FlowyLabs/llink
1
0
Fork 0
Code Issues 71 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

ci: split pr quality gates for mobile and desktop #268

Merged
talksik merged 1 commits from fix-pr-quality-gates into main 2026-06-11 17:57:04 +00:00
Conversation 2 Commits 1 Files Changed 2
+39 -31
2 changed files with 39 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/pr-quality-gate-js.yml → .github/workflows/pr-quality-gate-desktop.yml
+2 -31
View File
@@ -1,43 +1,14 @@
name: PR Quality Gate (client applications) name: PR Quality Gate (Desktop)
on: on:
pull_request: pull_request:
paths: paths:
- "js/mobile/**"
- "js/desktop/**" - "js/desktop/**"
branches: [ main ] branches: [ main ]
types: [ opened, synchronize, reopened ] types: [ opened, synchronize, reopened ]
jobs: jobs:
mobile: verify:
name: Lint & format check (mobile)
runs-on: ubuntu-latest
defaults:
run:
working-directory: js/mobile
steps:
- name: Check out repository code
uses: actions/checkout@v4
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
- name: Enable Corepack
run: corepack enable
- name: Install dependencies
run: yarn install --immutable
- name: Run Code Linter
run: yarn lint
- name: Run Format Check
run: yarn format:check
desktop:
name: Lint & format check (desktop) name: Lint & format check (desktop)
runs-on: ubuntu-latest runs-on: ubuntu-latest
defaults: defaults:
.github/workflows/pr-quality-gate-mobile.yml
+37
View File
@@ -0,0 +1,37 @@
name: PR Quality Gate (Mobile)
on:
pull_request:
paths:
- "js/mobile/**"
branches: [ main ]
types: [ opened, synchronize, reopened ]
jobs:
verify:
name: Lint & format check (mobile)
runs-on: ubuntu-latest
defaults:
run:
working-directory: js/mobile
steps:
- name: Check out repository code
uses: actions/checkout@v4
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
coderabbitai[bot] commented 2026-06-11 17:56:15 +00:00 (Migrated from github.com)
Review
Copy Link
Copy Source

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/pr-quality-gate-mobile.yml"

# Show file with line numbers around the referenced area
nl -ba "$FILE" | sed -n '1,120p'

# Also scan for other uses of actions/checkout and actions/setup-node in the repo for consistency
rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true

Repository: flowy-live/llink

Length of output: 103

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/pr-quality-gate-mobile.yml"
if [ ! -f "$FILE" ]; then
  echo "Missing file: $FILE"
  exit 1
fi

nl -ba "$FILE" | sed -n '1,160p'

echo "---- other workflows using checkout/setup-node ----"
rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true

echo "---- check for persist-credentials usage ----"
rg -n "persist-credentials" .github/workflows || true

Repository: flowy-live/llink

Length of output: 104

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/pr-quality-gate-mobile.yml"
nl -ba "$FILE" | sed -n '1,200p'

echo "---- other workflows using checkout/setup-node ----"
rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true

echo "---- check for persist-credentials usage ----"
rg -n "persist-credentials" .github/workflows || true

Repository: flowy-live/llink

Length of output: 103

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/pr-quality-gate-mobile.yml"

echo "=== pr-quality-gate-mobile.yml (lines 1-200) ==="
if [ -f "$FILE" ]; then
  cat -n "$FILE" | sed -n '1,200p'
else
  echo "Missing $FILE"
  exit 1
fi

echo "=== other workflows using checkout/setup-node (pinned or tag refs) ==="
rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true

echo "=== persist-credentials occurrences ==="
rg -n "persist-credentials" .github/workflows || true

Repository: flowy-live/llink

Length of output: 1941

Pin actions to commit SHAs and disable persisted checkout credentials in CI

.github/workflows/pr-quality-gate-mobile.yml uses mutable tag refs (actions/checkout@v4 at line 20, actions/setup-node@v4 at line 23) and the checkout step does not set persist-credentials: false, increasing supply-chain and token exposure risk.

Suggested hardening diff 
       - name: Check out repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@<FULL_COMMIT_SHA>
+        with:
+          persist-credentials: false

       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@<FULL_COMMIT_SHA>
         with:
           node-version: '20'
🧰 Tools
🪛 zizmor (1.25.2)

[warning] 19-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-quality-gate-mobile.yml around lines 19 - 25, Replace
mutable action tags actions/checkout@v4 and actions/setup-node@v4 with pinned
commit SHAs and set persist-credentials: false on the checkout step to reduce
supply-chain and token exposure risk; update the checkout step
(actions/checkout) to include persist-credentials: false and replace both uses
entries (actions/checkout and actions/setup-node) with their specific commit
SHAs (use the official SHAs for the versions currently referenced) so the
workflow references immutable commits.

Source: Linters/SAST tools

_⚠️ Potential issue_ | _🟠 Major_ <details> <summary>🧩 Analysis chain</summary> 🏁 Script executed: ```shell #!/bin/bash set -euo pipefail FILE=".github/workflows/pr-quality-gate-mobile.yml" # Show file with line numbers around the referenced area nl -ba "$FILE" | sed -n '1,120p' # Also scan for other uses of actions/checkout and actions/setup-node in the repo for consistency rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true ``` Repository: flowy-live/llink Length of output: 103 --- 🏁 Script executed: ```shell #!/bin/bash set -euo pipefail FILE=".github/workflows/pr-quality-gate-mobile.yml" if [ ! -f "$FILE" ]; then echo "Missing file: $FILE" exit 1 fi nl -ba "$FILE" | sed -n '1,160p' echo "---- other workflows using checkout/setup-node ----" rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true echo "---- check for persist-credentials usage ----" rg -n "persist-credentials" .github/workflows || true ``` Repository: flowy-live/llink Length of output: 104 --- 🏁 Script executed: ```shell #!/bin/bash set -euo pipefail FILE=".github/workflows/pr-quality-gate-mobile.yml" nl -ba "$FILE" | sed -n '1,200p' echo "---- other workflows using checkout/setup-node ----" rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true echo "---- check for persist-credentials usage ----" rg -n "persist-credentials" .github/workflows || true ``` Repository: flowy-live/llink Length of output: 103 --- 🏁 Script executed: ```shell #!/bin/bash set -euo pipefail FILE=".github/workflows/pr-quality-gate-mobile.yml" echo "=== pr-quality-gate-mobile.yml (lines 1-200) ===" if [ -f "$FILE" ]; then cat -n "$FILE" | sed -n '1,200p' else echo "Missing $FILE" exit 1 fi echo "=== other workflows using checkout/setup-node (pinned or tag refs) ===" rg -n "uses:\s*actions/(checkout|setup-node)@" .github/workflows || true echo "=== persist-credentials occurrences ===" rg -n "persist-credentials" .github/workflows || true ``` Repository: flowy-live/llink Length of output: 1941 --- </details> **Pin actions to commit SHAs and disable persisted checkout credentials in CI** `.github/workflows/pr-quality-gate-mobile.yml` uses mutable tag refs (`actions/checkout@v4` at line 20, `actions/setup-node@v4` at line 23) and the checkout step does not set `persist-credentials: false`, increasing supply-chain and token exposure risk. <details> <summary>Suggested hardening diff</summary> ```diff - name: Check out repository code - uses: actions/checkout@v4 + uses: actions/checkout@<FULL_COMMIT_SHA> + with: + persist-credentials: false - name: Set up Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@<FULL_COMMIT_SHA> with: node-version: '20' ``` </details> <details> <summary>🧰 Tools</summary> <details> <summary>🪛 zizmor (1.25.2)</summary> [warning] 19-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) --- [error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) --- [error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) </details> </details> <details> <summary>🤖 Prompt for AI Agents</summary> ``` Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-quality-gate-mobile.yml around lines 19 - 25, Replace mutable action tags actions/checkout@v4 and actions/setup-node@v4 with pinned commit SHAs and set persist-credentials: false on the checkout step to reduce supply-chain and token exposure risk; update the checkout step (actions/checkout) to include persist-credentials: false and replace both uses entries (actions/checkout and actions/setup-node) with their specific commit SHAs (use the official SHAs for the versions currently referenced) so the workflow references immutable commits. ``` </details> <!-- fingerprinting:phantom:poseidon:hawk --> <!-- cr-comment:v1:d1e53b8162f207c4b8c489fe --> _Source: Linters/SAST tools_ <!-- This is an auto-generated comment by CodeRabbit -->
- name: Enable Corepack
run: corepack enable
- name: Install dependencies
run: yarn install --immutable
- name: Run Code Linter
run: yarn lint
- name: Run Format Check
run: yarn format:check