ci: split pr quality gates for mobile and desktop #268

2026-06-11T17:49:19Z

talksik commented

2026-06-11 17:49:19 +00:00

(Migrated from github.com)

Summary by CodeRabbit

Chores
- Reorganized CI/CD quality gate workflows to independently verify desktop and mobile app changes for streamlined continuous integration processes.

## Summary by CodeRabbit * **Chores** * Reorganized CI/CD quality gate workflows to independently verify desktop and mobile app changes for streamlined continuous integration processes.

coderabbitai[bot] commented

2026-06-11 17:50:22 +00:00

(Migrated from github.com)

📝 Walkthrough

Walkthrough

The PR separates the PR quality gate workflows by platform: the desktop workflow is narrowed to desktop-only changes, and a new mobile-specific workflow is created to enforce the same lint and format checks for mobile code independently.

Changes

Platform-specific CI workflows

Layer / File(s)	Summary
Separate desktop and mobile quality gate workflows `.github/workflows/pr-quality-gate-desktop.yml`, `.github/workflows/pr-quality-gate-mobile.yml`	Desktop workflow refactored to trigger only on `js/desktop/` changes with a single `verify` job; new mobile workflow created to independently enforce `yarn lint` and `yarn format:check` on `js/mobile/` changes, both using Node.js 20 with immutable dependency installation.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐰 Workflows split clean, like a path through the wood,
Desktop and mobile, each does its own good,
Quality gates stand guard on their respective ways,
Lint and format checks through all of our days! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci: split pr quality gates for mobile and desktop' accurately and concisely describes the main change in the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix-pr-quality-gates

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/flowy-live/llink/pull/268?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)   <details> <summary>📝 Walkthrough</summary> ## Walkthrough The PR separates the PR quality gate workflows by platform: the desktop workflow is narrowed to desktop-only changes, and a new mobile-specific workflow is created to enforce the same lint and format checks for mobile code independently. ## Changes **Platform-specific CI workflows** |Layer / File(s)|Summary| |---|---| |**Separate desktop and mobile quality gate workflows** `.github/workflows/pr-quality-gate-desktop.yml`, `.github/workflows/pr-quality-gate-mobile.yml`|Desktop workflow refactored to trigger only on `js/desktop/**` changes with a single `verify` job; new mobile workflow created to independently enforce `yarn lint` and `yarn format:check` on `js/mobile/**` changes, both using Node.js 20 with immutable dependency installation.| ## Estimated code review effort 🎯 2 (Simple) | ⏱️ ~8 minutes ## Poem > 🐰 Workflows split clean, like a path through the wood, > Desktop and mobile, each does its own good, > Quality gates stand guard on their respective ways, > Lint and format checks through all of our days! ✨ </details>   <details> <summary>🚥 Pre-merge checks | ✅ 5</summary> <details> <summary>✅ Passed checks (5 passed)</summary> | Check name | Status | Explanation | | :------------------------: | :------- | :--------------------------------------------------------------------------------------------------------------------------------- | | Description Check | ✅ Passed | Check skipped - CodeRabbit’s high-level summary is enabled. | | Title check | ✅ Passed | The title 'ci: split pr quality gates for mobile and desktop' accurately and concisely describes the main change in the changeset. | | Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. | | Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. | | Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. | </details> ✏️ Tip: You can configure your own custom pre-merge checks in the settings. </details>   <details> <summary>✨ Finishing Touches</summary> <details> <summary>🧪 Generate unit tests (beta)</summary> - [ ]  Create PR with unit tests - [ ]  Commit unit tests in branch `fix-pr-quality-gates` </details> </details>   --- Comment `@coderabbitai help` to get the list of available commands and usage tips.

coderabbitai[bot] (Migrated from github.com) reviewed 2026-06-11 17:56:15 +00:00

coderabbitai[bot] (Migrated from github.com) left a comment

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/pr-quality-gate-mobile.yml:
- Around line 19-25: Replace mutable action tags actions/checkout@v4 and
actions/setup-node@v4 with pinned commit SHAs and set persist-credentials: false
on the checkout step to reduce supply-chain and token exposure risk; update the
checkout step (actions/checkout) to include persist-credentials: false and
replace both uses entries (actions/checkout and actions/setup-node) with their
specific commit SHAs (use the official SHAs for the versions currently
referenced) so the workflow references immutable commits.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c764ac6d-9a10-4f74-8aa6-42ef51a52823

📥 Commits

Reviewing files that changed from the base of the PR and between 95f2362947 and 05ce208a8a.

📒 Files selected for processing (2)

.github/workflows/pr-quality-gate-desktop.yml
.github/workflows/pr-quality-gate-mobile.yml

**Actionable comments posted: 1** <details> <summary>🤖 Prompt for all review comments with AI agents</summary> ``` Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. Inline comments: In @.github/workflows/pr-quality-gate-mobile.yml: - Around line 19-25: Replace mutable action tags actions/checkout@v4 and actions/setup-node@v4 with pinned commit SHAs and set persist-credentials: false on the checkout step to reduce supply-chain and token exposure risk; update the checkout step (actions/checkout) to include persist-credentials: false and replace both uses entries (actions/checkout and actions/setup-node) with their specific commit SHAs (use the official SHAs for the versions currently referenced) so the workflow references immutable commits. ``` </details> <details> <summary>🪄 Autofix (Beta)</summary> Fix all unresolved CodeRabbit comments on this PR: - [ ]  Push a commit to this branch (recommended) - [ ]  Create a new PR with the fixes </details> --- <details> <summary>ℹ️ Review info</summary> <details> <summary>⚙️ Run configuration</summary> **Configuration used**: defaults **Review profile**: CHILL **Plan**: Pro Plus **Run ID**: `c764ac6d-9a10-4f74-8aa6-42ef51a52823` </details> <details> <summary>📥 Commits</summary> Reviewing files that changed from the base of the PR and between 95f2362947076cea50ee50ef615e654ef1e0d45c and 05ce208a8a0435d7d4af9dda8cc0ca6872e0392c. </details> <details> <summary>📒 Files selected for processing (2)</summary> * `.github/workflows/pr-quality-gate-desktop.yml` * `.github/workflows/pr-quality-gate-mobile.yml` </details> </details>

.github/workflows/pr-quality-gate-mobile.yml

						
				@@ -0,0 +22,4 @@

				      - name: Set up Node.js

				        uses: actions/setup-node@v4

				        with:

				          node-version: '20'

coderabbitai[bot] (Migrated from github.com) commented

2026-06-11 17:56:15 +00:00

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/pr-quality-gate-mobile.yml"

# Show file with line numbers around the referenced area
nl -ba "$FILE" | sed -n '1,120p'

# Also scan for other uses of actions/checkout and actions/setup-node in the repo for consistency
rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true

Repository: flowy-live/llink

Length of output: 103

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/pr-quality-gate-mobile.yml"
if [ ! -f "$FILE" ]; then
  echo "Missing file: $FILE"
  exit 1
fi

nl -ba "$FILE" | sed -n '1,160p'

echo "---- other workflows using checkout/setup-node ----"
rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true

echo "---- check for persist-credentials usage ----"
rg -n "persist-credentials" .github/workflows || true

Repository: flowy-live/llink

Length of output: 104

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/pr-quality-gate-mobile.yml"
nl -ba "$FILE" | sed -n '1,200p'

echo "---- other workflows using checkout/setup-node ----"
rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true

echo "---- check for persist-credentials usage ----"
rg -n "persist-credentials" .github/workflows || true

Repository: flowy-live/llink

Length of output: 103

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/pr-quality-gate-mobile.yml"

echo "=== pr-quality-gate-mobile.yml (lines 1-200) ==="
if [ -f "$FILE" ]; then
  cat -n "$FILE" | sed -n '1,200p'
else
  echo "Missing $FILE"
  exit 1
fi

echo "=== other workflows using checkout/setup-node (pinned or tag refs) ==="
rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true

echo "=== persist-credentials occurrences ==="
rg -n "persist-credentials" .github/workflows || true

Repository: flowy-live/llink

Length of output: 1941

Pin actions to commit SHAs and disable persisted checkout credentials in CI

.github/workflows/pr-quality-gate-mobile.yml uses mutable tag refs (actions/checkout@v4 at line 20, actions/setup-node@v4 at line 23) and the checkout step does not set persist-credentials: false, increasing supply-chain and token exposure risk.

Suggested hardening diff

       - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@<FULL_COMMIT_SHA>
+        with:
+          persist-credentials: false

       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@<FULL_COMMIT_SHA>
         with:
           node-version: '20'

🧰 Tools

🪛 zizmor (1.25.2)

[warning] 19-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-quality-gate-mobile.yml around lines 19 - 25, Replace
mutable action tags actions/checkout@v4 and actions/setup-node@v4 with pinned
commit SHAs and set persist-credentials: false on the checkout step to reduce
supply-chain and token exposure risk; update the checkout step
(actions/checkout) to include persist-credentials: false and replace both uses
entries (actions/checkout and actions/setup-node) with their specific commit
SHAs (use the official SHAs for the versions currently referenced) so the
workflow references immutable commits.

Source: Linters/SAST tools

_⚠️ Potential issue_ | _🟠 Major_ <details> <summary>🧩 Analysis chain</summary> 🏁 Script executed: ```shell #!/bin/bash set -euo pipefail FILE=".github/workflows/pr-quality-gate-mobile.yml" # Show file with line numbers around the referenced area nl -ba "$FILE" | sed -n '1,120p' # Also scan for other uses of actions/checkout and actions/setup-node in the repo for consistency rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true ``` Repository: flowy-live/llink Length of output: 103 --- 🏁 Script executed: ```shell #!/bin/bash set -euo pipefail FILE=".github/workflows/pr-quality-gate-mobile.yml" if [ ! -f "$FILE" ]; then echo "Missing file: $FILE" exit 1 fi nl -ba "$FILE" | sed -n '1,160p' echo "---- other workflows using checkout/setup-node ----" rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true echo "---- check for persist-credentials usage ----" rg -n "persist-credentials" .github/workflows || true ``` Repository: flowy-live/llink Length of output: 104 --- 🏁 Script executed: ```shell #!/bin/bash set -euo pipefail FILE=".github/workflows/pr-quality-gate-mobile.yml" nl -ba "$FILE" | sed -n '1,200p' echo "---- other workflows using checkout/setup-node ----" rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true echo "---- check for persist-credentials usage ----" rg -n "persist-credentials" .github/workflows || true ``` Repository: flowy-live/llink Length of output: 103 --- 🏁 Script executed: ```shell #!/bin/bash set -euo pipefail FILE=".github/workflows/pr-quality-gate-mobile.yml" echo "=== pr-quality-gate-mobile.yml (lines 1-200) ===" if [ -f "$FILE" ]; then cat -n "$FILE" | sed -n '1,200p' else echo "Missing $FILE" exit 1 fi echo "=== other workflows using checkout/setup-node (pinned or tag refs) ===" rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true echo "=== persist-credentials occurrences ===" rg -n "persist-credentials" .github/workflows || true ``` Repository: flowy-live/llink Length of output: 1941 --- </details> **Pin actions to commit SHAs and disable persisted checkout credentials in CI** `.github/workflows/pr-quality-gate-mobile.yml` uses mutable tag refs (`actions/checkout@v4` at line 20, `actions/setup-node@v4` at line 23) and the checkout step does not set `persist-credentials: false`, increasing supply-chain and token exposure risk. <details> <summary>Suggested hardening diff</summary> ```diff - name: Check out repository code - uses: actions/checkout@v4 + uses: actions/checkout@<FULL_COMMIT_SHA> + with: + persist-credentials: false - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@<FULL_COMMIT_SHA> with: node-version: '20' ``` </details> <details> <summary>🧰 Tools</summary> <details> <summary>🪛 zizmor (1.25.2)</summary> [warning] 19-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) --- [error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) --- [error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) </details> </details> <details> <summary>🤖 Prompt for AI Agents</summary> ``` Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-quality-gate-mobile.yml around lines 19 - 25, Replace mutable action tags actions/checkout@v4 and actions/setup-node@v4 with pinned commit SHAs and set persist-credentials: false on the checkout step to reduce supply-chain and token exposure risk; update the checkout step (actions/checkout) to include persist-credentials: false and replace both uses entries (actions/checkout and actions/setup-node) with their specific commit SHAs (use the official SHAs for the versions currently referenced) so the workflow references immutable commits. ``` </details>   _Source: Linters/SAST tools_

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: FlowyLabs/llink#268