Conversation
|
Warning Review limit reached
More reviews will be available in 38 minutes and 30 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdds supply-chain security hardening across CI (lockfile freshness check, ChangesSupply Chain & CI Security Hardening
Test Directory Restructuring
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/check.yml:
- Line 22: Replace the unpinned `actions/checkout@v4` reference with a pinned
commit hash version in the format `actions/checkout@<commit-hash>`. Visit
https://github.com/actions/checkout/releases to find the latest v4 commit hash
and update the action reference to pin it to that specific commit instead of
using the version tag. This applies to all instances of the checkout action in
the workflow file to ensure consistent security hardening across all action
references.
In @.github/workflows/scorecard.yml:
- Line 22: Replace the version tags in the GitHub Actions references with
specific commit hashes to follow security best practices. For the
actions/checkout action (currently using `@v4`), ossf/scorecard-action (currently
using `@v2.4.0`), and github/codeql-action/upload-sarif (currently using `@v3`),
update each uses statement to pin to a specific commit hash instead of the
version tag. Verify the correct commit hashes by checking each action's releases
page on GitHub and update all three action references accordingly.
In `@subtrack/src/__tests__/display.test.ts`:
- Line 5: The import statement for spreadSubscription is missing the required
.ts file extension. Update the import statement by adding the .ts extension to
the import path from "../display" to "../display.ts" to comply with the repo's
coding guidelines that require explicit .ts extensions for local imports.
In `@subtrack/tsconfig.json`:
- Line 2: The exclude array in tsconfig.json currently hardcodes the exclusion
of src/__tests__, which conflicts with the repository's policy of co-locating
test files as *.test.ts alongside source modules. Remove the src/__tests__
exclusion and replace it with a pattern that excludes co-located test files such
as **/*.test.ts and **/*.test.tsx to align with the project's coding guidelines.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e1f611eb-a927-4bf7-8192-8101a525d910
📒 Files selected for processing (13)
.github/workflows/check.yml.github/workflows/scorecard.ymlSECURITY.mdpnpm-workspace.yamlsubtrack/README.mdsubtrack/package.jsonsubtrack/src/__tests__/commands.test.tssubtrack/src/__tests__/crypto.test.tssubtrack/src/__tests__/db.test.tssubtrack/src/__tests__/display.test.tssubtrack/src/__tests__/pricing.test.tssubtrack/src/pricing.tssubtrack/tsconfig.json
| @@ -22,10 +22,16 @@ jobs: | |||
|
|
|||
There was a problem hiding this comment.
Pin GitHub Actions to commit hashes.
The actions/checkout@v4 reference on line 22 is unpinned. Per GitHub security best practices and the requirements flagged by static analysis, all action references must be pinned to a specific commit hash (not a tag or branch) to prevent supply-chain attacks and ensure reproducible workflows.
While the lockfile verification (lines 25–26) and audit logic (lines 36–37) are sound, the unpinned action undermines the security hardening intent of this PR.
🔒 Proposed fix: Pin action to commit hash
- - uses: actions/checkout@v4
+ - uses: actions/checkout@44c85305e41dfe471331e387f004d221add66d31 # v4.1.1(Verify the latest v4.x commit hash at https://github.com/actions/checkout/releases)
Also applies to: 25-37
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/check.yml at line 22, Replace the unpinned
`actions/checkout@v4` reference with a pinned commit hash version in the format
`actions/checkout@<commit-hash>`. Visit
https://github.com/actions/checkout/releases to find the latest v4 commit hash
and update the action reference to pin it to that specific commit instead of
using the version tag. This applies to all instances of the checkout action in
the workflow file to ensure consistent security hardening across all action
references.
Source: Linters/SAST tools
| security-events: write | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
Pin all GitHub Actions to commit hashes.
Three action references are unpinned and violate security best practices:
- Line 22:
actions/checkout@v4 - Line 26:
ossf/scorecard-action@v2.4.0 - Line 33:
github/codeql-action/upload-sarif@v3
Unpinned tags and versions are mutable and vulnerable to supply-chain attacks (tag hijacking, compromised releases). All actions must be pinned to specific commit hashes.
🔒 Proposed fix: Pin all actions to commit hashes
- - uses: actions/checkout@v4
+ - uses: actions/checkout@44c85305e41dfe471331e387f004d221add66d31 # v4.1.1
- - uses: ossf/scorecard-action@v2.4.0
+ - uses: ossf/scorecard-action@dc50aa9510b46c811795eb24b2f1ba02a914a587 # v2.4.0
- uses: github/codeql-action/upload-sarif@v3
+ uses: github/codeql-action/upload-sarif@cdcdbbfb34304309f8c18fe68d3a021711ae8f642 # v3.1.1(Verify commit hashes at each action's GitHub releases page)
Also applies to: 26-26, 33-33
🧰 Tools
🪛 zizmor (1.25.2)
[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/scorecard.yml at line 22, Replace the version tags in the
GitHub Actions references with specific commit hashes to follow security best
practices. For the actions/checkout action (currently using `@v4`),
ossf/scorecard-action (currently using `@v2.4.0`), and
github/codeql-action/upload-sarif (currently using `@v3`), update each uses
statement to pin to a specific commit hash instead of the version tag. Verify
the correct commit hashes by checking each action's releases page on GitHub and
update all three action references accordingly.
Source: Linters/SAST tools
| import type { Database } from "sql.js" | ||
| import { spreadSubscription } from "./display" | ||
| import type { SharedArgs } from "./types.ts" | ||
| import { spreadSubscription } from "../display" |
There was a problem hiding this comment.
Use .ts extension for this local static import.
import { spreadSubscription } from "../display" violates the repo rule requiring explicit .ts for local imports.
As per coding guidelines, subtrack/**/*.{ts,tsx}: “Import local files with .ts extension (e.g., import { x } from "./foo.ts")".
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@subtrack/src/__tests__/display.test.ts` at line 5, The import statement for
spreadSubscription is missing the required .ts file extension. Update the import
statement by adding the .ts extension to the import path from "../display" to
"../display.ts" to comply with the repo's coding guidelines that require
explicit .ts extensions for local imports.
Source: Coding guidelines
| @@ -1,5 +1,5 @@ | |||
| { | |||
| "exclude": ["src/**/*.test.ts"], | |||
| "exclude": ["src/__tests__"], | |||
There was a problem hiding this comment.
src/__tests__ exclusion codifies a test layout that conflicts with project test-location policy.
This change hardwires centralized tests under src/__tests__, which conflicts with the repository rule requiring co-located *.test.ts files beside source modules.
As per coding guidelines, subtrack/**/*.test.{ts,tsx}: “Co-locate test files as *.test.ts alongside source files”.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@subtrack/tsconfig.json` at line 2, The exclude array in tsconfig.json
currently hardcodes the exclusion of src/__tests__, which conflicts with the
repository's policy of co-locating test files as *.test.ts alongside source
modules. Remove the src/__tests__ exclusion and replace it with a pattern that
excludes co-located test files such as **/*.test.ts and **/*.test.tsx to align
with the project's coding guidelines.
Source: Coding guidelines
The onlyBuiltDependencies field in pnpm-workspace.yaml is not compatible with pnpm v11.5.1 when running pnpm install --frozen-lockfile because the lockfile was generated with the allowBuilds format and pnpm does not automatically reconcile the new format with existing lockfile entries. Change back to the allowBuilds format which correctly allows esbuild postinstall scripts to run, fixing the CI failure.
1 participant
変更内容
セキュリティ修正
0o600に修正（他ファイルと統一）allowBuildsからonlyBuiltDependenciesに移行サプライチェーンセキュリティ強化
pnpm auditを追加filesフィールド: 存在しないnpm-shrinkwrap.json参照を削除テスト再編成
src/__tests__/に集約。import pathをすべて../に修正tsconfig.jsonの exclude パターンを更新検証
pnpm install --frozen-lockfile正常Summary by CodeRabbit
Security
Documentation
Chores