🏗️ Composite#127
Merged
Merged
Conversation
Signed-off-by: Nathan Gendron <nato@coderabbit.ai>
Signed-off-by: Nathan Gendron <nato@coderabbit.ai>
NatoBoram
requested review from
nehal-a2z and
tejascoderabbit
and removed request for
a team
June 16, 2026 05:04
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Central YAML (base), Repository UI (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe publish workflow is restructured from a single job into separate artifact-passing jobs for building, publishing to npm and GitHub Packages with OIDC provenance, and creating a GitHub release. TypeScript project references are introduced for ChangesCI/CD Publish Pipeline Restructuring
TypeScript Project References, Type Changes, and Tooling Upgrades
Sequence Diagram(s)sequenceDiagram
participant build as build job
participant artifact as GitHub Artifact Store
participant publish_npm as publish-npm job
participant publish_github as publish-github job
participant release as release job
participant npmjs as registry.npmjs.org
participant ghpkg as npm.pkg.github.com
participant ghrelease as GitHub Releases
build->>artifact: upload coderabbitai-bitbucket-*.tgz
publish_npm->>artifact: download tgz
publish_npm->>npmjs: pnpm publish --provenance (`@coderabbitai` scope)
publish_github->>artifact: download tgz
publish_github->>ghpkg: pnpm publish --provenance (`@coderabbitai` scope)
publish_github->>ghpkg: gh api → package version URL
release->>artifact: download tgz
release->>ghrelease: gh release create --generate-notes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested labels
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (2 warnings, 1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
[dependabot skip]
Signed-off-by: Nathan Gendron <nato@coderabbit.ai>
Signed-off-by: Nathan Gendron <nato@coderabbit.ai>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
.github/workflows/pnpm-publish.yaml (1)
16-18: ⚖️ Poor tradeoffConsider pinning actions to SHA hashes for supply chain security.
Static analysis flags all action references as unpinned. Pinning to commit SHAs prevents tag-hijacking attacks where a malicious actor moves a version tag to a compromised commit. For example:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2This is a security-versus-maintainability tradeoff. If your organization's policy requires pinned actions, consider using a tool like Dependabot or Renovate to automate SHA updates.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pnpm-publish.yaml around lines 16 - 18, The actions/checkout action reference in the workflow file is pinned to a version tag (v6) rather than a specific commit SHA, which creates a security vulnerability to tag-hijacking attacks. Update the uses field for actions/checkout to pin it to a specific commit SHA hash instead of the version tag, and include the version number as a trailing comment for maintainability. This ensures the workflow runs against a specific, immutable commit rather than a mutable tag that could potentially be moved to a malicious commit.Source: Linters/SAST tools
package.json (1)
34-35: Extendcleanscript to include referenced-project build artifacts.With the composite TypeScript build configuration, the
tsgo --buildcommand creates.tsbuildinfofiles for both the root project and referenced subprojects (src/cloudandsrc/server). The currentcleanscript only removes the roottsconfig.tsbuildinfo, leaving stale incremental build artifacts that can cause inconsistent builds during development.Suggested diff
- "clean": "rm -rf dist docs node_modules tsconfig.tsbuildinfo", + "clean": "rm -rf dist docs node_modules tsconfig.tsbuildinfo src/cloud/tsconfig.tsbuildinfo src/server/tsconfig.tsbuildinfo",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` around lines 34 - 35, The clean script in package.json currently only removes the root tsconfig.tsbuildinfo file, but with the composite TypeScript build configuration, .tsbuildinfo files are also created in the referenced subproject directories (src/cloud and src/server). Extend the clean script to additionally remove the .tsbuildinfo files from these subdirectories so that all incremental build artifacts are properly cleaned and stale builds don't interfere with development.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pnpm-publish.yaml:
- Line 63: The pnpm publish step at line 63 is missing the NODE_AUTH_TOKEN
environment variable that the setup-node action requires for npm authentication.
Add an env section to the run step that publishes the tarball file (the command
`pnpm publish coderabbitai-bitbucket-*.tgz --access public --no-git-checks
--provenance`) and set NODE_AUTH_TOKEN to reference the appropriate npm token
secret for your repository. Follow the same pattern used in the publish-github
job at line 98, replacing NPM_TOKEN with the actual secret name your repository
uses (such as CODERABBIT_NPM_TOKEN).
In `@src/base64.ts`:
- Around line 1-4: The fromBase64 function's return type annotation declares
Uint8Array | string but the implementation always returns a string via
TextDecoder().decode(bytes), so the Uint8Array type in the union is unreachable.
Narrow the return type annotation of the fromBase64 function to just string to
accurately reflect what the function actually returns.
In `@src/server/openapi/openapi-typescript.ts`:
- Around line 17176-17180: The generated JSDoc block descriptions have collapsed
whitespace between list items, making them unreadable. The post-processing step
in the OpenAPI TypeScript code generator needs to be fixed to preserve proper
line breaks and spacing within JSDoc description blocks. In
src/server/openapi/openapi-typescript.ts at lines 17176-17180 and the
consolidated sites at lines 23198-23204, 23297-23297, 23379-23382, 27579-27583,
and 37598-37602, the bullet points and list items have been merged together. Fix
the generator or post-processor that creates these JSDoc blocks to ensure it
properly formats multi-line descriptions by preserving newlines and indentation
between list items so that each bullet point or sentence remains on its own line
with appropriate spacing.
---
Nitpick comments:
In @.github/workflows/pnpm-publish.yaml:
- Around line 16-18: The actions/checkout action reference in the workflow file
is pinned to a version tag (v6) rather than a specific commit SHA, which creates
a security vulnerability to tag-hijacking attacks. Update the uses field for
actions/checkout to pin it to a specific commit SHA hash instead of the version
tag, and include the version number as a trailing comment for maintainability.
This ensures the workflow runs against a specific, immutable commit rather than
a mutable tag that could potentially be moved to a malicious commit.
In `@package.json`:
- Around line 34-35: The clean script in package.json currently only removes the
root tsconfig.tsbuildinfo file, but with the composite TypeScript build
configuration, .tsbuildinfo files are also created in the referenced subproject
directories (src/cloud and src/server). Extend the clean script to additionally
remove the .tsbuildinfo files from these subdirectories so that all incremental
build artifacts are properly cleaned and stale builds don't interfere with
development.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Central YAML (base), Repository UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 98118017-a99a-4315-9b00-6ddad6ddd22a
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (12)
.github/workflows/pnpm-publish.yamlpackage.jsonpnpm-workspace.yamlsrc/base64.tssrc/cloud/openapi/openapi-typescript.tssrc/cloud/openapi/swagger.v3.jsonsrc/cloud/tsconfig.jsonsrc/server/openapi/openapi-typescript.tssrc/server/tsconfig.jsonsrc/types/undici-types.d.tstests/server/projects.test.tstsconfig.json
💤 Files with no reviewable changes (1)
- src/types/undici-types.d.ts
Signed-off-by: Nathan Gendron <nato@coderabbit.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Update dependencies and migrate to a TypeScript Composite project.
Summary by CodeRabbit
Release Notes
Documentation
Tests
New Features
Chores