply: true |
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,41 @@ | ||||||||||||||||||||||||||
| name: PR Checks | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||
| pull_request: | ||||||||||||||||||||||||||
| branches: [ main ] | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||
| quality-checks: | ||||||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| # Run all commands inside the frontend directory | ||||||||||||||||||||||||||
| defaults: | ||||||||||||||||||||||||||
| run: | ||||||||||||||||||||||||||
| working-directory: ./frontend | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| steps: | ||||||||||||||||||||||||||
| - name: Checkout repository | ||||||||||||||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| - name: Setup Node.js | ||||||||||||||||||||||||||
| uses: actions/setup-node@v4 | ||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||
| node-version: '20' | ||||||||||||||||||||||||||
| cache: 'npm' | ||||||||||||||||||||||||||
| cache-dependency-path: ./frontend/package-lock.json | ||||||||||||||||||||||||||
|
Comment on lines
+20
to
+25
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
# Inspect the declared runtime and the Next.js engine requirement before changing CI.
sed -n '20,26p' .github/workflows/ci.yml
rg -n -C2 '"next"|"engines"' frontend/package.json
npm view next@16.2.4 engines --jsonRepository: Yash-pluto/refme Length of output: 837 🌐 Web query:
💡 Result: Node.js v20 (Iron) has reached its End-of-Life (EOL) date of March 24, 2026 [1]. Node.js v24 (Krypton) is an Long-Term Support (LTS) release that was first released on May 6, 2025 [1]. Citations: Use Node.js 24 for CI. Node.js 20 reached EOL on March 24, 2026. Proposed update- node-version: '20'
+ node-version: '24'📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| - name: Install dependencies | ||||||||||||||||||||||||||
| run: npm ci | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| - name: Run ESLint | ||||||||||||||||||||||||||
| # Uses the "lint": "eslint" script from your package.json | ||||||||||||||||||||||||||
| run: npm run lint | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| - name: Check TypeScript Types | ||||||||||||||||||||||||||
| # Uses npx to run the TypeScript compiler and check for errors without generating files | ||||||||||||||||||||||||||
| run: npx tsc --noEmit | ||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||
| - name: Verify Next.js Build | ||||||||||||||||||||||||||
| # Uses the "build": "next build" script | ||||||||||||||||||||||||||
| # Next.js will also do a strict check here, but having them separate makes debugging easier! | ||||||||||||||||||||||||||
| run: npm run build | ||||||||||||||||||||||||||
This file was deleted.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Restrict the workflow token and remove checkout credentials.
npm cican run lifecycle scripts from the checked-out PR. If repository defaults grant write access, the current workflow exposes a broader token than this read-only CI job requires. Set explicit read-only permissions and disable persisted checkout credentials.Proposed workflow hardening
on: pull_request: branches: [ main ] +permissions: + contents: read + jobs: quality-checks: @@ - name: Checkout repository uses: actions/checkout@v4 + with: + persist-credentials: falseAlso applies to: 17-18
🤖 Prompt for AI Agents
Source: Linters/SAST tools