Skip to content

ci: deploy documentation with reusable workflow #715

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zombieJ merged 1 commit into from
Jul 27, 2026
+15 −0
Merged

ci: deploy documentation with reusable workflow #715

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/workflows/deploy-pages.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
name: Deploy documentation

on:
release:
types: [published]
workflow_dispatch:

permissions:
contents: read
pages: write
id-token: write

jobs:
deploy:
uses: react-component/rc-test/.github/workflows/deploy-pages.yml@main

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow file =="
if [ -f .github/workflows/deploy-pages.yml ]; then
  nl -ba .github/workflows/deploy-pages.yml | sed -n '1,80p'
else
  echo "missing .github/workflows/deploy-pages.yml"
fi

echo
echo "== references to rc-test deploy-pages =="
rg -n "rc-test/.github/workflows/deploy-pages|workflow_call|workflow_dispatch|on:\s*\[" .github/workflows || true

echo
echo "== changed files/stat =="
git diff --stat || true
git diff --name-only || true

Repository: react-component/pagination

Length of output: 224

🌐 Web query:

GitHub Actions reusable workflows trigger workflow_call on remote workflow file documentation

💡 Result:

To trigger a reusable workflow from another file or repository, you must use the workflow_call event [1][2]. This event allows a workflow to be invoked by another workflow, known as a caller workflow [1][3]. Key Configuration Requirements: 1. Enable the trigger: In the target workflow file that you intend to reuse (the called workflow), you must include the workflow_call event in its on section [1][4]. on: workflow_call: 2. Call the workflow: In your caller workflow, use the uses keyword within a job to reference the remote or local workflow file [1][5]. The syntax requires the repository path, file path, and a reference (tag, branch, or commit SHA) [5]. jobs: call-reusable: uses: owner/repo/.github/workflows/reusable-workflow.yml@v1 Important Considerations: - Location: Reusable workflows must be located in the.github/workflows directory of the repository [1]. Subdirectories are not supported [1]. - Access: If the reusable workflow resides in a private repository, it can only be accessed by other workflows within that same private repository [2]. - Execution Context: When a workflow is called from a different repository, the actions within the called workflow execute as if they were part of the caller workflow [3]. For example, if the called workflow checks out code, it will check out the caller repository's code, not the repository where the reusable workflow file is stored [3]. - Data Passing: You can pass inputs and secrets to the reusable workflow using the with and secrets keywords within the job configuration [1][6]. Data types for inputs must match those defined in the called workflow [1]. For detailed documentation, refer to the official GitHub Actions guide on reusing workflows [1].

Citations:

🏁 Script executed:

#!/bin/bash
set -u

echo "== workflow file =="
if [ -f .github/workflows/deploy-pages.yml ]; then
  awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/deploy-pages.yml | sed -n '1,100p'
else
  echo "missing .github/workflows/deploy-pages.yml"
fi

echo
echo "== references to rc-test deploy-pages =="
rg -n "rc-test/.github/workflows/deploy-pages|workflow_call|workflow_dispatch|secrets|with:" .github/workflows || true

echo
echo "== changed files/stat =="
git diff --stat || true
git diff --name-only || true

echo
echo "== remote referenced workflow header via HTTP =="
python3 - <<'PY'
import urllib.request
url = 'https://raw.githubusercontent.com/react-component/rc-test/main/.github/workflows/deploy-pages.yml'
try:
    req = urllib.request.Request(url,headers={'User-Agent':'CodeRabbit-verify'})
    resp = urllib.request.urlopen(req, timeout=20)
    body = resp.read().decode('utf-8', 'replace')
    lines = body.splitlines()
    print(f"status={getattr(resp, 'status')}")
    print(f"first 80 lines:")
    for i, line in enumerate(lines[:80], 1):
        print(f"{i}: {line}")
    print(f"has workflow_call: {'workflow_call' in body}")
    print(f"repo_path: react-component/rc-test/.github/workflows/deploy-posts.yml?.git?")
    print(f"path: deploy-pages.yml")
except Exception as e:
    print(f"ERROR {e.__class__.__name__}: {e}")
PY

Repository: react-component/pagination

Length of output: 1684

🌐 Web query:

github actions reusable workflow @main fixed commit SHA pin best practice

💡 Result:

Pinning GitHub Actions reusable workflows to a full-length commit SHA is considered a security and stability best practice [1][2][3]. Unlike tags (e.g., @v1) or branches (e.g., @main), which are mutable and can be updated to point to malicious or breaking code, a commit SHA is immutable, ensuring the workflow always executes the exact code you have reviewed and verified [4][5]. Best practices for managing reusable workflow references include: 1. Always Pin to Full SHA: Use the full-length commit SHA (not the short version) in your workflow reference syntax: uses: owner/repo/.github/workflows/workflow.yml@a1b2c3d4... [2][5]. 2. Maintain Human-Readable References: While pinning to the SHA, it is common practice to include the original tag or branch name in a trailing comment to improve readability: uses: owner/repo/.github/workflows/workflow.yml@a1b2c3d4 # v1.0.0 [6]. 3. Automate Updates: Use automated tools such as Dependabot or Renovate to maintain these pins. These tools are designed to detect when a new release tag is available and can automatically propose a pull request to update the SHA pin, keeping you secure without manual tracking [5][6]. 4. Enforce via Organization Policy: If you are an administrator, you can enforce this requirement across your organization. GitHub allows you to set an organization-level policy to "Require actions to be pinned to a full-length commit SHA," which will cause any workflow using non-SHA references to fail [4][7]. 5. Audit Sub-dependencies: Remember that reusable workflows may themselves call other actions or workflows. Security best practices require that these sub-dependencies are also pinned to SHAs, as they are otherwise invisible to the primary caller [4][5][6]. You can use tools or scripts to walk the call graph and verify that all downstream references are also pinned [4]. 6. Beware of Impostor Commits: When pinning, ensure the commit belongs to the expected repository. Some security tools (such as Zizmor) can help detect "impostor commits" to prevent dependency confusion attacks [8]. By moving from mutable tags to immutable SHAs, you minimize the risk of supply chain attacks where a compromised tag could inject malicious steps into your CI/CD pipelines [2][6].

Citations:

将远程可复用工作流固定到完整 commit SHA。

.github/workflows/deploy-pages.yml:15 中 react-component/rc-test/.github/workflows/deploy-pages.yml@main 指向可变分支，会随上游更新改变文档部署行为并增加供应链风险。改用已审核的完整 commit SHA，并确认该提交仍暴露 workflow_call 接口。

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/deploy-pages.yml at line 15, 将 deploy-pages 工作流的 uses
引用从可变的 main 分支改为已审核的完整 commit SHA，并确认该提交仍提供 workflow_call 接口；保持其余工作流配置不变。

Source: Learnings

Loading