Skip to content

ci: add build+test gate and secret scan on PRs #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nish3451 merged 1 commit into from
Aug 6, 2026
Merged

ci: add build+test gate and secret scan on PRs #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
name: CI

on:
pull_request:
push:
branches: [main]

jobs:
verify:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 24
Comment on lines +12 to +15

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/ci.yml
printf '%s\n' '--- action references ---'
rg -n 'actions/(checkout|setup-node)@|gitleaks|branch protection|verify' .github README.md 2>/dev/null || true
printf '%s\n' '--- remote action metadata ---'
for ref in checkout/v4 checkout/v5 checkout/v6 setup-node/v4 setup-node/v5 setup-node/v6; do
  repo=${ref%/*}; tag=${ref#*/}
  url="https://raw.githubusercontent.com/actions/${repo}/${tag}/action.yml"
  printf '\n[%s]\n' "$ref"
  curl -fsSL "$url" | rg -n 'using:|node[0-9]+|runs:' || true
done

Repository: nish3451/TinyStudio.io

Length of output: 1497

🌐 Web query:

GitHub Actions checkout v5 v6 setup-node v5 v6 Node 24 runtime official documentation June 16 2026 Node 20 removal September 16 2026

💡 Result:

GitHub Actions has transitioned to using Node.js 24 as the default runtime for actions, with the official switch occurring on June 16, 2026 [1][2]. Node.js 24 Support Both actions/checkout and actions/setup-node have been updated to support the Node.js 24 runtime in their v5 and v6 major versions [3][4][5][6]. - actions/checkout: v5.0.0 and later, and v6.0.0 and later, are updated to use Node.js 24 [3][7][8]. These versions require GitHub Actions Runner version v2.327.1 or newer [9][8]. - actions/setup-node: v5.0.0 and later, and v6.0.0 and later, support Node.js 24 [4][5][6]. These versions also require runner version v2.327.1 or newer [4][5][6]. Node.js 20 Deprecation and Removal GitHub began the deprecation of Node.js 20 following its end-of-life status [1]. The timeline for this transition is as follows: - June 16, 2026: GitHub Actions runners began using Node.js 24 as the default runtime [1]. - Opt-out Period: Users who need to continue using Node.js 20 temporarily after this date can set the environment variable ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true in their workflow or runner environment [1][10]. - Removal: The ability to use Node.js 20 will be fully removed later in the fall of 2026, at which point the opt-out mechanism will no longer be available [1]. Users are advised to update their actions to versions that support Node.js 24 to ensure continued compatibility [1].

Citations:

Upgrade the CI actions to Node.js 24

Before branch protection depends on CI / verify, replace actions/checkout@v4 and actions/setup-node@v4 with Node.js 24-based majors (v5 or later). Pin each selected release to its commit SHA. The current majors use Node.js 20, which GitHub plans to remove from hosted runners in fall 2026.

🧰 Tools
🪛 zizmor (1.29.0)

[warning] 12-12: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 12 - 15, Update the CI workflow steps
using actions/checkout and actions/setup-node from v4 to Node.js 24-based major
releases (v5 or later), and pin each selected action version to its
corresponding commit SHA. Preserve the existing setup-node configuration,
including node-version: 24.

cache: npm
- run: npm ci
- run: npm test
- name: Wrangler config and bundle check
run: npx wrangler@latest deploy --dry-run

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Run the lockfile-pinned Wrangler version

When Wrangler publishes a new latest version, this gate will test that unreviewed release rather than the version installed by npm ci from package-lock.json, so otherwise unchanged PRs can begin failing because of new CLI behavior or Node requirements. Checked npx --help, whose usage accepts <pkg>[@<version>]; the explicit @latest is therefore what bypasses the local pinned dependency. Use the repository's npm run deploy:dry-run command required by specs/001-public-buyer-page/plan.md:27 instead.

AGENTS.md reference: AGENTS.md:L2-L3

Useful? React with 👍 / 👎.

27 changes: 27 additions & 0 deletions .github/workflows/secret-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
name: Secret Scan

on:
pull_request:
push:
branches:
- main
workflow_dispatch:

permissions:
contents: read
pull-requests: read
Comment on lines +10 to +12

@coderabbitai coderabbitai Bot Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- workflow files ---'
git ls-files '.github/workflows/secret-scan.yml'
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/secret-scan.yml
printf '%s\n' '--- related permission and Gitleaks references ---'
rg -n -C 3 'GITLEAKS_ENABLE_COMMENTS|gitleaks-action|pull-requests:|permissions:' .github README.md 2>/dev/null || true
printf '%s\n' '--- pinned action README at the referenced commit ---'
curl -fsSL 'https://raw.githubusercontent.com/gitleaks/gitleaks-action/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e/README.md' | sed -n '1,240p'

Repository: nish3451/TinyStudio.io

Length of output: 10987

🏁 Script executed:

# Awaiting the repository and upstream README results before rewriting the comment.

Repository: nish3451/TinyStudio.io

Length of output: 160

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- action manifest and source tree ---'
curl -fsSL 'https://api.github.com/repos/gitleaks/gitleaks-action/git/trees/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e?recursive=1' |
  jq -r '.tree[] | select(.path == "action.yml" or (.path | test("(^|/)src/|dist/"))) | .path' |
  head -80
printf '%s\n' '--- action metadata ---'
curl -fsSL 'https://raw.githubusercontent.com/gitleaks/gitleaks-action/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e/action.yml'
printf '%s\n' '--- source references to comments and failures ---'
for f in src/index.ts src/*.ts; do
  body=$(curl -fsSL "https://raw.githubusercontent.com/gitleaks/gitleaks-action/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e/$f" || true)
  if printf '%s' "$body" | rg -n 'GITLEAKS_ENABLE_COMMENTS|comment|createReviewComment|setFailed|throw'; then
    printf '\n--- %s ---\n' "$f"
    printf '%s\n' "$body" | rg -n -C 5 'GITLEAKS_ENABLE_COMMENTS|comment|createReviewComment|setFailed|throw'
  fi
done
printf '%s\n' '--- GitHub permission documentation references ---'
curl -fsSL 'https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#permissions' |
  rg -o -i '.{0,120}(pull-requests|create|write).{0,180}' | head -20 || true

Repository: nish3451/TinyStudio.io

Length of output: 7216

🏁 Script executed:

# Awaiting the action source and GitHub permission results before producing the rewritten comment.

Repository: nish3451/TinyStudio.io

Length of output: 160

🏁 Script executed:

#!/bin/bash
set -eu
for f in src/index.js src/gitleaks.js src/summary.js; do
  printf '\n--- %s ---\n' "$f"
  curl -fsSL "https://raw.githubusercontent.com/gitleaks/gitleaks-action/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e/$f" |
    nl -ba | rg -n -C 8 'GITLEAKS_ENABLE_COMMENTS|comment|createReviewComment|pull_request|setFailed|setOutput|process\.exit|throw'
done
printf '\n--- exact permission documentation text ---\n'
curl -fsSL 'https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax' |
  tr '<' '\n' |
  rg -i -C 2 'pull-requests.*(read|write)|create.*(issue|review).*comment|pull request review comments' |
  head -80 || true

Repository: nish3451/TinyStudio.io

Length of output: 291

🏁 Script executed:

# Awaiting the action implementation and permission documentation output.

Repository: nish3451/TinyStudio.io

Length of output: 160

🏁 Script executed:

#!/bin/bash
set -eu
for f in src/index.js src/gitleaks.js src/summary.js; do
  printf '\n--- %s ---\n' "$f"
  curl -fsSL "https://raw.githubusercontent.com/gitleaks/gitleaks-action/e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e/$f" |
    rg -n -C 8 'GITLEAKS_ENABLE_COMMENTS|comment|createReviewComment|pull_request|setFailed|setOutput|process\.exit|throw'
done
printf '\n--- permission documentation text ---\n'
curl -fsSL 'https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax' |
  tr '<' '\n' |
  rg -i -C 2 'pull-requests.*(read|write)|create.*(issue|review).*comment|pull request review comments' |
  head -80 || true

Repository: nish3451/TinyStudio.io

Length of output: 7759

🏁 Script executed:

# Awaiting the corrected action source and permission documentation output.

Repository: nish3451/TinyStudio.io

Length of output: 160

Disable Gitleaks pull-request comments.

gitleaks-action@v3 enables comments by default and requires pull-requests: write for review comments. Set GITLEAKS_ENABLE_COMMENTS to false with the current read-only permissions.

Proposed fix 
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_ENABLE_COMMENTS: 'false'
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/secret-scan.yml around lines 10 - 12, Update the
gitleaks-action@v3 configuration in the secret-scan workflow to set
GITLEAKS_ENABLE_COMMENTS to false, preserving the existing contents and
pull-requests read-only permissions.


jobs:
gitleaks:
name: Gitleaks
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 0
persist-credentials: false
- name: Scan repository
uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Loading