ci: update GitHub Actions for Node 24 - #184
Conversation
|
|
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 56 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
WalkthroughGitHub Actions workflows now use newer major versions of checkout, Node setup, GitHub Script, and cache actions. The PR preview workflow also adds issue write permission while retaining its existing cleanup behavior. ChangesWorkflow modernization
Estimated code review effort: 1 (Trivial) | ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
📝 Storybook Preview: View Storybook This preview will be updated automatically when you push new changes to this PR.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-preview.yml:
- Line 14: Move the comment logic in the workflow into a dedicated
same-repository comment job and relocate the issues: write permission from
workflow scope to that job’s permissions. Keep build and cleanup jobs limited to
their existing permissions, and preserve the fork guard around the comment API
call.
In @.github/workflows/release.yml:
- Around line 20-23: Update the stale setup-node reference in the release
workflow comment to say actions/setup-node@v5, matching the version used by the
Setup Node.js step.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: bcca33e3-1d06-4c59-be10-3dd6c4a4fdd7
📒 Files selected for processing (5)
.github/workflows/github-pages.yml.github/workflows/pr-preview.yml.github/workflows/pr-quality-checks.yml.github/workflows/release.yml.github/workflows/test.yml
| # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages | ||
| permissions: | ||
| contents: read | ||
| issues: write |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Scope issues: write to the comment job.
issues: write is workflow-wide here, so the build and cleanup jobs also inherit issue-write access even though the fork guard only skips the API call in the comment step. Move the comment logic into a dedicated same-repo job with job-level issues: write.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 14-14: overly broad permissions (excessive-permissions): issues: write is overly broad at the workflow level
(excessive-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr-preview.yml at line 14, Move the comment logic in the
workflow into a dedicated same-repository comment job and relocate the issues:
write permission from workflow scope to that job’s permissions. Keep build and
cleanup jobs limited to their existing permissions, and preserve the fork guard
around the comment API call.
| uses: actions/checkout@v5 | ||
|
|
||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v4 | ||
| uses: actions/setup-node@v5 |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the relevant workflow region with line numbers.
file=".github/workflows/release.yml"
wc -l "$file"
sed -n '1,80p' "$file" | cat -nRepository: lambda-curry/forms
Length of output: 3150
Update the stale setup-node reference. The comment at the release step still says setup-node@v4, but this workflow now uses actions/setup-node@v5.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 20 - 23, Update the stale
setup-node reference in the release workflow comment to say
actions/setup-node@v5, matching the version used by the Setup Node.js step.
1 participant
Summary
issues: writefor preview comments on trusted same-repository PRs.GITHUB_TOKENpermissions to read-only.Why
The failing preview run is not caused by the project Node version. The build succeeds, then
actions/github-script@v6receives a 403 when trying to create a comment on fork PR #183. The Node 20 messages are action-runtime deprecation warnings.Validation
git diff --checkSummary by CodeRabbit