add: github actions to lint and npm audit #62
Conversation
WalkthroughThe GitHub Actions workflow for linting and auditing was refactored from referencing an external reusable workflow to an inline job definition. The workflow is now configured to trigger on pushes and pull requests to main, master, and develop branches, with pull request runs further filtered to only execute when relevant JavaScript/TypeScript or package files are changed. The workflow steps include repository checkout, Node.js setup, dependency installation, and conditional execution of ESLint and npm audit steps based on the types of files changed. Changes
Sequence Diagram(s)sequenceDiagram
participant GitHub Actions
participant Repo
participant Node.js
participant npm
participant ESLint
GitHub Actions->>Repo: Checkout repository (full history)
GitHub Actions->>Node.js: Setup Node.js 16 (with npm cache)
GitHub Actions->>npm: Install dependencies (npm ci)
GitHub Actions->>Repo: Detect changed files (JS/TS/package files)
alt JS/TS files changed
GitHub Actions->>ESLint: Run ESLint on changed files
end
alt package.json or package-lock.json changed
GitHub Actions->>npm: Run npm audit
end
Possibly related PRs
Suggested reviewers
Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/lint_audit.yml (1)
48-50: Duplicate: Audit condition depends on updated changed-files config
As noted above, the npm audit step’sifdepends onall_changed_filescontaining package files. Once you update the patterns, this condition will work as intended.
🧹 Nitpick comments (1)
.github/workflows/lint_audit.yml (1)
30-32: Remove trailing whitespace
The blank line at line 32 contains trailing spaces; trimming it will satisfy YAML lint rules.🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 32-32: trailing spaces
(trailing-spaces)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/lint_audit.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/lint_audit.yml
20-20: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
25-25: the runner of "actions/setup-node@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 YAMLlint (1.35.1)
.github/workflows/lint_audit.yml
[error] 32-32: trailing spaces
(trailing-spaces)
🔇 Additional comments (4)
.github/workflows/lint_audit.yml (4)
8-14: Pull request triggers scoped to relevant file changes
Filteringpull_requestevents to JS/TS and package files will prevent unnecessary CI runs on unrelated commits.
18-23: Full repository checkout for accurate diff detection
Usingfetch-depth: 0onactions/checkout@v3is required fortj-actions/changed-filesto compute the full diff correctly. Perfect.🧰 Tools
🪛 actionlint (1.7.4)
20-20: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
24-28: Node.js setup with caching is optimal
actions/setup-node@v3withcache: 'npm'and pinnednode-version: '16.x'ensures fast, repeatable installs.🧰 Tools
🪛 actionlint (1.7.4)
25-25: the runner of "actions/setup-node@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
43-47: Conditional ESLint run on changed files
Running ESLint only whenany_changed == 'true'is efficient and prevents full runs on unrelated commits.
| - name: Get changed files | ||
| id: changed-files | ||
| uses: tj-actions/changed-files@v35 | ||
| with: | ||
| files: | | ||
| **/*.js | ||
| **/*.ts | ||
| **/*.tsx | ||
| **/*.jsx | ||
There was a problem hiding this comment.
🛠️ Refactor suggestion
Include dependency files in changed-files patterns
Right now the changed-files action only watches JS/TS source, so changes to package.json or package-lock.json won’t be reported. This breaks your npm audit condition.
Apply this diff to capture dependency file changes:
with:
files: |
**/*.js
**/*.ts
**/*.tsx
**/*.jsx
+ package.json
+ package-lock.json📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Get changed files | |
| id: changed-files | |
| uses: tj-actions/changed-files@v35 | |
| with: | |
| files: | | |
| **/*.js | |
| **/*.ts | |
| **/*.tsx | |
| **/*.jsx | |
| - name: Get changed files | |
| id: changed-files | |
| uses: tj-actions/changed-files@v35 | |
| with: | |
| files: | | |
| **/*.js | |
| **/*.ts | |
| **/*.tsx | |
| **/*.jsx | |
| package.json | |
| package-lock.json |
1 participant
📋 Description
Implements PSMRI/AMRIT#3
Enable eslint and npm audit via github actions for the repository
✅ Type of Change
Summary by CodeRabbit