feat(localization): added zh_TW - #2910
Conversation
添加繁体中文支持 added zh_TW
WalkthroughSplits the single Chinese locale into Simplified (zh_CN) and Traditional (zh_TW): backend constants and normalization updated, new zh_TW locale file added, frontend i18n and language selector updated, README files adjusted to expose both Chinese variants and blockquote-style formatting. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant Frontend
participant Backend
participant LocaleFile
User->>Frontend: select language (zh_CN / zh_TW)
Frontend->>Frontend: map selection to locale key
Frontend->>Backend: request localized content / save preference
Backend->>Backend: normalize language -> LangZhCN or LangZhTW
Backend->>LocaleFile: load translations (zh_CN / zh_TW)
LocaleFile-->>Backend: return localized strings
Backend-->>Frontend: respond with localized content / ack preference
Frontend-->>User: render UI in selected locale
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (4)
web/src/components/settings/personal/cards/PreferencesSettings.jsx (1)
41-41:⚠️ Potential issue | 🟠 MajorStale default language value
'zh'.The fallback default
'zh'no longer matches any registered i18n resource key (nowzhCN/zhTWor the correctedzh-CN/zh-TW). This will cause the initial render to show untranslated keys until the user's saved preference is loaded. Update this to match your chosen Simplified Chinese key.- const [currentLanguage, setCurrentLanguage] = useState(i18n.language || 'zh'); + const [currentLanguage, setCurrentLanguage] = useState(i18n.language || 'zh-CN');i18n/i18n.go (3)
200-215:⚠️ Potential issue | 🔴 CriticalBug:
normalizeLangwill never matchzh_CNorzh_TW— input is lowercased but comparisons use mixed case.Line 202 lowercases the input (
strings.ToLower), so"zh_CN"becomes"zh_cn"and"zh_TW"becomes"zh_tw". TheHasPrefixchecks on lines 206 and 208 compare against the original mixed-case constants"zh_CN"and"zh_TW", which will never match the lowercased string. Every Chinese language input falls through toDefaultLang(English).Additionally:
- Standard
Accept-Languageheaders use hyphens (zh-CN,zh-TW), not underscores — these should be normalized.- The previous
"zh"prefix handling was removed, breaking backward compatibility for users/settings that stored"zh"as their language preference.🐛 Proposed fix
func normalizeLang(lang string) string { lang = strings.ToLower(strings.TrimSpace(lang)) + lang = strings.ReplaceAll(lang, "-", "_") // Handle common variations switch { - case strings.HasPrefix(lang, "zh_CN"): + case strings.HasPrefix(lang, "zh_tw"): + return LangZhTW + case strings.HasPrefix(lang, "zh_cn"): return LangZhCN - case strings.HasPrefix(lang, "zh_TW"): - return LangZhTW + case strings.HasPrefix(lang, "zh"): + return LangZhCN // backward-compat: bare "zh" defaults to Simplified case strings.HasPrefix(lang, "en"): return LangEn default: return DefaultLang } }Note:
zh_twmust be checked beforezh_cn/zhto preventzh_twfrom matching the shorterzhprefix first.
42-54:⚠️ Potential issue | 🔴 CriticalLoad both
zh_CN.yamlandzh_TW.yamltranslation files into the bundle;zh.yamldoes not exist.Line 43 loads
locales/zh.yamlwhich doesn't exist in the repository. The actual Chinese Simplified file islocales/zh_CN.yaml. Additionally, thezh_TW.yamlfile exists but is never loaded, so theLangZhTWlocalizer created on line 54 has no zh_TW-specific messages and will silently fall back to English.🐛 Fix: load the correct translation files
// Load embedded translation files - files := []string{"locales/zh.yaml", "locales/en.yaml"} + files := []string{"locales/zh_CN.yaml", "locales/zh_TW.yaml", "locales/en.yaml"}
39-39:⚠️ Potential issue | 🟠 MajorThe backend i18n implementation exceeds documented language support and introduces unexpected fallback behavior.
The code creates
zh_CNandzh_TWlocalizers but loads only a genericzh.yamlfile into the bundle. This violates the requirement that backend i18n supports onlyenandzhlanguages. Additionally:
- Using underscore format (
zh_CN) instead of BCP-47 hyphens (zh-CN) may cause matching failures.- Single-tag localizers created without fallback chains risk unexpected resolution when BCP-47 matching cannot find
zh_CN/zh_TWin the bundle.Either remove
zh_CN/zh_TWsupport to align with documented requirements, or load region-specific translation files and use explicit fallback chains (e.g.,i18n.NewLocalizer(bundle, "zh_CN", "zh", LangEn)).
🤖 Fix all issues with AI agents
In `@README.zh_TW.md`:
- Around line 9-15: The navigation mistakenly links to README.zh_TW.md twice and
omits the Simplified Chinese link; update the second anchor so it points to
README.zh_CN.md and uses the label "简体中文" (keeping the first "繁體中文" as plain
text for the current page), e.g. replace the duplicate <a
href="./README.zh_TW.md">繁體中文</a> entry with <a
href="./README.zh_CN.md">简体中文</a> so navigation shows 繁體中文 (current), 简体中文,
English, Français, 日本語.
In `@web/src/i18n/i18n.js`:
- Around line 36-46: The i18n resources use custom keys (zhCN, zhTW) while
PreferencesSettings.jsx calls i18n.changeLanguage with zh_CN/zh_TW and load:
'languageOnly' strips region subtags; pick one fix: recommended Option A —
rename resource keys to BCP‑47 (zh-CN, zh-TW), update any selector values in
PreferencesSettings.jsx to 'zh-CN'/'zh-TW', and change the i18n config load
option from 'languageOnly' to 'all' or 'currentOnly' so region is preserved;
alternatively (Option B) keep the custom keys by changing
PreferencesSettings.jsx to use 'zhCN'/'zhTW' and set load to 'currentOnly' so
the custom keys resolve.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Fix all issues with AI agents
In `@README.zh_TW.md`:
- Line 190: The multilingual feature row currently shows "| 🌍 多語言 |
支援中文、英文、法語、日語 |" which omits supported languages; update that table row (the
string starting with "🌍 多語言") to list all supported languages including Russian
and Vietnamese and explicitly include both zh-CN and zh-TW (e.g.,
"支援中文（zh-CN、zh-TW）、英文、法語、日語、俄語、越南語") so the README accurately reflects current
language support.
In `@web/src/i18n/i18n.js`:
- Around line 39-40: The object keys zh-CN and zh-TW are unquoted and thus
parsed as subtraction expressions; update the translations object so the keys
are string literals (e.g., "zh-CN" and "zh-TW") mapping to zhCNTranslation and
zhTWTranslation respectively, ensuring the properties are quoted to avoid
JavaScript parse errors when exporting/using the translations object.
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Fix all issues with AI agents
In `@README.fr.md`:
- Line 190: Update the Multilingue feature row string ("| 🌍 Multilingue | Prend
en charge le chinois simplifié, le chinois traditionnel, l'anglais, le français
et le japonais |") to include Russian and Vietnamese as supported languages
(matching frontend i18n: zh_CN, zh_TW, en, fr, ru, ja, vi) so the README
accurately reflects all supported languages.
In `@README.ja.md`:
- Line 190: Update the multilingual feature row string that currently reads "|
🌍 多言語 | 簡体字中国語、繁体字中国語、英語、フランス語、日本語をサポート |" to include Russian and Vietnamese
(e.g., add "ロシア語、ベトナム語") so it reflects frontend i18n support for zh_CN, zh_TW,
en, fr, ru, ja, vi; edit the README.ja.md table cell with the "🌍 多言語" row to
list all supported languages.
In `@README.md`:
- Line 190: Update the "🌍 Multi-language" table row in README.md to include the
missing languages Russian and Vietnamese; locate the row that currently reads
"Supports Simplified Chinese, Traditional Chinese, English, French, Japanese"
and expand it to list all supported locales (e.g., Simplified Chinese,
Traditional Chinese, English, French, Russian, Japanese, Vietnamese or
corresponding locale codes zh_CN, zh_TW, en, fr, ru, ja, vi) so the README
accurately reflects frontend i18n support.
| |------|------| | ||
| | 🎨 Nouvelle interface utilisateur | Conception d'interface utilisateur moderne | | ||
| | 🌍 Multilingue | Prend en charge le chinois, l'anglais, le français, le japonais | | ||
| | 🌍 Multilingue | Prend en charge le chinois simplifié, le chinois traditionnel, l'anglais, le français et le japonais | |
There was a problem hiding this comment.
Incomplete language list in the multilingual feature row.
The feature description lists Chinese (Simplified and Traditional), English, French, and Japanese, but omits Russian and Vietnamese which are also supported.
📝 Suggested fix
-| 🌍 Multilingue | Prend en charge le chinois simplifié, le chinois traditionnel, l'anglais, le français et le japonais |
+| 🌍 Multilingue | Prend en charge le chinois simplifié, le chinois traditionnel, l'anglais, le français, le russe, le japonais et le vietnamien |Based on learnings: Frontend i18n supports zh_CN, zh_TW, en, fr, ru, ja, vi.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| | 🌍 Multilingue | Prend en charge le chinois simplifié, le chinois traditionnel, l'anglais, le français et le japonais | | |
| | 🌍 Multilingue | Prend en charge le chinois simplifié, le chinois traditionnel, l'anglais, le français, le russe, le japonais et le vietnamien | |
🤖 Prompt for AI Agents
In `@README.fr.md` at line 190, Update the Multilingue feature row string ("| 🌍
Multilingue | Prend en charge le chinois simplifié, le chinois traditionnel,
l'anglais, le français et le japonais |") to include Russian and Vietnamese as
supported languages (matching frontend i18n: zh_CN, zh_TW, en, fr, ru, ja, vi)
so the README accurately reflects all supported languages.
| |------|------| | ||
| | 🎨 新しいUI | モダンなユーザーインターフェースデザイン | | ||
| | 🌍 多言語 | 中国語、英語、フランス語、日本語をサポート | | ||
| | 🌍 多言語 | 簡体字中国語、繁体字中国語、英語、フランス語、日本語をサポート | |
There was a problem hiding this comment.
Incomplete language list in the multilingual feature row.
The feature lists Simplified Chinese, Traditional Chinese, English, French, and Japanese, but omits Russian and Vietnamese which are also supported by the frontend.
📝 Suggested fix
-| 🌍 多言語 | 簡体字中国語、繁体字中国語、英語、フランス語、日本語をサポート |
+| 🌍 多言語 | 簡体字中国語、繁体字中国語、英語、フランス語、ロシア語、日本語、ベトナム語をサポート |Based on learnings: Frontend i18n supports zh_CN, zh_TW, en, fr, ru, ja, vi.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| | 🌍 多言語 | 簡体字中国語、繁体字中国語、英語、フランス語、日本語をサポート | | |
| | 🌍 多言語 | 簡体字中国語、繁体字中国語、英語、フランス語、ロシア語、日本語、ベトナム語をサポート | |
🤖 Prompt for AI Agents
In `@README.ja.md` at line 190, Update the multilingual feature row string that
currently reads "| 🌍 多言語 | 簡体字中国語、繁体字中国語、英語、フランス語、日本語をサポート |" to include
Russian and Vietnamese (e.g., add "ロシア語、ベトナム語") so it reflects frontend i18n
support for zh_CN, zh_TW, en, fr, ru, ja, vi; edit the README.ja.md table cell
with the "🌍 多言語" row to list all supported languages.
| |------|------| | ||
| | 🎨 New UI | Modern user interface design | | ||
| | 🌍 Multi-language | Supports Chinese, English, French, Japanese | | ||
| | 🌍 Multi-language | Supports Simplified Chinese, Traditional Chinese, English, French, Japanese | |
There was a problem hiding this comment.
Incomplete language list in the multilingual feature row.
The feature description mentions Simplified Chinese, Traditional Chinese, English, French, and Japanese, but omits Russian and Vietnamese which are also supported.
📝 Suggested fix
-| 🌍 Multi-language | Supports Simplified Chinese, Traditional Chinese, English, French, Japanese |
+| 🌍 Multi-language | Supports Simplified Chinese, Traditional Chinese, English, French, Russian, Japanese, Vietnamese |Based on learnings: Frontend i18n supports zh_CN, zh_TW, en, fr, ru, ja, vi.
🤖 Prompt for AI Agents
In `@README.md` at line 190, Update the "🌍 Multi-language" table row in README.md
to include the missing languages Russian and Vietnamese; locate the row that
currently reads "Supports Simplified Chinese, Traditional Chinese, English,
French, Japanese" and expand it to list all supported locales (e.g., Simplified
Chinese, Traditional Chinese, English, French, Russian, Japanese, Vietnamese or
corresponding locale codes zh_CN, zh_TW, en, fr, ru, ja, vi) so the README
accurately reflects frontend i18n support.
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Fix all issues with AI agents
In @.github/workflows/docker.yml:
- Around line 29-35: The workflow installs cosign in the "Install cosign" step
but never uses it to sign the image; either remove that step or add a post-build
signing step: after the job step that builds and pushes the image (the
build-and-push step) add a step that runs cosign sign --key or cosign sign
--keyless against the pushed image digest (use the same image name/digest output
from the build step), or alternatively delete the "Install cosign" step to avoid
unnecessary installation; ensure the new step references the image digest
variable produced by the build-and-push step and runs only when not a
pull_request (same if condition as the Install cosign step).
- Line 27: Update the workflow step that references actions/checkout@v3 to use
actions/checkout@v4 to address deprecation/Node16 EOL and satisfy actionlint;
locate the line containing "uses: actions/checkout@v3" and replace the version
tag with "@v4", then run your workflow linter and CI to verify there are no
further compatibility issues.
In @.github/workflows/sync.yml:
- Around line 1-10: This PR adds an unrelated CI workflow called "Sync Upstream"
(the sync.yml workflow with the schedule/cron and workflow_dispatch entries);
remove this workflow from the current changeset and either revert the sync.yml
addition or move it into a separate branch/PR dedicated to fork-sync updates so
the zh_TW localization PR only contains localization files and related changes.
- Around line 42-43: The workflow step that prints the has_new_commits output is
using an unquoted GitHub Actions expression which is a shell injection risk;
update the step named "Show value of 'has_new_commits'" so the run command wraps
the expression in quotes (i.e., quote the ${{ steps.sync.outputs.has_new_commits
}} expression used in the run line) to ensure the value is treated as a single
string and prevent injection.
- Line 19: Update the GitHub Actions checkout action reference from
actions/checkout@v3 to actions/checkout@v4 to remove the deprecated Node.js
runtime warning; find the uses: actions/checkout@v3 entry in the workflow (the
checkout step) and change the version tag to `@v4` so the workflow uses the v4
runner-compatible release.
- Around line 26-32: Update the GitHub Action reference and remove the
unnecessary git flag: change the action reference
aormsby/Fork-Sync-With-Upstream-action@v3.4 to at least v3.4.1 or, preferably,
pin to a specific commit SHA, and delete the upstream_pull_args:
'--allow-unrelated-histories' line (remove use of upstream_pull_args entirely
unless there is a documented need for unrelated history merges).
🧹 Nitpick comments (1)
.github/workflows/docker.yml (1)
58-67: Upgradedocker/build-push-actiontov6and add multi-platform support.
docker/build-push-action@v6is the current major version and includes Docker Build summary support, build archive export, and security hardening improvements. Without an explicitplatformskey, the image is only built for the runner's architecture (amd64). To support arm64, addplatforms: linux/amd64,linux/arm64.Proposed changes
- uses: docker/build-push-action@v5 + uses: docker/build-push-action@v6 with: context: . push: ${{ github.event_name != 'pull_request' }} tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} + platforms: linux/amd64,linux/arm64 cache-from: type=gha cache-to: type=gha,mode=max
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v3 |
There was a problem hiding this comment.
actions/checkout@v3 is deprecated — upgrade to v4.
v3 uses Node 16 which is EOL on GitHub Actions. This is also flagged by actionlint.
Proposed fix
- uses: actions/checkout@v3
+ uses: actions/checkout@v4📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: actions/checkout@v3 | |
| uses: actions/checkout@v4 |
🧰 Tools
🪛 actionlint (1.7.10)
[error] 27-27: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
In @.github/workflows/docker.yml at line 27, Update the workflow step that
references actions/checkout@v3 to use actions/checkout@v4 to address
deprecation/Node16 EOL and satisfy actionlint; locate the line containing "uses:
actions/checkout@v3" and replace the version tag with "@v4", then run your
workflow linter and CI to verify there are no further compatibility issues.
| # Install the cosign tool except on PR | ||
| # https://github.com/sigstore/cosign-installer | ||
| - name: Install cosign | ||
| if: github.event_name != 'pull_request' | ||
| uses: sigstore/cosign-installer@v3.5.0 | ||
| with: | ||
| cosign-release: 'v2.2.4' |
There was a problem hiding this comment.
Cosign is installed but never used to sign the image.
The workflow installs cosign but there is no subsequent step that actually signs the built image digest. Either add a signing step after the build-and-push step, or remove the cosign installation to avoid unnecessary complexity and workflow time.
🤖 Prompt for AI Agents
In @.github/workflows/docker.yml around lines 29 - 35, The workflow installs
cosign in the "Install cosign" step but never uses it to sign the image; either
remove that step or add a post-build signing step: after the job step that
builds and pushes the image (the build-and-push step) add a step that runs
cosign sign --key or cosign sign --keyless against the pushed image digest (use
the same image name/digest output from the build step), or alternatively delete
the "Install cosign" step to avoid unnecessary installation; ensure the new step
references the image digest variable produced by the build-and-push step and
runs only when not a pull_request (same if condition as the Install cosign
step).
| name: Sync Upstream | ||
|
|
||
| permissions: | ||
| contents: write | ||
|
|
||
| on: | ||
| schedule: | ||
| # Run once a day at midnight | ||
| - cron: "0 0 * * *" | ||
| workflow_dispatch: |
There was a problem hiding this comment.
This workflow appears unrelated to the zh_TW localization PR.
A fork-sync workflow doesn't belong in a PR that adds Traditional Chinese support. Consider splitting this into a separate PR to keep changes focused and reviewable.
🤖 Prompt for AI Agents
In @.github/workflows/sync.yml around lines 1 - 10, This PR adds an unrelated CI
workflow called "Sync Upstream" (the sync.yml workflow with the schedule/cron
and workflow_dispatch entries); remove this workflow from the current changeset
and either revert the sync.yml addition or move it into a separate branch/PR
dedicated to fork-sync updates so the zh_TW localization PR only contains
localization files and related changes.
|
|
||
| steps: | ||
| - name: Checkout target repo | ||
| uses: actions/checkout@v3 |
There was a problem hiding this comment.
Update actions/checkout to v4.
actions/checkout@v3 uses a deprecated Node.js runtime. Upgrade to v4 to avoid warnings and ensure continued compatibility with GitHub Actions runners.
Proposed fix
- uses: actions/checkout@v3
+ uses: actions/checkout@v4📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: actions/checkout@v3 | |
| uses: actions/checkout@v4 |
🧰 Tools
🪛 actionlint (1.7.10)
[error] 19-19: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🤖 Prompt for AI Agents
In @.github/workflows/sync.yml at line 19, Update the GitHub Actions checkout
action reference from actions/checkout@v3 to actions/checkout@v4 to remove the
deprecated Node.js runtime warning; find the uses: actions/checkout@v3 entry in
the workflow (the checkout step) and change the version tag to `@v4` so the
workflow uses the v4 runner-compatible release.
| uses: aormsby/Fork-Sync-With-Upstream-action@v3.4 | ||
| with: | ||
| upstream_sync_repo: QuantumNous/new-api | ||
| upstream_sync_branch: main | ||
| target_sync_branch: main | ||
| target_repo_token: ${{ secrets.GITHUB_TOKEN }} | ||
| upstream_pull_args: '--allow-unrelated-histories' |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
aormsby Fork-Sync-With-Upstream-action GitHub latest version releases 2025
💡 Result:
- Latest release (as of Feb 11, 2026):
v3.4.1(released Mar 9, 2024) foraormsby/Fork-Sync-With-Upstream-action. [1][2] - 2025 releases: None (the repo’s newest tag/release shown is still
v3.4.1from 2024). [1][3]
Use in workflow: uses: aormsby/Fork-Sync-With-Upstream-action@v3.4.1 [2]
Sources: [1] https://github.com/aormsby/Fork-Sync-With-Upstream-action/releases, [2] https://github.com/marketplace/actions/upstream-sync, [3] https://github.com/aormsby/Fork-Sync-With-Upstream-action/tags
🏁 Script executed:
# Search for the action repository and check if it's still maintained
cd /tmp && git clone --depth 1 https://github.com/aormsby/Fork-Sync-With-Upstream-action.git 2>/dev/null || echo "Clone check attempted"
# Check GitHub releases via web if available
curl -s "https://api.github.com/repos/aormsby/Fork-Sync-With-Upstream-action/releases" 2>/dev/null | jq -r '.[0:5] | .[] | "\(.tag_name) - \(.published_at)"' | head -10Repository: QuantumNous/new-api
Length of output: 206
Update action to v3.4.1 (or pin to commit SHA) and remove --allow-unrelated-histories flag.
- The workflow uses
v3.4from October 2022; the latest version isv3.4.1(March 2024). Update to at leastv3.4.1, or follow best practice by pinning the action to a specific commit SHA rather than a mutable tag to mitigate supply-chain risks. --allow-unrelated-historiesbypasses git's ancestry checks and can introduce unexpected merge artifacts. For a fork sync, this should not be necessary unless the repositories genuinely have divergent history that requires explicit acknowledgment. Remove it unless there is a documented reason.
Proposed fix
- uses: aormsby/Fork-Sync-With-Upstream-action@v3.4
+ uses: aormsby/Fork-Sync-With-Upstream-action@v3.4.1
with:
upstream_sync_repo: QuantumNous/new-api
upstream_sync_branch: main
target_sync_branch: main
target_repo_token: ${{ secrets.GITHUB_TOKEN }}
- upstream_pull_args: '--allow-unrelated-histories'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: aormsby/Fork-Sync-With-Upstream-action@v3.4 | |
| with: | |
| upstream_sync_repo: QuantumNous/new-api | |
| upstream_sync_branch: main | |
| target_sync_branch: main | |
| target_repo_token: ${{ secrets.GITHUB_TOKEN }} | |
| upstream_pull_args: '--allow-unrelated-histories' | |
| uses: aormsby/Fork-Sync-With-Upstream-action@v3.4.1 | |
| with: | |
| upstream_sync_repo: QuantumNous/new-api | |
| upstream_sync_branch: main | |
| target_sync_branch: main | |
| target_repo_token: ${{ secrets.GITHUB_TOKEN }} |
🤖 Prompt for AI Agents
In @.github/workflows/sync.yml around lines 26 - 32, Update the GitHub Action
reference and remove the unnecessary git flag: change the action reference
aormsby/Fork-Sync-With-Upstream-action@v3.4 to at least v3.4.1 or, preferably,
pin to a specific commit SHA, and delete the upstream_pull_args:
'--allow-unrelated-histories' line (remove use of upstream_pull_args entirely
unless there is a documented need for unrelated history merges).
| - name: Show value of 'has_new_commits' | ||
| run: echo ${{ steps.sync.outputs.has_new_commits }} |
There was a problem hiding this comment.
Quote the expression to prevent shell injection.
Unquoted ${{ }} expressions in run: are a script injection vector. Always wrap them in quotes.
Proposed fix
- run: echo ${{ steps.sync.outputs.has_new_commits }}
+ run: echo "${{ steps.sync.outputs.has_new_commits }}"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Show value of 'has_new_commits' | |
| run: echo ${{ steps.sync.outputs.has_new_commits }} | |
| - name: Show value of 'has_new_commits' | |
| run: echo "${{ steps.sync.outputs.has_new_commits }}" |
🤖 Prompt for AI Agents
In @.github/workflows/sync.yml around lines 42 - 43, The workflow step that
prints the has_new_commits output is using an unquoted GitHub Actions expression
which is a shell injection risk; update the step named "Show value of
'has_new_commits'" so the run command wraps the expression in quotes (i.e.,
quote the ${{ steps.sync.outputs.has_new_commits }} expression used in the run
line) to ensure the value is treated as a single string and prevent injection.
|
wrong branch |
1 participant
添加繁体中文支持
added zh_TW
Summary by CodeRabbit
Documentation
New Features
Chores