Create webpack.yml - #257
Conversation
Signed-off-by: danialzivehdar <243804543+danialzivehdar1992-hue@users.noreply.github.com>
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
📝 WalkthroughWalkthrough新增一个 GitHub Actions webpack 构建工作流，并新增一段流程配置：先读取本地图片文件，再将其输出传给文档分析动作并调用对应接口。 ChangesWebpack CI 工作流
文件获取与文档分析流程
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/webpack.yml (1)
18-18: ⚖️ Poor tradeoff安全风险：操作引用未固定到提交哈希。
actions/checkout@v4和actions/setup-node@v4使用标签引用而非提交 SHA，存在供应链攻击风险。标签可以被移动或覆盖，而提交哈希是不可变的。🔐 建议修复（固定到提交哈希）
- - uses: actions/checkout@v4 + - uses: actions/checkout@v4 # v4.2.2 + # SHA: 11bd71901bbe5b1630ceea73d27597364c9af683- - name: Use Node.js ${{ matrix.node-version }} - uses: actions/setup-node@v4 + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@v4 # v4.1.0 + # SHA: 39370e3970a6d050c480ffad4ff0ed4d3fdee109 with: node-version: ${{ matrix.node-version }}注意：需要查找对应标签的实际提交 SHA 并替换。
Also applies to: 21-21
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/webpack.yml at line 18, The GitHub Actions in the workflow file are using mutable tag references (actions/checkout@v4 and actions/setup-node@v4) instead of immutable commit hashes, creating a supply chain attack risk. Replace the tag-based references in both the actions/checkout and actions/setup-node action invocations with their corresponding full commit SHA hashes. Look up the actual commit hash for each version tag and replace the `@v4` notation with @<full-commit-sha> to ensure the workflow always uses the exact same version of these actions and prevent tampering.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/webpack.yml:
- Line 18: The actions/checkout@v4 action in the webpack.yml workflow is missing
the persist-credentials parameter, which creates a security risk of GitHub
credentials being exposed through build artifacts. Add the persist-credentials:
false configuration parameter to the actions/checkout@v4 step to disable
credential persistence and prevent credentials from being inadvertently exposed
in the build environment.
- Around line 25-28: The Build step in the workflow is using npx webpack to
compile the project, but webpack is not declared as a project dependency and the
actual build tool is father. Replace the npx webpack command with npm run
compile, which is the correct build command defined in the project's
package.json scripts and will ensure the workflow uses the intended build
process.
---
Nitpick comments:
In @.github/workflows/webpack.yml:
- Line 18: The GitHub Actions in the workflow file are using mutable tag
references (actions/checkout@v4 and actions/setup-node@v4) instead of immutable
commit hashes, creating a supply chain attack risk. Replace the tag-based
references in both the actions/checkout and actions/setup-node action
invocations with their corresponding full commit SHA hashes. Look up the actual
commit hash for each version tag and replace the `@v4` notation with
@<full-commit-sha> to ensure the workflow always uses the exact same version of
these actions and prevent tampering.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ee606065-faf6-421f-8224-987ccc98f907
📒 Files selected for processing (1)
.github/workflows/webpack.yml
| node-version: [18.x, 20.x, 22.x] | ||
|
|
||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
安全风险：缺少凭证持久化保护。
操作 actions/checkout@v4 未设置 persist-credentials: false，可能导致 GitHub 凭证通过构建产物泄露。
🔒 建议修复
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v4 | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 18-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/webpack.yml at line 18, The actions/checkout@v4 action in
the webpack.yml workflow is missing the persist-credentials parameter, which
creates a security risk of GitHub credentials being exposed through build
artifacts. Add the persist-credentials: false configuration parameter to the
actions/checkout@v4 step to disable credential persistence and prevent
credentials from being inadvertently exposed in the build environment.
Source: Linters/SAST tools
| - name: Build | ||
| run: | | ||
| npm install | ||
| npx webpack |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# 描述：检查仓库中是否存在 webpack 配置文件
# 查找 webpack 配置文件
fd -t f 'webpack.config' -d 3
# 检查 package.json 中是否有 webpack 相关脚本
rg -n "webpack" package.json
# 查看项目的实际构建脚本
cat package.json | jq -r '.scripts.compile, .scripts.build'Repository: ant-design/cssinjs
Length of output: 80
修复工作流步骤：将 npx webpack 替换为 npm run compile。
webpack 未在项目依赖中声明，且项目实际使用 father build 作为构建工具。当前工作流执行 npx webpack 将失败或动态下载最新版本的 webpack（不可复现）。项目的真实构建命令是 npm run compile，应改用此命令。
- name: Build
run: |
npm install
- npx webpack
+ npm run compile📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Build | |
| run: | | |
| npm install | |
| npx webpack | |
| - name: Build | |
| run: | | |
| npm install | |
| npm run compile |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/webpack.yml around lines 25 - 28, The Build step in the
workflow is using npx webpack to compile the project, but webpack is not
declared as a project dependency and the actual build tool is father. Replace
the npx webpack command with npm run compile, which is the correct build command
defined in the project's package.json scripts and will ensure the workflow uses
the intended build process.
Signed-off-by: danialzivehdar <243804543+danialzivehdadr@users.noreply.github.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ファイルを取得`:
- Line 7: `GetFile` 和 `DFAnalyzeDocument` 目前都被设置为 `private:
false`，这会把本地文件和分析结果暴露给更大的可见范围；请在这些配置点将默认值改为私有，只有在明确需要公开测试资产时才显式开启公开。请根据评论中提到的
`GetFile` 与 `DFAnalyzeDocument` 定位并同步调整对应的可见性设置，确保两个位置一致。
- Line 21: The configured endpoint is still a masked placeholder literal, so
update the analysis endpoint setting to use a real value source instead of the
redacted string. Locate the config entry containing endpoint and replace the
hardcoded URL with an environment-based or secret-injected value, keeping any
tenant/key-specific routing out of source control. Verify the code path that
builds the request reads the endpoint from configuration at runtime.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| display_name>: 'ファイルを取得' | ||
| provider: local | ||
| filename: rc_36b0011677688bf489d7 | ||
| private: false |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
确认这里确实需要公开文件与分析结果。
GetFile 和 DFAnalyzeDocument 都设置为 private: false，会扩大本地图片及分析输出的可见范围；除非这是明确可公开的测试资产，否则建议默认设为私有。
Also applies to: 27-27
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ファイルを取得` at line 7, `GetFile` 和 `DFAnalyzeDocument` 目前都被设置为 `private:
false`，这会把本地文件和分析结果暴露给更大的可见范围；请在这些配置点将默认值改为私有，只有在明确需要公开测试资产时才显式开启公开。请根据评论中提到的
`GetFile` 与 `DFAnalyzeDocument` 定位并同步调整对应的可见性设置，确保两个位置一致。
| action>: DFAnalyzeDocument | ||
| display_name>: 'Document Forceでドキュメントを解析' | ||
| provider_id: documentforce_03f3151d6f9accddcffa | ||
| endpoint: 'https://app.aipuncher.com/api/v2/analyse/****************' |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
不要提交占位或密钥型分析端点。
endpoint 当前看起来是字面量脱敏值；如果按此运行，请求会打到无效地址。若真实路径包含密钥/租户路由信息，也应改为从环境变量或 secret 注入。
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@ファイルを取得` at line 21, The configured endpoint is still a masked placeholder
literal, so update the analysis endpoint setting to use a real value source
instead of the redacted string. Locate the config entry containing endpoint and
replace the hardcoded URL with an environment-based or secret-injected value,
keeping any tenant/key-specific routing out of source control. Verify the code
path that builds the request reads the endpoint from configuration at runtime.
|
🚨 Closed: supply-chain attack attempt. This PR injects malicious files into a trusted open-source repository:
Same identical payload was submitted to multiple ant-design ecosystem repos by the same user on the same day. User reported to GitHub Trust & Safety. |
2 participants
Summary by CodeRabbit
webpack。