Revert "fix: run E2E tests after i18n completes on release PRs" #8105
Conversation
This reverts commit b979ba8.
dosubot
bot
added
the
size:L
📝 WalkthroughWalkthroughThis PR removes the end-to-end release workflow and simplifies the main E2E workflow by eliminating workflow_call inputs, consolidating logic to rely on GitHub event context directly instead of optional parameters. Changes
Possibly Related PRs
Suggested Reviewers
📜 Recent review detailsConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro 📒 Files selected for processing (2)
💤 Files with no reviewable changes (1)
🧰 Additional context used🧠 Learnings (1)📚 Learning: 2025-12-12T23:02:37.473ZApplied to files:
🪛 actionlint (1.7.10).github/workflows/ci-tests-e2e.yaml227-227: "github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks for more details (expression) ⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
🔇 Additional comments (1)
✏️ Tip: You can disable this entire section by setting Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
🎨 Storybook Build Status✅ Build completed successfully! ⏰ Completed at: 01/16/2026, 05:46:10 PM UTC 🔗 Links🎉 Your Storybook is ready for review! |
🎭 Playwright Tests:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/ci-tests-e2e.yaml (2)
192-201: Script injection risk:github.head_refis user-controlled.Branch names are attacker-controlled and directly interpolating
github.head_refinto shell script arguments enables command injection. Pass it through an environment variable instead.🔒 Recommended fix
- name: Post starting comment env: GITHUB_TOKEN: ${{ github.token }} + PR_NUMBER: ${{ github.event.pull_request.number }} + HEAD_REF: ${{ github.head_ref }} run: | chmod +x scripts/cicd/pr-playwright-deploy-and-comment.sh ./scripts/cicd/pr-playwright-deploy-and-comment.sh \ - "${{ github.event.pull_request.number }}" \ - "${{ github.head_ref }}" \ + "$PR_NUMBER" \ + "$HEAD_REF" \ "starting" \ "${{ steps.start-time.outputs.time }}"
221-231: Same script injection risk withgithub.head_ref.Apply the same fix here—pass the PR number and head ref through environment variables. Note that
GITHUB_SHAis already handled securely via env var on line 226, which is the correct pattern to follow.🔒 Recommended fix
- name: Deploy reports and comment on PR env: CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} GITHUB_TOKEN: ${{ github.token }} GITHUB_SHA: ${{ github.event.pull_request.head.sha }} + PR_NUMBER: ${{ github.event.pull_request.number }} + HEAD_REF: ${{ github.head_ref }} run: | bash ./scripts/cicd/pr-playwright-deploy-and-comment.sh \ - "${{ github.event.pull_request.number }}" \ - "${{ github.head_ref }}" \ + "$PR_NUMBER" \ + "$HEAD_REF" \ "completed"
📜 Review details
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/ci-tests-e2e-release.yaml.github/workflows/ci-tests-e2e.yaml
💤 Files with no reviewable changes (1)
- .github/workflows/ci-tests-e2e-release.yaml
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-12-12T23:02:37.473Z
Learnt from: Myestery
Repo: Comfy-Org/ComfyUI_frontend PR: 7422
File: .github/workflows/pr-update-playwright-expectations.yaml:131-135
Timestamp: 2025-12-12T23:02:37.473Z
Learning: In the `.github/workflows/pr-update-playwright-expectations.yaml` workflow in the Comfy-Org/ComfyUI_frontend repository, the snapshot update process is intentionally scoped to only add and update snapshot images. Deletions of snapshot files are handled explicitly outside this workflow and should not be suggested as part of this automation.
Applied to files:
.github/workflows/ci-tests-e2e.yaml
🪛 actionlint (1.7.10)
.github/workflows/ci-tests-e2e.yaml
227-227: "github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks for more details
(expression)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: lint-and-format
- GitHub Check: setup
- GitHub Check: test
- GitHub Check: collect
🔇 Additional comments (1)
.github/workflows/ci-tests-e2e.yaml (1)
11-13: LGTM on concurrency group simplification.Using
github.refdirectly is the standard approach for workflows triggered bypushandpull_requestevents.
✏️ Tip: You can disable this entire section by setting review_details to false in your review settings.
Bundle Size ReportSummary
Category Glance Per-category breakdownApp Entry Points — 3.36 MB (baseline 3.36 MB) • ⚪ 0 BMain entry bundles and manifests
Graph Workspace — 1.14 MB (baseline 1.14 MB) • ⚪ 0 BGraph editor runtime, canvas, workflow orchestration
Views & Navigation — 6.66 kB (baseline 6.66 kB) • ⚪ 0 BTop-level views, pages, and routed surfaces
Panels & Settings — 372 kB (baseline 372 kB) • ⚪ 0 BConfiguration panels, inspectors, and settings screens
UI Components — 203 kB (baseline 203 kB) • ⚪ 0 BReusable component library chunks
Data & Services — 12.5 kB (baseline 12.5 kB) • ⚪ 0 BStores, services, APIs, and repositories
Utilities & Hooks — 1.41 kB (baseline 1.41 kB) • ⚪ 0 BHelpers, composables, and utility bundles
Vendor & Third-Party — 9.34 MB (baseline 9.34 MB) • ⚪ 0 BExternal libraries and shared vendor chunks
Other — 5.38 MB (baseline 5.38 MB) • ⚪ 0 BBundles that do not match a named category
|
3 participants
Reverts #8091
┆Issue is synchronized with this Notion page by Unito