ci: add build+test gate and secret scan on PRs - #9
Conversation
TinyStudio.io had no CI at all, so branch protection had nothing real to require and any auto-merge waited on nothing. This adds the same two checks siterep and 0509 already run, using the same job names so the required-check contexts match across the fleet: - verify (npm ci, npm test, wrangler deploy --dry-run) - Gitleaks (secret scan, pinned by SHA) npm test here is scripts/check-site.mjs, which reads files only - no network and no secrets - so it is safe to require on every PR. Verified passing locally before shipping a gate that depends on it.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
nish3451 has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.
📝 WalkthroughWalkthroughAdded GitHub Actions workflows for Node.js and Wrangler validation, plus Gitleaks secret scanning on repository changes. ChangesCI Automation
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 787f32d1e0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - run: npm ci | ||
| - run: npm test | ||
| - name: Wrangler config and bundle check | ||
| run: npx wrangler@latest deploy --dry-run |
There was a problem hiding this comment.
When Wrangler publishes a new latest version, this gate will test that unreviewed release rather than the version installed by npm ci from package-lock.json, so otherwise unchanged PRs can begin failing because of new CLI behavior or Node requirements. Checked npx --help, whose usage accepts <pkg>[@<version>]; the explicit @latest is therefore what bypasses the local pinned dependency. Use the repository's npm run deploy:dry-run command required by specs/001-public-buyer-page/plan.md:27 instead.
AGENTS.md reference: AGENTS.md:L2-L3
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/ci.yml (2)
19-20: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winUse the lockfile-installed Wrangler binary.
Line 17 runs
npm ci, which installs the lockfile dependency tree. The suppliedpackage.jsoncontext listswrangleras a development dependency. Line 20 then explicitly asksnpxforwrangler@latest; npm allowsnpxto execute a remote package, so this command can validate a different version from the one reviewed in the lockfile. (docs.npmjs.com)Use the repository's Wrangler npm script, or invoke the installed binary directly:
Proposed fix
- run: npx wrangler@latest deploy --dry-run + run: npm exec -- wrangler deploy --dry-run🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 19 - 20, Update the “Wrangler config and bundle check” step to use the lockfile-installed Wrangler through the repository’s npm script or local binary, rather than invoking npx with wrangler@latest; preserve the existing deploy --dry-run arguments.
12-15: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winSecurity Misconfiguration (CWE-494): Download of Code Without Integrity Check
Reachability: External
Pin the CI action references to full-length SHAs.
Line 12 and Line 13 use mutable
@v4tags..github/workflows/secret-scan.ymlpins its action dependencies at Lines 20 and 25, but this workflow does not. A moved or compromised tag can make a future run execute different third-party code without a pull request change. GitHub documents full-length SHA pinning as the strongest action version control. (docs.github.com)Pin the Node24-based action releases to exact commits and keep version comments.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 12 - 15, Update the actions/checkout and actions/setup-node references in the workflow to immutable full-length commit SHAs for the Node 24-compatible releases, preserving inline comments that identify the pinned versions and leaving their existing configuration unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 12-15: Update the CI workflow steps using actions/checkout and
actions/setup-node from v4 to Node.js 24-based major releases (v5 or later), and
pin each selected action version to its corresponding commit SHA. Preserve the
existing setup-node configuration, including node-version: 24.
In @.github/workflows/secret-scan.yml:
- Around line 10-12: Update the gitleaks-action@v3 configuration in the
secret-scan workflow to set GITLEAKS_ENABLE_COMMENTS to false, preserving the
existing contents and pull-requests read-only permissions.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 19-20: Update the “Wrangler config and bundle check” step to use
the lockfile-installed Wrangler through the repository’s npm script or local
binary, rather than invoking npx with wrangler@latest; preserve the existing
deploy --dry-run arguments.
- Around line 12-15: Update the actions/checkout and actions/setup-node
references in the workflow to immutable full-length commit SHAs for the Node
24-compatible releases, preserving inline comments that identify the pinned
versions and leaving their existing configuration unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 42f80e8b-ad51-4e64-abb1-768ac3723899
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/secret-scan.yml
| - uses: actions/checkout@v4 | ||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 24 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/ci.yml
printf '%s\n' '--- action references ---'
rg -n 'actions/(checkout|setup-node)@|gitleaks|branch protection|verify' .github README.md 2>/dev/null || true
printf '%s\n' '--- remote action metadata ---'
for ref in checkout/v4 checkout/v5 checkout/v6 setup-node/v4 setup-node/v5 setup-node/v6; do
repo=${ref%/*}; tag=${ref#*/}
url="https://raw.githubusercontent.com/actions/${repo}/${tag}/action.yml"
printf '\n[%s]\n' "$ref"
curl -fsSL "$url" | rg -n 'using:|node[0-9]+|runs:' || true
doneRepository: nish3451/TinyStudio.io
Length of output: 1497
🌐 Web query:
GitHub Actions checkout v5 v6 setup-node v5 v6 Node 24 runtime official documentation June 16 2026 Node 20 removal September 16 2026
💡 Result:
GitHub Actions has transitioned to using Node.js 24 as the default runtime for actions, with the official switch occurring on June 16, 2026 [1][2]. Node.js 24 Support Both actions/checkout and actions/setup-node have been updated to support the Node.js 24 runtime in their v5 and v6 major versions [3][4][5][6]. - actions/checkout: v5.0.0 and later, and v6.0.0 and later, are updated to use Node.js 24 [3][7][8]. These versions require GitHub Actions Runner version v2.327.1 or newer [9][8]. - actions/setup-node: v5.0.0 and later, and v6.0.0 and later, support Node.js 24 [4][5][6]. These versions also require runner version v2.327.1 or newer [4][5][6]. Node.js 20 Deprecation and Removal GitHub began the deprecation of Node.js 20 following its end-of-life status [1]. The timeline for this transition is as follows: - June 16, 2026: GitHub Actions runners began using Node.js 24 as the default runtime [1]. - Opt-out Period: Users who need to continue using Node.js 20 temporarily after this date can set the environment variable ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true in their workflow or runner environment [1][10]. - Removal: The ability to use Node.js 20 will be fully removed later in the fall of 2026, at which point the opt-out mechanism will no longer be available [1]. Users are advised to update their actions to versions that support Node.js 24 to ensure continued compatibility [1].
Citations:
- 1: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
- 2: Update Node 24 default date to June 16th, 2026 actions/runner#4462
- 3: https://github.com/actions/checkout/blob/main/CHANGELOG.md
- 4: https://github.com/actions/setup-node/releases/tag/v5.0.0
- 5: https://github.com/actions/setup-node/blob/v6/README.md
- 6: https://github.com/actions/setup-node
- 7: https://github.com/actions/checkout/releases/tag/v6.0.0
- 8: https://github.com/actions/checkout/releases/tag/v5.0.0
- 9: actions/checkout@v5.0.0...v6.0.0
- 10: Node 20 -> Node 24 migration feature flagging, opt-in and opt-out environment variables actions/runner#3948
Upgrade the CI actions to Node.js 24
Before branch protection depends on CI / verify, replace actions/checkout@v4 and actions/setup-node@v4 with Node.js 24-based majors (v5 or later). Pin each selected release to its commit SHA. The current majors use Node.js 20, which GitHub plans to remove from hosted runners in fall 2026.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 12-12: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 12 - 15, Update the CI workflow steps
using actions/checkout and actions/setup-node from v4 to Node.js 24-based major
releases (v5 or later), and pin each selected action version to its
corresponding commit SHA. Preserve the existing setup-node configuration,
including node-version: 24.
| permissions: | ||
| contents: read | ||
| pull-requests: read |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/secret-scan.yml'
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/secret-scan.yml
printf '%s\n' '--- related permission and Gitleaks references ---'
rg -n -C 3 'GITLEAKS_ENABLE_COMMENTS|gitleaks-action|pull-requests:|permissions:' .github README.md 2>/dev/null || true
printf '%s\n' '--- pinned action README at the referenced commit ---'
curl -fsSL 'https://raw.githubusercontent.com/gitleaks/gitleaks-action/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e/README.md' | sed -n '1,240p'Repository: nish3451/TinyStudio.io
Length of output: 10987
🏁 Script executed:
# Awaiting the repository and upstream README results before rewriting the comment.Repository: nish3451/TinyStudio.io
Length of output: 160
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- action manifest and source tree ---'
curl -fsSL 'https://api.github.com/repos/gitleaks/gitleaks-action/git/trees/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e?recursive=1' |
jq -r '.tree[] | select(.path == "action.yml" or (.path | test("(^|/)src/|dist/"))) | .path' |
head -80
printf '%s\n' '--- action metadata ---'
curl -fsSL 'https://raw.githubusercontent.com/gitleaks/gitleaks-action/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e/action.yml'
printf '%s\n' '--- source references to comments and failures ---'
for f in src/index.ts src/*.ts; do
body=$(curl -fsSL "https://raw.githubusercontent.com/gitleaks/gitleaks-action/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e/$f" || true)
if printf '%s' "$body" | rg -n 'GITLEAKS_ENABLE_COMMENTS|comment|createReviewComment|setFailed|throw'; then
printf '\n--- %s ---\n' "$f"
printf '%s\n' "$body" | rg -n -C 5 'GITLEAKS_ENABLE_COMMENTS|comment|createReviewComment|setFailed|throw'
fi
done
printf '%s\n' '--- GitHub permission documentation references ---'
curl -fsSL 'https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#permissions' |
rg -o -i '.{0,120}(pull-requests|create|write).{0,180}' | head -20 || trueRepository: nish3451/TinyStudio.io
Length of output: 7216
🏁 Script executed:
# Awaiting the action source and GitHub permission results before producing the rewritten comment.Repository: nish3451/TinyStudio.io
Length of output: 160
🏁 Script executed:
#!/bin/bash
set -eu
for f in src/index.js src/gitleaks.js src/summary.js; do
printf '\n--- %s ---\n' "$f"
curl -fsSL "https://raw.githubusercontent.com/gitleaks/gitleaks-action/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e/$f" |
nl -ba | rg -n -C 8 'GITLEAKS_ENABLE_COMMENTS|comment|createReviewComment|pull_request|setFailed|setOutput|process\.exit|throw'
done
printf '\n--- exact permission documentation text ---\n'
curl -fsSL 'https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax' |
tr '<' '\n' |
rg -i -C 2 'pull-requests.*(read|write)|create.*(issue|review).*comment|pull request review comments' |
head -80 || trueRepository: nish3451/TinyStudio.io
Length of output: 291
🏁 Script executed:
# Awaiting the action implementation and permission documentation output.Repository: nish3451/TinyStudio.io
Length of output: 160
🏁 Script executed:
#!/bin/bash
set -eu
for f in src/index.js src/gitleaks.js src/summary.js; do
printf '\n--- %s ---\n' "$f"
curl -fsSL "https://raw.githubusercontent.com/gitleaks/gitleaks-action/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e/$f" |
rg -n -C 8 'GITLEAKS_ENABLE_COMMENTS|comment|createReviewComment|pull_request|setFailed|setOutput|process\.exit|throw'
done
printf '\n--- permission documentation text ---\n'
curl -fsSL 'https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax' |
tr '<' '\n' |
rg -i -C 2 'pull-requests.*(read|write)|create.*(issue|review).*comment|pull request review comments' |
head -80 || trueRepository: nish3451/TinyStudio.io
Length of output: 7759
🏁 Script executed:
# Awaiting the corrected action source and permission documentation output.Repository: nish3451/TinyStudio.io
Length of output: 160
Disable Gitleaks pull-request comments.
gitleaks-action@v3 enables comments by default and requires pull-requests: write for review comments. Set GITLEAKS_ENABLE_COMMENTS to false with the current read-only permissions.
Proposed fix
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ GITLEAKS_ENABLE_COMMENTS: 'false'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/secret-scan.yml around lines 10 - 12, Update the
gitleaks-action@v3 configuration in the secret-scan workflow to set
GITLEAKS_ENABLE_COMMENTS to false, preserving the existing contents and
pull-requests read-only permissions.
… current main and live (2026-08-21, lane 1) (#276) Item ba5fb5fb58: the THREE agent-desk-canonical PRs #91/#131/#138 are no longer a duplicate open-PR cluster — #131 and #138 were closed by PR #157 on 2026-08-12, the substantive fix is on origin/main head 92d55c3 via PR #229 (commit 798cd71, merged 2026-08-17), and the canonical <link rel="canonical" href="https://tinystudio.io/agent-desk"> plus matching <meta property="og:url"> are present on source and live, md5-for-md5 (3310f720f1b9234970327ba35c52da94). Re-verification on the current head shows no code change is needed. This receipt is process evidence — a state verification of the repository's pull requests plus a reconciliation-history re-verify — not a live-index measurement. The dispatch item's trailing token "#105's declared survivor #9" reads "#91" in the backlog source and in the pr/postmerge-198 snapshot; the typo is in the dispatch only. Co-authored-by: minimax-vps <minimax-vps@local> Co-authored-by: minimax-vps <minimax-vps@users.noreply.github.com>
2 participants
TinyStudio.io had no CI workflows at all, so
mainhad nothing real to protect and auto-merge had nothing to wait on. Flagged as the top blocker by the 2026-08-06 fleet audit (Grok 4.5 High and GPT-5.6 Sol, independently).Adds the two checks the rest of the fleet already runs, with matching job names so required-check contexts stay consistent:
verifynpm ci,npm test,wrangler deploy --dry-runGitleaksnpm testhere isscripts/check-site.mjs, which only reads files - no network, no secrets - so requiring it on every PR is safe. Verified passing locally before shipping a gate that depends on it.Once this lands and both checks have reported once,
maingets branch protection requiring them. siterep was given the same protection today; 0509 already had it.Summary by CodeRabbit