chore: standardize repository tooling#659
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
More reviews will be available in 2 minutes and 54 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
Walkthrough更新了 README 与资助入口，调整了 TypeScript/格式化脚本和编译范围，新增或修改了多个 GitHub Actions 工作流，并扩展了 Cloudflare、Surge 和 Vercel 的预览/部署配置。 Changes仓库文档、工具链与自动化
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #659 +/- ##
=======================================
Coverage 99.84% 99.84%
=======================================
Files 17 17
Lines 633 633
Branches 196 188 -8
=======================================
Hits 632 632
Misses 1 1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request comprehensively updates the README.md with installation, usage, and API documentation. It also updates package.json by simplifying the Prettier script, adding a new tsc script for type-checking, adding TypeScript ESLint dependencies, and downgrading eslint-plugin-jest. Additionally, tsconfig.json is updated to include specific configuration files. The feedback suggests documenting the new tsc script in the README's development section.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| npm install | ||
| npm start | ||
| npm test | ||
| npm run lint | ||
| npm run compile |
There was a problem hiding this comment.
Since a new tsc script has been added to package.json to perform type-checking, it should be documented in the Development section of the README.md so that contributors are aware of it and can run it locally.
| npm install | |
| npm start | |
| npm test | |
| npm run lint | |
| npm run compile | |
| npm install | |
| npm start | |
| npm test | |
| npm run tsc | |
| npm run lint | |
| npm run compile |
afc163
force-pushed
the
codex/standardize-rc-config
branch
from
a663729 to
0edc4f9
Compare
❌ Deploy failed
📋 Build log (last lines)🤖 Powered by surge-preview |
|||||||||
afc163
force-pushed
the
codex/standardize-rc-config
branch
from
0edc4f9 to
8650838
Compare
afc163
force-pushed
the
codex/standardize-rc-config
branch
from
8650838 to
9b43b63
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/cloudflare-pages-preview.yml:
- Around line 13-17: The Cloudflare deployment secrets are currently set at the
job level, so every step including npm install and build inherits them. Move
CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID out of the job-wide env in this
workflow and pass them only to the final Deploy preview step, while keeping
non-sensitive values like CLOUDFLARE_PAGES_PROJECT and PREVIEW where
appropriate. Update the affected workflow job and the Deploy preview step so the
secrets are only available at deployment time.
In @.github/workflows/react-component-ci.yml:
- Line 5: The reusable workflow reference in the CI workflow is using a mutable
branch, which should be pinned to an immutable commit SHA. Update the workflow
call in the rc-test reusable workflow reference to use a full commit hash
instead of the current branch reference, so the executed workflow content is
locked to a reviewed version.
- Around line 5-6: The workflow call is inheriting all repository secrets and
leaving the token scope too broad. Update the reusable workflow invocation in
react-component-ci to pass only the specific needed secrets instead of using
secrets: inherit, and add an explicit permissions block on the caller with the
minimum required GITHUB_TOKEN access. Use the existing workflow call to
react-component/rc-test/.github/workflows/test-utoo.yml as the place to tighten
both secrets and permissions.
In @.github/workflows/surge-preview.yml:
- Around line 20-30: The Surge preview step currently runs build commands
through afc163/surge-preview while injecting SURGE_TOKEN, which can expose the
token during build execution. Move the npm install and npm run build logic out
of the surge-preview action so it runs in a separate step before the action, and
then invoke afc163/surge-preview without a build block while keeping surge_token
only for the deployment step.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a018738f-d909-4902-89d3-9dc6e3b9e9e0
📒 Files selected for processing (10)
.github/FUNDING.yml.github/workflows/cloudflare-pages-preview.yml.github/workflows/codeql.yml.github/workflows/react-component-ci.yml.github/workflows/react-doctor.yml.github/workflows/surge-preview.ymlREADME.mdpackage.jsontsconfig.jsonvercel.json
| jobs: | ||
| test: | ||
| uses: react-component/rc-test/.github/workflows/test.yml@main | ||
| uses: react-component/rc-test/.github/workflows/test-utoo.yml@main |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
把复用工作流固定到提交 SHA。
@main 会直接信任外部仓库的最新分支内容；一旦上游分支被改写或被入侵，这里的 CI 就会在未审查的代码上运行。改成完整 commit SHA 才能把执行内容锁住。
🧰 Tools
🪛 GitHub Check: CodeQL
[warning] 5-6: Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{}}
🪛 zizmor (1.26.1)
[error] 5-5: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 5-5: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/react-component-ci.yml at line 5, The reusable workflow
reference in the CI workflow is using a mutable branch, which should be pinned
to an immutable commit SHA. Update the workflow call in the rc-test reusable
workflow reference to use a full commit hash instead of the current branch
reference, so the executed workflow content is locked to a reviewed version.
Source: Linters/SAST tools
| uses: react-component/rc-test/.github/workflows/test-utoo.yml@main | ||
| secrets: inherit |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
不要对外部工作流无条件继承全部 secrets。
secrets: inherit 会把当前仓库的所有可用 secret 交给 react-component/rc-test，而这个工作流当前也没有显式 permissions 去收紧 GITHUB_TOKEN。至少改成按需逐个传递 secret，并在调用方声明最小权限。
🧰 Tools
🪛 GitHub Check: CodeQL
[warning] 5-6: Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{}}
🪛 zizmor (1.26.1)
[error] 5-5: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 5-5: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/react-component-ci.yml around lines 5 - 6, The workflow
call is inheriting all repository secrets and leaving the token scope too broad.
Update the reusable workflow invocation in react-component-ci to pass only the
specific needed secrets instead of using secrets: inherit, and add an explicit
permissions block on the caller with the minimum required GITHUB_TOKEN access.
Use the existing workflow call to
react-component/rc-test/.github/workflows/test-utoo.yml as the place to tighten
both secrets and permissions.
Source: Linters/SAST tools
| - uses: afc163/surge-preview@bf90a5a86111f6311ca42f0a5a0f80fb0fb03cec | ||
| if: ${{ env.SURGE_TOKEN != '' }} | ||
| with: | ||
| surge_token: ${{ env.SURGE_TOKEN }} | ||
| github_token: ${{ secrets.GITHUB_TOKEN }} | ||
| dist: dist | ||
| failOnError: true | ||
| setCommitStatus: true | ||
| build: | | ||
| npm install | ||
| npm run build |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
构建脚本存在泄露 SURGE_TOKEN 的安全风险
该 action (afc163/surge-preview) 会将 surge_token 设置为执行 build 命令时的环境变量。如果 build 脚本（如本例中的 npm install 和 npm run build）由外部 PR 控制，恶意代码可以在构建阶段读取该环境变量并泄露部署令牌。
建议将构建逻辑移至 action 之前独立执行，确保构建步骤运行时无敏感令牌注入。
# 修改前
- uses: afc163/surge-preview@...
with:
surge_token: ${{ env.SURGE_TOKEN }}
build: |
npm install
npm run build
# 修改后
- run: npm install && npm run build
- uses: afc163/surge-preview@...
with:
surge_token: ${{ env.SURGE_TOKEN }}
# 移除 build 参数或留空🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/surge-preview.yml around lines 20 - 30, The Surge preview
step currently runs build commands through afc163/surge-preview while injecting
SURGE_TOKEN, which can expose the token during build execution. Move the npm
install and npm run build logic out of the surge-preview action so it runs in a
separate step before the action, and then invoke afc163/surge-preview without a
build block while keeping surge_token only for the deployment step.
|
Deployment failed with the following error: Learn More: https://vercel.com/react-component?upgradeToPro=build-rate-limit |
1 participant
Summary
@rc-component/tree-selectheader, package-specific emoji description, focused highlights, install, usage, examples, API, development, and release sections.npm install @rc-component/tree-selectcommand, and add a subtle Ant Design ecosystem note.tsccheck and broadening the Prettier command.@umijs/fabricconfig so lint and compile remain runnable.test-utoo.yml.master..github/FUNDING.ymlwith Ant Design sponsorship entries.tsccommand.Compatibility
No runtime code changes. This should not introduce breaking changes.
Verification
npm run lintnpm testnpm run tscnpm run compilenpm run buildgit diff --checkSummary by CodeRabbit
新功能
文档
维护
Refs ant-design/ant-design#58514