ci: deploy documentation with reusable workflow#715
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Walkthrough新增 GitHub Pages 部署工作流，支持 release 发布事件和手动触发，并通过远程复用工作流执行部署。 Changes文档部署
Estimated code review effort: 1 (Trivial) | ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
React Doctor could not complete this scan.
Reviewed by React Doctor for commit |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #715 +/- ##
=======================================
Coverage 99.69% 99.69%
=======================================
Files 4 4
Lines 331 331
Branches 152 152
=======================================
Hits 330 330
Misses 1 1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
❌ Deploy failed
📋 Build log (last lines)🤖 Powered by surge-preview |
|||||||||
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deploy-pages.yml:
- Line 15: 将 deploy-pages 工作流的 uses 引用从可变的 main 分支改为已审核的完整 commit SHA，并确认该提交仍提供
workflow_call 接口；保持其余工作流配置不变。
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e4fbe36f-1b34-4bf9-b5e7-5505f17f862f
📒 Files selected for processing (1)
.github/workflows/deploy-pages.yml
|
|
||
| jobs: | ||
| deploy: | ||
| uses: react-component/rc-test/.github/workflows/deploy-pages.yml@main |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow file =="
if [ -f .github/workflows/deploy-pages.yml ]; then
nl -ba .github/workflows/deploy-pages.yml | sed -n '1,80p'
else
echo "missing .github/workflows/deploy-pages.yml"
fi
echo
echo "== references to rc-test deploy-pages =="
rg -n "rc-test/.github/workflows/deploy-pages|workflow_call|workflow_dispatch|on:\s*\[" .github/workflows || true
echo
echo "== changed files/stat =="
git diff --stat || true
git diff --name-only || trueRepository: react-component/pagination
Length of output: 224
🌐 Web query:
GitHub Actions reusable workflows trigger workflow_call on remote workflow file documentation
💡 Result:
To trigger a reusable workflow from another file or repository, you must use the workflow_call event [1][2]. This event allows a workflow to be invoked by another workflow, known as a caller workflow [1][3]. Key Configuration Requirements: 1. Enable the trigger: In the target workflow file that you intend to reuse (the called workflow), you must include the workflow_call event in its on section [1][4]. on: workflow_call: 2. Call the workflow: In your caller workflow, use the uses keyword within a job to reference the remote or local workflow file [1][5]. The syntax requires the repository path, file path, and a reference (tag, branch, or commit SHA) [5]. jobs: call-reusable: uses: owner/repo/.github/workflows/reusable-workflow.yml@v1 Important Considerations: - Location: Reusable workflows must be located in the.github/workflows directory of the repository [1]. Subdirectories are not supported [1]. - Access: If the reusable workflow resides in a private repository, it can only be accessed by other workflows within that same private repository [2]. - Execution Context: When a workflow is called from a different repository, the actions within the called workflow execute as if they were part of the caller workflow [3]. For example, if the called workflow checks out code, it will check out the caller repository's code, not the repository where the reusable workflow file is stored [3]. - Data Passing: You can pass inputs and secrets to the reusable workflow using the with and secrets keywords within the job configuration [1][6]. Data types for inputs must match those defined in the called workflow [1]. For detailed documentation, refer to the official GitHub Actions guide on reusing workflows [1].
Citations:
- 1: https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
- 2: https://github.blog/developer-skills/github/using-reusable-workflows-github-actions/
- 3: https://github.com/github/docs/blob/main/content/actions/concepts/workflows-and-actions/reusing-workflow-configurations.md
- 4: https://github.com/github/docs/blob/main/content/actions/how-tos/reuse-automations/reuse-workflows.md
- 5: https://docs.github.com/en/enterprise-cloud@latest/actions/how-tos/reuse-automations/reuse-workflows
- 6: https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax
🏁 Script executed:
#!/bin/bash
set -u
echo "== workflow file =="
if [ -f .github/workflows/deploy-pages.yml ]; then
awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/deploy-pages.yml | sed -n '1,100p'
else
echo "missing .github/workflows/deploy-pages.yml"
fi
echo
echo "== references to rc-test deploy-pages =="
rg -n "rc-test/.github/workflows/deploy-pages|workflow_call|workflow_dispatch|secrets|with:" .github/workflows || true
echo
echo "== changed files/stat =="
git diff --stat || true
git diff --name-only || true
echo
echo "== remote referenced workflow header via HTTP =="
python3 - <<'PY'
import urllib.request
url = 'https://raw.githubusercontent.com/react-component/rc-test/main/.github/workflows/deploy-pages.yml'
try:
req = urllib.request.Request(url,headers={'User-Agent':'CodeRabbit-verify'})
resp = urllib.request.urlopen(req, timeout=20)
body = resp.read().decode('utf-8', 'replace')
lines = body.splitlines()
print(f"status={getattr(resp, 'status')}")
print(f"first 80 lines:")
for i, line in enumerate(lines[:80], 1):
print(f"{i}: {line}")
print(f"has workflow_call: {'workflow_call' in body}")
print(f"repo_path: react-component/rc-test/.github/workflows/deploy-posts.yml?.git?")
print(f"path: deploy-pages.yml")
except Exception as e:
print(f"ERROR {e.__class__.__name__}: {e}")
PYRepository: react-component/pagination
Length of output: 1684
🌐 Web query:
github actions reusable workflow @main fixed commit SHA pin best practice
💡 Result:
Pinning GitHub Actions reusable workflows to a full-length commit SHA is considered a security and stability best practice [1][2][3]. Unlike tags (e.g., @v1) or branches (e.g., @main), which are mutable and can be updated to point to malicious or breaking code, a commit SHA is immutable, ensuring the workflow always executes the exact code you have reviewed and verified [4][5]. Best practices for managing reusable workflow references include: 1. Always Pin to Full SHA: Use the full-length commit SHA (not the short version) in your workflow reference syntax: uses: owner/repo/.github/workflows/workflow.yml@a1b2c3d4... [2][5]. 2. Maintain Human-Readable References: While pinning to the SHA, it is common practice to include the original tag or branch name in a trailing comment to improve readability: uses: owner/repo/.github/workflows/workflow.yml@a1b2c3d4 # v1.0.0 [6]. 3. Automate Updates: Use automated tools such as Dependabot or Renovate to maintain these pins. These tools are designed to detect when a new release tag is available and can automatically propose a pull request to update the SHA pin, keeping you secure without manual tracking [5][6]. 4. Enforce via Organization Policy: If you are an administrator, you can enforce this requirement across your organization. GitHub allows you to set an organization-level policy to "Require actions to be pinned to a full-length commit SHA," which will cause any workflow using non-SHA references to fail [4][7]. 5. Audit Sub-dependencies: Remember that reusable workflows may themselves call other actions or workflows. Security best practices require that these sub-dependencies are also pinned to SHAs, as they are otherwise invisible to the primary caller [4][5][6]. You can use tools or scripts to walk the call graph and verify that all downstream references are also pinned [4]. 6. Beware of Impostor Commits: When pinning, ensure the commit belongs to the expected repository. Some security tools (such as Zizmor) can help detect "impostor commits" to prevent dependency confusion attacks [8]. By moving from mutable tags to immutable SHAs, you minimize the risk of supply chain attacks where a compromised tag could inject malicious steps into your CI/CD pipelines [2][6].
Citations:
- 1: https://github.com/github/docs/blob/main/content/actions/concepts/workflows-and-actions/reusing-workflow-configurations.md
- 2: https://adaptive-enforcement-lab.com/secure/github-actions-security/workflows/reusable/caller-validation-pinning/
- 3: https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows
- 4: https://www.systemshardening.com/articles/cicd/github-actions-reusable-workflow-pinning-audit/
- 5: https://www.romainlespinasse.dev/posts/github-actions-commit-sha-pinning/
- 6: https://safeguard.sh/resources/blog/securing-github-actions-reusable-workflows-at-scale
- 7: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
- 8: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.md
将远程可复用工作流固定到完整 commit SHA。
.github/workflows/deploy-pages.yml:15 中 react-component/rc-test/.github/workflows/deploy-pages.yml@main 指向可变分支，会随上游更新改变文档部署行为并增加供应链风险。改用已审核的完整 commit SHA，并确认该提交仍暴露 workflow_call 接口。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deploy-pages.yml at line 15, 将 deploy-pages 工作流的 uses
引用从可变的 main 分支改为已审核的完整 commit SHA，并确认该提交仍提供 workflow_call 接口；保持其余工作流配置不变。
Source: Learnings
1 participant
Summary
Verification
Summary by CodeRabbit