-
Notifications
You must be signed in to change notification settings - Fork 202
chore: standardize repository tooling #785
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| github: ant-design | ||
| open_collective: ant-design |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,42 @@ | ||
| name: Cloudflare Pages Preview | ||
|
|
||
| on: | ||
| pull_request: | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.event.pull_request.number }} | ||
| cancel-in-progress: true | ||
|
|
||
| permissions: | ||
| contents: read | ||
| deployments: write | ||
|
|
||
| jobs: | ||
| preview: | ||
| runs-on: ubuntu-latest | ||
| env: | ||
| CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} | ||
| CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} | ||
| CLOUDFLARE_PAGES_PROJECT: ${{ vars.CLOUDFLARE_PAGES_PROJECT }} | ||
| PREVIEW: true | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | ||
| with: | ||
| persist-credentials: false | ||
| - name: Skip Cloudflare Pages preview | ||
| if: ${{ env.CLOUDFLARE_API_TOKEN == '' || env.CLOUDFLARE_ACCOUNT_ID == '' || env.CLOUDFLARE_PAGES_PROJECT == '' }} | ||
| run: echo "Cloudflare Pages preview is not configured; skip deployment." | ||
| - name: Install dependencies | ||
| if: ${{ env.CLOUDFLARE_API_TOKEN != '' && env.CLOUDFLARE_ACCOUNT_ID != '' && env.CLOUDFLARE_PAGES_PROJECT != '' }} | ||
| run: npm install | ||
| - name: Build site | ||
| if: ${{ env.CLOUDFLARE_API_TOKEN != '' && env.CLOUDFLARE_ACCOUNT_ID != '' && env.CLOUDFLARE_PAGES_PROJECT != '' }} | ||
| run: npm run build | ||
| - name: Deploy preview | ||
| if: ${{ env.CLOUDFLARE_API_TOKEN != '' && env.CLOUDFLARE_ACCOUNT_ID != '' && env.CLOUDFLARE_PAGES_PROJECT != '' }} | ||
| uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 | ||
| with: | ||
| apiToken: ${{ env.CLOUDFLARE_API_TOKEN }} | ||
| accountId: ${{ env.CLOUDFLARE_ACCOUNT_ID }} | ||
| command: pages deploy .doc --project-name=${{ env.CLOUDFLARE_PAGES_PROJECT }} --branch=${{ github.head_ref }} | ||
| gitHubToken: ${{ secrets.GITHUB_TOKEN }} | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,5 +2,5 @@ name: ✅ test | |
| on: [push, pull_request] | ||
| jobs: | ||
| test: | ||
| uses: react-component/rc-test/.github/workflows/test-npm.yml@main | ||
| uses: react-component/rc-test/.github/workflows/test-utoo.yml@main | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔒 Security & Privacy | 🟡 Minor 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# 验证目标可复用工作流是否存在及其声明的 inputs/secrets
gh api repos/react-component/rc-test/contents/.github/workflows/test-utoo.yml \
--jq '.content' 2>/dev/null | base64 -d || \
echo "未能获取 test-utoo.yml,请确认该工作流在 react-component/rc-test 的 main 分支存在"Repository: react-component/util Length of output: 690 确认 已验证
# 建议修改示例
uses: react-component/rc-test/.github/workflows/test-utoo.yml@<commit-sha>
secrets:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}🧰 Tools🪛 zizmor (1.26.1)[error] 5-5: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy) (unpinned-uses) [warning] 5-5: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow (secrets-inherit) 🤖 Prompt for AI AgentsSource: Linters/SAST tools |
||
| secrets: inherit | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,27 @@ | ||
| name: React Doctor | ||
|
|
||
| on: | ||
| pull_request: | ||
| types: [opened, synchronize, reopened, ready_for_review] | ||
| push: | ||
| branches: [master] | ||
|
|
||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| issues: write | ||
| statuses: write | ||
|
|
||
| concurrency: | ||
| group: react-doctor-${{ github.event.pull_request.number || github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| react-doctor: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | ||
| with: | ||
| fetch-depth: 0 | ||
| persist-credentials: false | ||
| - uses: millionco/react-doctor@0b4f4f4bd248a154e64eb508a48347f71154b3f3 |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| name: Surge Preview | ||
|
|
||
| on: | ||
| pull_request: | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.event.pull_request.number }} | ||
| cancel-in-progress: true | ||
|
|
||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| checks: write | ||
| statuses: write | ||
|
|
||
| jobs: | ||
| preview: | ||
| runs-on: ubuntu-latest | ||
| env: | ||
| SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }} | ||
| PREVIEW: true | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | ||
| with: | ||
| persist-credentials: false | ||
| - uses: afc163/surge-preview@bf90a5a86111f6311ca42f0a5a0f80fb0fb03cec | ||
| if: ${{ env.SURGE_TOKEN != '' }} | ||
| with: | ||
| surge_token: ${{ env.SURGE_TOKEN }} | ||
| github_token: ${{ secrets.GITHUB_TOKEN }} | ||
| dist: .doc | ||
| failOnError: true | ||
| setCommitStatus: true | ||
| build: | | ||
| npm install | ||
| npm run build | ||
| - name: Skip Surge preview | ||
| if: ${{ env.SURGE_TOKEN == '' }} | ||
| run: echo "SURGE_TOKEN is not configured; skip Surge preview." |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
避免将
github.head_ref直接插值到command中(模板注入隐患)。command会被wrangler-action作为 shell 命令执行,而github.head_ref是用户可控的分支名。Git 引用名允许包含$、反引号、;等 shell 元字符,攻击者可构造特制分支名注入命令。虽然此处密钥仅对同仓库 PR 可用(fork PR 因密钥为空被跳过)从而限制了暴露面,但仍建议通过环境变量间接引用,避免在表达式中直接拼接。🛡️ 建议改为通过 env 传递分支名
- name: Deploy preview if: ${{ env.CLOUDFLARE_API_TOKEN != '' && env.CLOUDFLARE_ACCOUNT_ID != '' && env.CLOUDFLARE_PAGES_PROJECT != '' }} uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 + env: + HEAD_REF: ${{ github.head_ref }} with: apiToken: ${{ env.CLOUDFLARE_API_TOKEN }} accountId: ${{ env.CLOUDFLARE_ACCOUNT_ID }} - command: pages deploy .doc --project-name=${{ env.CLOUDFLARE_PAGES_PROJECT }} --branch=${{ github.head_ref }} + command: pages deploy .doc --project-name=${{ env.CLOUDFLARE_PAGES_PROJECT }} --branch="$HEAD_REF" gitHubToken: ${{ secrets.GITHUB_TOKEN }}📝 Committable suggestion
🤖 Prompt for AI Agents