ci: migrate deploy workflow to new deno-deploy flow - #65
Conversation
📝 WalkthroughWalkthroughRefactors the GitHub Actions workflow to a Possibly related PRs
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.github/workflows/update-configuration.yml (1)
137-160: ScopeGITHUB_TOKENmore tightly thanwrite-all.Both downstream jobs hand a repo-wide write token to external actions. Please trim job permissions to the minimum required once the exact scopes are known. GitHub recommends least-privilege workflow/job permissions. (wellarchitected.github.com)
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a5337413-be49-4e5a-957d-eaa3eb016ab5
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
.github/workflows/update-configuration.ymlpackage.json
| pluginEntry: "${{ github.workspace }}/src/worker.ts" | ||
| excludeSupportedEvents: ${{ needs.resolve-context.outputs.exclude_supported_events }} | ||
| skipBotEvents: ${{ needs.resolve-context.outputs.skip_bot_events }} |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Check the workflow file around lines 147-149
sed -n '140,155p' .github/workflows/update-configuration.ymlRepository: ubiquity-os/plugin-template
Length of output: 711
🏁 Script executed:
# Check what's exported from src/worker.ts
head -30 src/worker.tsRepository: ubiquity-os/plugin-template
Length of output: 1239
🏁 Script executed:
# Check what's exported from src/action.ts
head -30 src/action.tsRepository: ubiquity-os/plugin-template
Length of output: 938
🏁 Script executed:
# Get broader context of the artifact job in the workflow
sed -n '130,160p' .github/workflows/update-configuration.ymlRepository: ubiquity-os/plugin-template
Length of output: 1311
Use the Actions entrypoint for the artifact build.
src/worker.ts is the Cloudflare Workers runtime entrypoint (createPlugin), while src/action.ts is the GitHub Actions entrypoint (createActionsPlugin). The artifact job publishes a GitHub Action, so it should use src/action.ts.
Suggested change
- pluginEntry: "${{ github.workspace }}/src/worker.ts"
+ pluginEntry: "${{ github.workspace }}/src/action.ts"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| pluginEntry: "${{ github.workspace }}/src/worker.ts" | |
| excludeSupportedEvents: ${{ needs.resolve-context.outputs.exclude_supported_events }} | |
| skipBotEvents: ${{ needs.resolve-context.outputs.skip_bot_events }} | |
| pluginEntry: "${{ github.workspace }}/src/action.ts" | |
| excludeSupportedEvents: ${{ needs.resolve-context.outputs.exclude_supported_events }} | |
| skipBotEvents: ${{ needs.resolve-context.outputs.skip_bot_events }} |
|
|
||
| - uses: ubiquity-os/deno-deploy@main | ||
| if: ${{ env.DEPLOY_DENO_ENABLED == 'true' && steps.refs.outputs.is_tag_ref != 'true' && steps.refs.outputs.is_artifact_ref != 'true' }} | ||
| - uses: ubiquity-os/deno-deploy@issue-17-deno-deploy-app-migration |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# Check if the repository exists and find available refs
curl -s "https://api.github.com/repos/ubiquity-os/deno-deploy" | jq -r '.name, .description, .url' 2>/dev/null || echo "Repo check via API"Repository: ubiquity-os/plugin-template
Length of output: 161
🌐 Web query:
GitHub Actions security hardening recommendations action pinning best practices
💡 Result:
GitHub Actions security hardening (with action pinning best practices)
1) Pin every third‑party action to a full commit SHA (not a branch, not @vX, not @main)
- Use:
- uses: actions/checkout@<full_length_commit_sha> # v4
- Rationale: tags/branches are mutable; a compromised tag update can change what your workflow executes. GitHub explicitly recommends full-SHA pinning for this reason. (docs.github.com)
2) Keep pinned SHAs updated automatically (don’t “set and forget”)
- Enable Dependabot version updates for GitHub Actions so it raises PRs when newer action versions are available (even when you use SHAs). (docs.github.com)
3) Enforce pinning (and optionally restrict which actions can run)
- Use repository/org Actions policies to (a) require SHA pinning and (b) control which actions/reusable workflows are allowed. (github.blog)
4) Lock down GITHUB_TOKEN permissions (least privilege)
- Set default token permissions to the minimum needed, and override per job where required:
permissions: contents: read
- GitHub’s hardening guidance highlights how a single compromised action can become high-impact if it has broad token permissions and access to secrets. (docs.github.com)
5) Prefer OIDC over long‑lived cloud credentials in secrets
- Use GitHub’s OpenID Connect integration to mint short-lived, workload-identity tokens for cloud deploys (AWS/GCP/Azure), instead of storing static cloud keys in GitHub Secrets. (docs.github.com)
6) Treat PRs (especially from forks) as untrusted input
- Follow GitHub’s guidance to avoid script-injection patterns and reduce impact by limiting permissions/secrets exposure; GitHub also notes fork PR workflows run with minimal privileges by default. (docs.github.com)
If you paste a sample workflow, I can point out exactly what to pin, what permissions: can be reduced to, and where OIDC would replace stored credentials.
Citations:
- 1: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions?utm_source=openai
- 2: https://docs.github.com/code-security/supply-chain-security/keeping-your-dependencies-updated-automatically/keeping-your-actions-up-to-date-with-dependabot?learn=dependency_version_updates&utm_source=openai
- 3: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/?utm_source=openai
- 4: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions?utm_source=openai
- 5: https://docs.github.com/en/actions/concepts/security/about-security-hardening-with-openid-connect?utm_source=openai
- 6: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions?utm_source=openai
🏁 Script executed:
# Also check the file to confirm the line and context
if [ -f .github/workflows/update-configuration.yml ]; then
sed -n '160,170p' .github/workflows/update-configuration.yml
fiRepository: ubiquity-os/plugin-template
Length of output: 501
Pin ubiquity-os/deno-deploy to a full commit SHA.
@issue-17-deno-deploy-app-migration is a mutable branch ref. Upstream rebases or force-pushes can change deployment behavior without alerting this repo. GitHub security hardening explicitly recommends pinning actions to full-length commit SHAs.
Suggested change
- - uses: ubiquity-os/deno-deploy@issue-17-deno-deploy-app-migration
+ - uses: ubiquity-os/deno-deploy@<full-commit-sha> # issue-17-deno-deploy-app-migration
GitHub Actions
Inactive
GitHub Actions
Failure
GitHub Actions
Failure
GitHub Actions
Inactive
GitHub Actions
Failure
GitHub Actions
Inactive
GitHub Actions
Failure
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
.github/workflows/update-configuration.yml (3)
41-41: Consider explicit minimal permissions instead ofread-all.
read-allworks but is broader than necessary. For a context-resolution job,contents: readwould suffice and better follow least-privilege.Suggested change
- permissions: read-all + permissions: + contents: read
134-134: Scope downwrite-allpermissions.
write-allgrants unnecessary access. Specify only required permissions (e.g.,contents: write).Suggested change
- permissions: write-all + permissions: + contents: write
156-156: Scope downwrite-allpermissions.Same as above—specify only necessary permissions for the Deno deploy job.
Suggested change
- permissions: write-all + permissions: + contents: read + deployments: write
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b1a3805d-2d0e-437d-ad5d-581f863f603d
📒 Files selected for processing (3)
.github/workflows/update-configuration.ymltests/__mocks__/helpers.tstests/main.test.ts
✅ Files skipped from review due to trivial changes (1)
- tests/mocks/helpers.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- tests/main.test.ts
| with: | ||
| pluginEntry: "./worker" | ||
| steps: | ||
| - uses: actions/checkout@v6 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What is the latest version of actions/checkout GitHub Action?
💡 Result:
The latest stable release of actions/checkout is v5.0.1 (so you’d typically use uses: actions/checkout@v5). (github.com)
Citations:
Use actions/checkout@v5 instead of v6.
The latest stable version of actions/checkout is v5.0.1, not v6. Update line 160 to use @v5. Additionally, consider SHA-pinning by using the full commit hash (e.g., actions/checkout@5a4ac9002d0be2fb38641e34605410775e73a978) for improved supply chain security.
|
| View | Contribution | Count | Reward |
|---|---|---|---|
| Review | Specification | 1 | 8.28 |
Conversation Incentives
| Comment | Formatting | Relevance | Priority | Reward |
|---|---|---|---|---|
## Summary- switch the deploy workflow to the new provision / … | 4.14content:
content:
h2:
score: 1
elementCount: 2
ul:
score: 0
elementCount: 1
li:
score: 0.1
elementCount: 3
p:
score: 0
elementCount: 2
result: 2.3
regex:
wordCount: 71
wordValue: 0.1
result: 1.84
authorship: 1
| Relevance: 1 Readability: 0.0 | 1 | 8.28 |
1 participant
Summary
Notes
-this references ubiquity-os/deno-deploy@issue-17-deno-deploy-app-migration until that PR is merged
-this workflow now expects DENO_DEPLOY_TOKEN
Closes ubiquity-os/deno-deploy#17
Depends on ubiquity-os/deno-deploy#30