test: WORKFLOW TEST: DO NOT MERGE (Delete after ENG-2146) Dashboard code only change #4197
test: WORKFLOW TEST: DO NOT MERGE (Delete after ENG-2146) Dashboard code only change #4197
Conversation
mcstepp
requested review from
Flo4604,
MichaelUnkey,
chronark,
ogzhanolguncu and
perkinsjr
as code owners
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
|
📝 WalkthroughWalkthroughRefines detect_changes globs (dashboard and Go paths), adjusts job condition grouping in the PR workflow, and adds a new Test Dashboard workflow invoked when detect_changes reports dashboard changes. Changes
Sequence Diagram(s)sequenceDiagram
participant PR as Pull Request
participant Detect as detect_changes job
participant PRwf as pr.yaml jobs
participant DashboardWF as Test Dashboard (workflow_call)
PR->>Detect: push PR triggers change detection
Detect-->>PRwf: outputs (api, packages, dashboard, ...)
alt dashboard == true
PRwf->>DashboardWF: invoke test_dashboard (needs.detect_changes)
DashboardWF->>DashboardWF: checkout -> setup-node -> test -> build
DashboardWF-->>PRwf: result (success/failure)
end
alt api/packages == true
PRwf->>PRwf: run build/test_api jobs (conditioned on grouped logic)
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes
Possibly related PRs
Pre-merge checks and finishing touches❌ Failed checks (2 warnings)
✅ Passed checks (1 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🧰 Additional context used🧠 Learnings (2)📓 Common learnings📚 Learning: 2025-08-08T19:52:42.113ZApplied to files:
🪛 actionlint (1.7.8).github/workflows/job_test_dashboard.yaml9-9: label "depot-ubuntu-24.04-4" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file (runner-label) ⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
🔇 Additional comments (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Thank you for following the naming conventions for pull request titles! 🙏 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/job_dashboard_checks.yaml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.8)
.github/workflows/job_dashboard_checks.yaml
9-9: label "depot-ubuntu-24.04-4" is unknown. available labels are "windows-latest", "windows-latest-8-cores", "windows-2025", "windows-2022", "windows-11-arm", "ubuntu-latest", "ubuntu-latest-4-cores", "ubuntu-latest-8-cores", "ubuntu-latest-16-cores", "ubuntu-24.04", "ubuntu-24.04-arm", "ubuntu-22.04", "ubuntu-22.04-arm", "macos-latest", "macos-latest-xl", "macos-latest-xlarge", "macos-latest-large", "macos-26-xlarge", "macos-26", "macos-15-intel", "macos-15-xlarge", "macos-15-large", "macos-15", "macos-14-xl", "macos-14-xlarge", "macos-14-large", "macos-14", "macos-13-xl", "macos-13-xlarge", "macos-13-large", "macos-13", "self-hosted", "x64", "arm", "arm64", "linux", "macos", "windows". if it is a custom label for self-hosted runner, set list of labels in actionlint.yaml config file
(runner-label)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Dashboard Checks / Dashboard Checks
- GitHub Check: autofix
🔇 Additional comments (2)
.github/workflows/job_dashboard_checks.yaml (2)
1-19: Workflow structure and permissions are sound.The workflow follows good practices:
- Minimal read-only permissions (line 5).
- Pinned action versions (line 11) for reproducibility.
- Proper use of workflow_call trigger for reusability.
- Filtered build to dashboard package only, reducing build time.
- Custom setup-node action for consistent Node environment.
9-9: ****The
depot-ubuntu-24.04-4runner label is not misconfigured. This label is used consistently across 24 workflows in the repository, including critical production workflows (release.yaml, deploy.yaml, job_deploy_api_production.yaml), indicating it's a properly configured, repository-wide standard—likely Depot.dev's third-party runner service. The actionlint flagging is a false positive; this runner is actively operational.Likely an incorrect or invalid review comment.
| env: | ||
| CI: 1 | ||
| DATABASE_HOST: localhost:8080 | ||
| DATABASE_USERNAME: unkey | ||
| DATABASE_PASSWORD: password | ||
| DATABASE_NAME: unkey | ||
| UNKEY_WORKSPACE_ID: "not-empty" | ||
| UNKEY_API_ID: "not-empty" | ||
| UNKEY_WEBHOOK_KEYS_API_ID: "not-empty" | ||
| AGENT_URL: "http://localhost:8080" | ||
| AGENT_TOKEN: "not-empty" | ||
| AUTH_PROVIDER: "workos" | ||
| WORKOS_CLIENT_ID: "client_" | ||
| WORKOS_API_KEY: "sk_test_" | ||
| WORKOS_COOKIE_PASSWORD: "IAMACOOKIEPASSWORD" | ||
| NEXT_PUBLIC_WORKOS_REDIRECT_URI: "http://localhost:3000/auth/sso-callback" |
There was a problem hiding this comment.
Document or externalize hardcoded credentials.
The workflow contains hardcoded test/placeholder credentials (e.g., WORKOS_CLIENT_ID: "client_", WORKOS_API_KEY: "sk_test_", AGENT_TOKEN: "not-empty"). While these appear to be safe test values, they should be:
- Clearly documented as test/placeholder values in a comment if intentional.
- Moved to GitHub Secrets if they need to be sensitive or change frequently.
- Verified to not contain any actual credentials or PII.
Apply this diff to add clarifying documentation and consider externalizing sensitive values:
- name: Build
run: pnpm turbo run build --filter=@unkey/dashboard
env:
+ # Test/placeholder configuration for dashboard build in CI
CI: 1
DATABASE_HOST: localhost:8080
DATABASE_USERNAME: unkey
DATABASE_PASSWORD: password
DATABASE_NAME: unkey
UNKEY_WORKSPACE_ID: "not-empty"
UNKEY_API_ID: "not-empty"
UNKEY_WEBHOOK_KEYS_API_ID: "not-empty"
AGENT_URL: "http://localhost:8080"
AGENT_TOKEN: "not-empty"
AUTH_PROVIDER: "workos"
WORKOS_CLIENT_ID: "client_"
WORKOS_API_KEY: "sk_test_"
WORKOS_COOKIE_PASSWORD: "IAMACOOKIEPASSWORD"
NEXT_PUBLIC_WORKOS_REDIRECT_URI: "http://localhost:3000/auth/sso-callback"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| env: | |
| CI: 1 | |
| DATABASE_HOST: localhost:8080 | |
| DATABASE_USERNAME: unkey | |
| DATABASE_PASSWORD: password | |
| DATABASE_NAME: unkey | |
| UNKEY_WORKSPACE_ID: "not-empty" | |
| UNKEY_API_ID: "not-empty" | |
| UNKEY_WEBHOOK_KEYS_API_ID: "not-empty" | |
| AGENT_URL: "http://localhost:8080" | |
| AGENT_TOKEN: "not-empty" | |
| AUTH_PROVIDER: "workos" | |
| WORKOS_CLIENT_ID: "client_" | |
| WORKOS_API_KEY: "sk_test_" | |
| WORKOS_COOKIE_PASSWORD: "IAMACOOKIEPASSWORD" | |
| NEXT_PUBLIC_WORKOS_REDIRECT_URI: "http://localhost:3000/auth/sso-callback" | |
| env: | |
| # Test/placeholder configuration for dashboard build in CI | |
| CI: 1 | |
| DATABASE_HOST: localhost:8080 | |
| DATABASE_USERNAME: unkey | |
| DATABASE_PASSWORD: password | |
| DATABASE_NAME: unkey | |
| UNKEY_WORKSPACE_ID: "not-empty" | |
| UNKEY_API_ID: "not-empty" | |
| UNKEY_WEBHOOK_KEYS_API_ID: "not-empty" | |
| AGENT_URL: "http://localhost:8080" | |
| AGENT_TOKEN: "not-empty" | |
| AUTH_PROVIDER: "workos" | |
| WORKOS_CLIENT_ID: "client_" | |
| WORKOS_API_KEY: "sk_test_" | |
| WORKOS_COOKIE_PASSWORD: "IAMACOOKIEPASSWORD" | |
| NEXT_PUBLIC_WORKOS_REDIRECT_URI: "http://localhost:3000/auth/sso-callback" |
🤖 Prompt for AI Agents
.github/workflows/job_dashboard_checks.yaml lines 20-35: the workflow currently
defines hardcoded placeholder credentials (WORKOS_CLIENT_ID, WORKOS_API_KEY,
AGENT_TOKEN, etc.); update the file by (1) adding an inline comment above these
env vars noting they are test/placeholder values only, (2) replace any values
that should be treated as secrets with references to GitHub Secrets (e.g., use
the actions secrets context for WORKOS_API_KEY, AGENT_TOKEN, DATABASE_PASSWORD,
etc.), and (3) add a checklist comment to verify none of the values contain real
credentials or PII before merging; ensure you do not commit any actual secret
values when switching to secrets.
1 participant
What does this PR do?
Fixes # (issue)
If there is not an issue for this, please create one first. This is used to tracking purposes and also helps use understand why this PR exists
Type of change
How should this be tested?
Checklist
Required
pnpm buildpnpm fmtconsole.logsgit pull origin mainAppreciated