use npm ci - #2140
Merged
Merged
Conversation
Contributor
WalkthroughCI workflows updated to run certain lint/test steps with workspace-scoped npm invocations and to add npm-blacklist validation steps (root and per-package) across multiple workflows (UI components, webapp, tauri, Vercel, and npm release). No public/exported API changes. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant GH as GitHub Actions Job
participant Nix as nix develop
participant Npm as npm (workspace)
participant Blacklist as npm-blacklist Action
rect rgb(240,245,255)
note over GH: Lint/Format & Tests (workspace-scoped)
GH->>Nix: nix develop -c npm run svelte-lint-format-check -w <workspace>
Nix->>Npm: run svelte-lint-format-check
GH->>Nix: nix develop -c npm run test -w <workspace>
Nix->>Npm: run test
end
rect rgb(245,255,245)
note over GH,Blacklist: New: npm blacklist validations
GH->>Blacklist: run (root)
GH->>Blacklist: run (packages/orderbook)
GH->>Blacklist: run (packages/ui-components)
opt Additional workspace
GH->>Blacklist: run (packages/webapp or tauri-app)
end
end
rect rgb(255,250,240)
alt No blacklist detected
GH->>GH: continue to build/release/deploy
else Blacklist detected
GH-->>GH: fail job
end
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Pre-merge checks (2 passed, 1 warning)❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests
Tip 👮 Agentic pre-merge checks are now available in preview!Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.
Please see the documentation for more information. Example: reviews:
pre_merge_checks:
custom_checks:
- name: "Undocumented Breaking Changes"
mode: "warning"
instructions: |
Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).Please share your feedback with us on this Discord post. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
⛔ Files ignored due to path filters (1)
flake.lockis excluded by!**/*.lock
📒 Files selected for processing (5)
.github/workflows/vercel-docs-preview.yaml(1 hunks).github/workflows/vercel-docs-prod.yaml(1 hunks).github/workflows/vercel-preview-pr-target.yaml(1 hunks).github/workflows/vercel-preview.yaml(1 hunks).github/workflows/vercel-prod.yaml(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:14:22.646Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, I must consistently report the PR size after EVERY new commit in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number" without any additional text or formatting blocks. The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and can be included either as part of the review or as a separate comment.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:14:22.646Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, I must consistently report the PR size after EVERY new commit in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number" without any formatting blocks. The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and can be included either as part of the review or as a separate comment.
Learnt from: hardyjosh
PR: rainlanguage/rain.orderbook#2087
File: .github/workflows/vercel-preview-pr-target.yaml:76-84
Timestamp: 2025-08-21T10:31:38.177Z
Learning: The Vercel CLI `vercel pull` command can work from the repository root in monorepo setups with appropriate project configuration, and doesn't necessarily need to run from the specific package directory (e.g., packages/webapp).
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (17)
- GitHub Check: test
- GitHub Check: git-clean
- GitHub Check: build-tauri (ubuntu-22.04, true)
- GitHub Check: standard-tests (ubuntu-latest, rainix-wasm-artifacts)
- GitHub Check: standard-tests (ubuntu-latest, test-js-bindings)
- GitHub Check: standard-tests (ubuntu-latest, rainix-rs-static)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-artifacts)
- GitHub Check: standard-tests (ubuntu-latest, rainix-wasm-test)
- GitHub Check: test
- GitHub Check: standard-tests (ubuntu-latest, ob-rs-test, true)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-legal)
- GitHub Check: standard-tests (ubuntu-latest, rainix-rs-artifacts, true)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-test)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-static)
- GitHub Check: test
- GitHub Check: Deploy-Docs-Preview
- GitHub Check: Deploy-Preview-Push
hardyjosh
approved these changes
Sep 10, 2025
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/test-webapp.yaml (2)
47-54: Optional: de-dup env at step level.Consider moving
PUBLIC_WALLETCONNECT_PROJECT_IDto the job-levelenv:to DRY the workflow.jobs: test: - permissions: + permissions: id-token: write contents: read runs-on: ubuntu-latest - env: - COMMIT_SHA: ${{ github.sha }} + env: + COMMIT_SHA: ${{ github.sha }} + PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }} @@ - - run: nix develop -c npm run svelte-lint-format-check -w @rainlanguage/webapp - env: - PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }} + - run: nix develop -c npm run svelte-lint-format-check -w @rainlanguage/webapp @@ - - run: nix develop -c npm run test -w @rainlanguage/webapp - env: - PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }} + - run: nix develop -c npm run test -w @rainlanguage/webapp
47-54: Ensure webapp scripts run in the correct directory
The-w @rainlanguage/webappflag still leaves CWD at the repo root, but your scripts use relative paths (e.g../tsconfig.json,src), so CI will fail. Addworking-directory: packages/webappto those steps or adjust scripts to referencepackages/webapp/...explicitly.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/test-ui-components.yaml(1 hunks).github/workflows/test-webapp.yaml(1 hunks)
🧰 Additional context used
🧠 Learnings (10)
📓 Common learnings
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:14:22.646Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, I must consistently report the PR size after EVERY new commit in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number" without any additional text or formatting blocks. The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and can be included either as part of the review or as a separate comment.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:14:22.646Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, I must consistently report the PR size after EVERY new commit in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number" without any formatting blocks. The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and can be included either as part of the review or as a separate comment.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#1955
File: packages/orderbook/package.json:40-40
Timestamp: 2025-07-01T21:26:42.195Z
Learning: In the rain.orderbook project, the team does not require cross-platform compatibility improvements for the TypeScript check script in packages/orderbook/package.json. The current brace expansion syntax "./dist/**/*.{ts,js}" is sufficient for their development environment.
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/webapp/**/*.{svelte,ts,js} : Webapp: run tests with `npm run test -w rainlanguage/webapp`
Applied to files:
.github/workflows/test-webapp.yaml.github/workflows/test-ui-components.yaml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/webapp/**/*.{svelte,ts,js} : Webapp: build with `npm run build -w rainlanguage/webapp`
Applied to files:
.github/workflows/test-webapp.yaml.github/workflows/test-ui-components.yaml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/webapp/**/*.{svelte,ts,js} : Webapp: lint/format check with `npm run svelte-lint-format-check -w rainlanguage/webapp`
Applied to files:
.github/workflows/test-webapp.yaml.github/workflows/test-ui-components.yaml
📚 Learning: 2025-07-11T12:30:09.245Z
Learnt from: findolor
PR: rainlanguage/rain.orderbook#1971
File: .github/workflows/vercel-docs-prod.yaml:32-34
Timestamp: 2025-07-11T12:30:09.245Z
Learning: findolor prefers not to pin Node versions explicitly in GitHub Actions workflows when using Nix with webapp-shell, considering the current setup sufficient for deterministic builds in the rainlanguage/rain.orderbook project.
Applied to files:
.github/workflows/test-webapp.yaml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/ui-components/**/*.{svelte,ts,js} : UI components: run tests with `npm run test -w rainlanguage/ui-components`
Applied to files:
.github/workflows/test-webapp.yaml.github/workflows/test-ui-components.yaml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/ui-components/**/*.{svelte,ts,js} : UI components: build with `npm run build -w rainlanguage/ui-components`
Applied to files:
.github/workflows/test-webapp.yaml.github/workflows/test-ui-components.yaml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/ui-components/**/*.{svelte,ts,js} : UI components: lint/format check with `npm run svelte-lint-format-check -w rainlanguage/ui-components`
Applied to files:
.github/workflows/test-webapp.yaml.github/workflows/test-ui-components.yaml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Always run all commands via Nix using `nix develop -c <command>`
Applied to files:
.github/workflows/test-webapp.yaml.github/workflows/test-ui-components.yaml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/orderbook/**/*.{ts,tsx} : Orderbook package: run tests with `npm run test -w rainlanguage/orderbook`
Applied to files:
.github/workflows/test-webapp.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (17)
- GitHub Check: standard-tests (ubuntu-latest, test-js-bindings)
- GitHub Check: test
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-legal)
- GitHub Check: standard-tests (ubuntu-latest, rainix-wasm-test)
- GitHub Check: standard-tests (ubuntu-latest, rainix-wasm-artifacts)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-test)
- GitHub Check: test
- GitHub Check: standard-tests (ubuntu-latest, rainix-rs-artifacts, true)
- GitHub Check: standard-tests (ubuntu-latest, rainix-rs-static)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-static)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-artifacts)
- GitHub Check: standard-tests (ubuntu-latest, ob-rs-test, true)
- GitHub Check: test
- GitHub Check: git-clean
- GitHub Check: build-tauri (ubuntu-22.04, true)
- GitHub Check: Deploy-Preview-Push
- GitHub Check: Deploy-Docs-Preview
🔇 Additional comments (2)
.github/workflows/test-ui-components.yaml (1)
47-49: No changes required: the workspace flag-w @rainlanguage/ui-componentsmatches thenamefield in packages/ui-components/package.json..github/workflows/test-webapp.yaml (1)
47-54: LGTM: workspace-scoped runs via Nix with required env.Using
-w @rainlanguage/webappundernix develop -cis consistent with repo guidance; env propagation looks correct.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 10
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/tauri.yaml (1)
102-116: Fix action path: uses bullet character instead of dot, action will not resolveReplace
•githubwith.githubin all four steps.Apply:
- - uses: rainlanguage/github-chore/•github/actions/npm-blacklist@main + - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - - uses: rainlanguage/github-chore/•github/actions/npm-blacklist@main + - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main with: working-directory: packages/orderbook - - uses: rainlanguage/github-chore/•github/actions/npm-blacklist@main + - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main with: working-directory: packages/ui-components - + - - uses: rainlanguage/github-chore/•github/actions/npm-blacklist@main + - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main with: working-directory: tauri-app.github/workflows/test-webapp.yaml (1)
21-21: Upgrade checkout action to v4 for security/perf parity with other jobs.Apply:
- - uses: actions/checkout@v2 + - uses: actions/checkout@v4
♻️ Duplicate comments (1)
.github/workflows/test-ui-components.yaml (1)
47-50: Propagate PUBLIC_WALLETCONNECT_PROJECT_ID to match webapp workflow.Align env for lint/tests to avoid divergent behavior.
Apply:
- - run: nix develop -c npm run svelte-lint-format-check -w @rainlanguage/ui-components + - run: nix develop -c npm run svelte-lint-format-check -w @rainlanguage/ui-components + env: + PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }} - - run: nix develop -c npm run test -w @rainlanguage/ui-components + - run: nix develop -c npm run test -w @rainlanguage/ui-components + env: + PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (5)
.github/workflows/npm-package-release.yml(1 hunks).github/workflows/tauri-release.yml(1 hunks).github/workflows/tauri.yaml(1 hunks).github/workflows/test-ui-components.yaml(1 hunks).github/workflows/test-webapp.yaml(1 hunks)
🧰 Additional context used
🧠 Learnings (11)
📓 Common learnings
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:14:22.646Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, I must consistently report the PR size after EVERY new commit in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number" without any additional text or formatting blocks. The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and can be included either as part of the review or as a separate comment.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:14:22.646Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, I must consistently report the PR size after EVERY new commit in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number" without any formatting blocks. The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and can be included either as part of the review or as a separate comment.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#1955
File: packages/orderbook/package.json:40-40
Timestamp: 2025-07-01T21:26:42.195Z
Learning: In the rain.orderbook project, the team does not require cross-platform compatibility improvements for the TypeScript check script in packages/orderbook/package.json. The current brace expansion syntax "./dist/**/*.{ts,js}" is sufficient for their development environment.
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/orderbook/**/*.{ts,tsx} : Orderbook package: run tests with `npm run test -w rainlanguage/orderbook`
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml.github/workflows/npm-package-release.yml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/webapp/**/*.{svelte,ts,js} : Webapp: run tests with `npm run test -w rainlanguage/webapp`
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/orderbook/**/*.{ts,tsx} : Orderbook package: type/lint check with `npm run check -w rainlanguage/orderbook`
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml.github/workflows/npm-package-release.yml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/ui-components/**/*.{svelte,ts,js} : UI components: run tests with `npm run test -w rainlanguage/ui-components`
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml.github/workflows/npm-package-release.yml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/webapp/**/*.{svelte,ts,js} : Webapp: build with `npm run build -w rainlanguage/webapp`
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/ui-components/**/*.{svelte,ts,js} : UI components: build with `npm run build -w rainlanguage/ui-components`
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml.github/workflows/npm-package-release.yml
📚 Learning: 2025-07-11T12:30:09.245Z
Learnt from: findolor
PR: rainlanguage/rain.orderbook#1971
File: .github/workflows/vercel-docs-prod.yaml:32-34
Timestamp: 2025-07-11T12:30:09.245Z
Learning: findolor prefers not to pin Node versions explicitly in GitHub Actions workflows when using Nix with webapp-shell, considering the current setup sufficient for deterministic builds in the rainlanguage/rain.orderbook project.
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/webapp/**/*.{svelte,ts,js} : Webapp: lint/format check with `npm run svelte-lint-format-check -w rainlanguage/webapp`
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/ui-components/**/*.{svelte,ts,js} : UI components: lint/format check with `npm run svelte-lint-format-check -w rainlanguage/ui-components`
Applied to files:
.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml.github/workflows/npm-package-release.yml
📚 Learning: 2025-08-20T06:59:07.794Z
Learnt from: hardyjosh
PR: rainlanguage/rain.orderbook#2087
File: .github/workflows/vercel-preview.yaml:69-77
Timestamp: 2025-08-20T06:59:07.794Z
Learning: In the rain.orderbook project, for Vercel preview workflows, the PUBLIC_WALLETCONNECT_PROJECT_ID should be hardcoded to "test" rather than using the secret with fallback, as the real ID is not needed for preview builds and will be available when it matters in production contexts.
Applied to files:
.github/workflows/test-ui-components.yaml
🪛 YAMLlint (1.37.1)
.github/workflows/tauri.yaml
[error] 112-112: trailing spaces
(trailing-spaces)
.github/workflows/tauri-release.yml
[error] 112-112: trailing spaces
(trailing-spaces)
.github/workflows/test-webapp.yaml
[error] 65-65: trailing spaces
(trailing-spaces)
[error] 69-69: trailing spaces
(trailing-spaces)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: standard-tests (ubuntu-latest, rainix-wasm-artifacts)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-artifacts)
- GitHub Check: standard-tests (ubuntu-latest, rainix-rs-artifacts, true)
- GitHub Check: test
- GitHub Check: git-clean
- GitHub Check: Deploy-Preview-Push
🔇 Additional comments (1)
.github/workflows/test-ui-components.yaml (1)
47-50: Ensure deterministic Node modules setup before tests
Add an explicitnpm ci(or equivalent install) in.github/workflows/test-ui-components.yamlbefore thenpm runsteps, or confirm that the Nix devShell inprep-all.shalready handles dependency installation.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 7
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (3)
.github/workflows/vercel-prod.yaml (1)
64-69: Pin and install Vercel locally and add safety flags.Replace the global canary install (npm install --global vercel@canary) in .github/workflows/vercel-prod.yaml (lines ~64–69) and .github/workflows/vercel-docs-prod.yaml (lines ~42–46) with the same local, pinned pattern used in vercel-preview.yaml: create a VERCEL_DIR, run npm install --no-audit --no-fund --no-save --prefix "$VERCEL_DIR" vercel@33.4.1, echo "VERCEL_BIN=$VERCEL_DIR/node_modules/.bin/vercel" >> "$GITHUB_ENV", test -x "$VERCEL_BIN", and invoke "$VERCEL_BIN" for pull/deploy steps. This prevents PATH hijacking and avoids unstable canary behavior.
.github/workflows/tauri.yaml (1)
100-116: Run npm-blacklist checks before tauri-rs-test to fail fast.
Move the four npm-blacklist steps (lines 102–115) to precede the tauri-rs-test step (line 100) in .github/workflows/tauri.yaml to avoid running expensive tauri tests/build when a blacklist violation exists..github/workflows/test-ui-components.yaml (1)
51-61: Avoid redundant blacklist runs.Same recommendation: keep one root run (if recursive) or switch to a matrix for the per-package checks.
♻️ Duplicate comments (2)
.github/workflows/vercel-preview.yaml (1)
85-86: Harden the one-off Vercel install with --ignore-scripts.Match PR-target workflow safety flags.
- npm install --no-audit --no-fund --no-save --prefix "$VERCEL_DIR" vercel@33.4.1 + npm install --no-audit --no-fund --no-save --ignore-scripts --prefix "$VERCEL_DIR" vercel@33.4.1.github/workflows/test-ui-components.yaml (1)
47-50: Propagate PUBLIC_WALLETCONNECT_PROJECT_ID and adjust -w flag position.Align with webapp workflow and canonical npm syntax.
- - run: nix develop -c npm run svelte-lint-format-check -w @rainlanguage/ui-components + - run: nix develop -c npm -w @rainlanguage/ui-components run svelte-lint-format-check + env: + PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }} @@ - - run: nix develop -c npm run test -w @rainlanguage/ui-components + - run: nix develop -c npm -w @rainlanguage/ui-components run test + env: + PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (8)
.github/workflows/npm-package-release.yml(1 hunks).github/workflows/tauri-release.yml(1 hunks).github/workflows/tauri.yaml(1 hunks).github/workflows/test-ui-components.yaml(1 hunks).github/workflows/test-webapp.yaml(1 hunks).github/workflows/vercel-preview-pr-target.yaml(1 hunks).github/workflows/vercel-preview.yaml(1 hunks).github/workflows/vercel-prod.yaml(1 hunks)
🧰 Additional context used
🧠 Learnings (11)
📓 Common learnings
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:14:22.646Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, I must consistently report the PR size after EVERY new commit in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number" without any formatting blocks. The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and can be included either as part of the review or as a separate comment.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:14:22.646Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, I must consistently report the PR size after EVERY new commit in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number" without any additional text or formatting blocks. The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and can be included either as part of the review or as a separate comment.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T21:26:31.566Z
Learning: For PR #1884 and future PRs in rainlanguage/rain.orderbook repository, provide PR size reports in a separate comment with ONLY the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number", without any additional text or explanation. Reports should exclude irrelevant files such as lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock).
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T23:09:27.578Z
Learning: For PR #1884 in rainlanguage/rain.orderbook repository, I must always reassess the PR size after each new commit, calculating the total changes up to the very latest commit and ensuring accuracy of the report. The calculation must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and report in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number".
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:46:08.530Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, the PR size report should be the only content in the comment - no text before it, no text after it, no formatting blocks, just the raw report in the exact format: "TOTAL=number\nADDITIONS=number\nDELETIONS=number". The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock).
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#1955
File: packages/orderbook/package.json:40-40
Timestamp: 2025-07-01T21:26:42.195Z
Learning: In the rain.orderbook project, the team does not require cross-platform compatibility improvements for the TypeScript check script in packages/orderbook/package.json. The current brace expansion syntax "./dist/**/*.{ts,js}" is sufficient for their development environment.
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/orderbook/**/*.{ts,tsx} : Orderbook package: run tests with `npm run test -w rainlanguage/orderbook`
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml.github/workflows/npm-package-release.yml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/webapp/**/*.{svelte,ts,js} : Webapp: run tests with `npm run test -w rainlanguage/webapp`
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/orderbook/**/*.{ts,tsx} : Orderbook package: type/lint check with `npm run check -w rainlanguage/orderbook`
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml.github/workflows/npm-package-release.yml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/ui-components/**/*.{svelte,ts,js} : UI components: run tests with `npm run test -w rainlanguage/ui-components`
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml.github/workflows/npm-package-release.yml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/webapp/**/*.{svelte,ts,js} : Webapp: build with `npm run build -w rainlanguage/webapp`
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml
📚 Learning: 2025-07-11T12:30:09.245Z
Learnt from: findolor
PR: rainlanguage/rain.orderbook#1971
File: .github/workflows/vercel-docs-prod.yaml:32-34
Timestamp: 2025-07-11T12:30:09.245Z
Learning: findolor prefers not to pin Node versions explicitly in GitHub Actions workflows when using Nix with webapp-shell, considering the current setup sufficient for deterministic builds in the rainlanguage/rain.orderbook project.
Applied to files:
.github/workflows/tauri.yaml.github/workflows/test-webapp.yaml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/ui-components/**/*.{svelte,ts,js} : UI components: lint/format check with `npm run svelte-lint-format-check -w rainlanguage/ui-components`
Applied to files:
.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml.github/workflows/npm-package-release.yml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/ui-components/**/*.{svelte,ts,js} : UI components: build with `npm run build -w rainlanguage/ui-components`
Applied to files:
.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml.github/workflows/npm-package-release.yml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/webapp/**/*.{svelte,ts,js} : Webapp: lint/format check with `npm run svelte-lint-format-check -w rainlanguage/webapp`
Applied to files:
.github/workflows/test-ui-components.yaml.github/workflows/test-webapp.yaml
📚 Learning: 2025-08-20T06:59:07.794Z
Learnt from: hardyjosh
PR: rainlanguage/rain.orderbook#2087
File: .github/workflows/vercel-preview.yaml:69-77
Timestamp: 2025-08-20T06:59:07.794Z
Learning: In the rain.orderbook project, for Vercel preview workflows, the PUBLIC_WALLETCONNECT_PROJECT_ID should be hardcoded to "test" rather than using the secret with fallback, as the real ID is not needed for preview builds and will be available when it matters in production contexts.
Applied to files:
.github/workflows/test-ui-components.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (14)
- GitHub Check: standard-tests (ubuntu-latest, rainix-rs-static)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-legal)
- GitHub Check: standard-tests (ubuntu-latest, test-js-bindings)
- GitHub Check: standard-tests (ubuntu-latest, rainix-wasm-test)
- GitHub Check: standard-tests (ubuntu-latest, rainix-wasm-artifacts)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-static)
- GitHub Check: standard-tests (ubuntu-latest, ob-rs-test, true)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-test)
- GitHub Check: standard-tests (ubuntu-latest, rainix-rs-artifacts, true)
- GitHub Check: Deploy-Docs-Preview
- GitHub Check: test
- GitHub Check: test
- GitHub Check: build-tauri (ubuntu-22.04, true)
- GitHub Check: Deploy-Preview-Push
🔇 Additional comments (1)
.github/workflows/test-webapp.yaml (1)
43-53: Run a deterministic install (npm ci) before npm runSearch found no
npm ciin the repo andprep-all.shdoesn't callnpm install; add an explicit deterministic install step (e.g.npm cior equivalent) before the npm run steps in .github/workflows/test-webapp.yaml (lines 43–53), or confirm & document thatprep-all.sh/Nix already performs an equivalent deterministic install and point to where it happens.
Comment on lines
+102
to
+116
| # check for npm package blacklists pkgs across all tauri related packages | ||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/orderbook | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/ui-components | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: tauri-app | ||
|
|
Contributor
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Confirm scope and placement of blacklist checks.
- Scope: If the root run scans all packages, the three scoped runs may be unnecessary.
- Placement: Consider moving these checks earlier to fail fast before costly steps.
Do you want me to refactor into a matrix or a reusable workflow and place it right after checkout?
🤖 Prompt for AI Agents
.github/workflows/tauri-release.yml lines 102-116: the workflow runs the same
npm-blacklist action four times (root + three package-specific invocations) and
they are placed late in the job; either the root scan already covers all
packages (making the scoped runs redundant) or we should run per-package checks
earlier to fail fast. Refactor by replacing the repeated steps with a single
matrix (or call a reusable workflow) that iterates over the desired
working-directory values (including root and each package) and move that
job/step immediately after the checkout step so blacklist checks run first; if
the root scan truly covers all packages, remove the scoped invocations instead
of duplicating them.
Comment on lines
+47
to
53
| - run: nix develop -c npm run svelte-lint-format-check -w @rainlanguage/webapp | ||
| env: | ||
| PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }} | ||
|
|
||
| - run: nix develop -c npm run test | ||
| working-directory: packages/webapp | ||
| - run: nix develop -c npm run test -w @rainlanguage/webapp | ||
| env: | ||
| PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID || 'test' }} |
Contributor
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Use canonical npm workspace flag position.
Place -w before run to avoid any npm option parsing ambiguity.
- - run: nix develop -c npm run svelte-lint-format-check -w @rainlanguage/webapp
+ - run: nix develop -c npm -w @rainlanguage/webapp run svelte-lint-format-check
@@
- - run: nix develop -c npm run test -w @rainlanguage/webapp
+ - run: nix develop -c npm -w @rainlanguage/webapp run test🤖 Prompt for AI Agents
.github/workflows/test-webapp.yaml around lines 47 to 53: the npm workspace flag
(-w) is currently placed after "run" which can cause option parsing ambiguity;
move the -w flag before "run" for both npm commands (e.g., "npm -w
@rainlanguage/webapp run ...") so the workspace is recognized unambiguously by
npm, and keep the same env entries unchanged.
Comment on lines
+55
to
+68
| # check for npm package blacklists pkgs across all packages | ||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/orderbook | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/ui-components | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/webapp |
Contributor
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Deduplicate blacklist runs or use a matrix.
Same as other workflows: keep only root if it’s recursive, or matrix-ize.
🤖 Prompt for AI Agents
.github/workflows/test-webapp.yaml lines 55-68: the npm-blacklist action is
invoked four times (root plus three package-specific calls) which duplicates
work; either keep only the root invocation if that action checks subdirectories
recursively or replace the repeated steps with a single matrix/looped job that
runs the action once per working-directory (packages/orderbook,
packages/ui-components, packages/webapp) — update the workflow to remove
duplicate steps and implement a matrix strategy (or confirm recursive behavior
and delete the per-package entries) so each package is checked exactly once.
Comment on lines
+62
to
+76
| # check for npm package blacklists pkgs across all packages | ||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/orderbook | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/ui-components | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/webapp | ||
|
|
Contributor
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Deduplicate blacklist steps via a matrix or reusable workflow.
Same comment as other workflows—either rely on the root run (if it’s recursive) or convert these four nearly identical steps into a matrix.
🤖 Prompt for AI Agents
.github/workflows/vercel-preview-pr-target.yaml lines 62-76 contain four nearly
identical uses of the rainlanguage/npm-blacklist action; deduplicate them by
either removing the package-level steps if the root blacklist run already covers
subpackages, or replace the repeated steps with a single matrix-driven step (or
a reusable workflow call) that iterates over working-directory: ["",
"packages/orderbook", "packages/ui-components", "packages/webapp"] so the action
runs once per target; update the workflow to pass the working-directory via
matrix.include or to invoke the reusable workflow with a list input, and remove
the redundant individual uses.
Comment on lines
+66
to
+80
| # check for npm package blacklists pkgs across all packages | ||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/orderbook | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/ui-components | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/webapp | ||
|
|
Contributor
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Reduce duplication or confirm action semantics.
You run npm-blacklist once at repo root and again per package. If the root run already scans all workspaces, the per-package runs are redundant; otherwise, consider a matrix to avoid repetitive steps.
Would you like me to convert these four steps into a single matrix job here (and across other workflows) for consistency?
🤖 Prompt for AI Agents
.github/workflows/vercel-preview.yaml around lines 66 to 80: the npm-blacklist
action is invoked at repo root and again for each package, causing duplication;
either remove the per-package invocations if the root call already scans all
workspaces (verify the action supports workspace scanning) or replace the four
separate steps with a single matrix job that iterates over the list [.,
packages/orderbook, packages/ui-components, packages/webapp]; implement the
matrix in the job that runs this action and use matrix.working-directory for
each entry, and propagate the same change to other workflows for consistency.
Comment on lines
+49
to
+63
| # check for npm package blacklists pkgs across all packages | ||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/orderbook | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/ui-components | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/webapp | ||
|
|
Contributor
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Avoid redundant blacklist runs.
If the root invocation already covers all workspaces, drop the per-package steps or switch to a small matrix to reduce maintenance.
🤖 Prompt for AI Agents
.github/workflows/vercel-prod.yaml lines 49-63: the workflow runs the same
npm-blacklist action at root and then repeats identical runs per-package,
creating redundant checks and extra maintenance; remove the per-package steps
(packages/orderbook, packages/ui-components, packages/webapp) if the root
invocation already scans all workspaces, or replace the repeated steps with a
single matrix-based job that iterates over package paths to run the action once
per package (define a matrix with the package list and reference matrix.package
as working-directory) so you either keep only the root call or consolidate
per-package calls into a maintainable matrix.
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
.github/workflows/vercel-prod.yaml (2)
60-65: Harden global install flags; consider pinning and PATH hardening.Add no-audit/no-fund flags; consider pinned local install via prefix + absolute path for consistency with preview flows.
- - name: Install Vercel CLI - run: npm install --global vercel@canary + - name: Install Vercel CLI + run: npm install --global --no-audit --no-fund vercel@canaryOptional (local pinned, hardened):
- - name: Install Vercel CLI - run: npm install --global --no-audit --no-fund vercel@canary + - name: Install Vercel CLI (local, pinned) + shell: bash --noprofile --norc -euo pipefail {0} + run: | + VERCEL_DIR="$(mktemp -d)" + npm install --no-audit --no-fund --no-save --ignore-scripts --prefix "$VERCEL_DIR" vercel@33.4.1 + echo "VERCEL_BIN=$VERCEL_DIR/node_modules/.bin/vercel" >> "$GITHUB_ENV" + - name: Pull Vercel Environment Information - run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }} + run: "$VERCEL_BIN" pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }} - name: Deploy Project Artifacts to Vercel - run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }} packages/webapp + run: "$VERCEL_BIN" deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }} packages/webapp
18-19: Upgrade checkout action to v4.Align with other workflows and benefit from fixes and perf.
- - uses: actions/checkout@v2 + - uses: actions/checkout@v4
♻️ Duplicate comments (4)
.github/workflows/vercel-preview.yaml (2)
66-76: Deduplicate npm-blacklist runs; use one root run or a matrix.Running the action at root and then per-package is redundant unless the action doesn’t traverse workspaces. Prefer one root scan or a matrix over copy-paste.
Option A (if action scans workspaces): remove per-package runs.
- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - with: - working-directory: packages/orderbook - - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - with: - working-directory: packages/ui-componentsOption B (if per-package is required): switch to a matrix on directories.
jobs: Deploy-Preview-Push: + strategy: + matrix: + dir: ['.', 'packages/orderbook', 'packages/ui-components'] steps: # … - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - with: - working-directory: packages/orderbook - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - with: - working-directory: packages/ui-components + - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main + with: + working-directory: ${{ matrix.dir }}
66-76: Harden Vercel CLI install: add --ignore-scripts.Match PR-target workflow hardening; prevent postinstall execution during the pinned local install.
- npm install --no-audit --no-fund --no-save --prefix "$VERCEL_DIR" vercel@33.4.1 + npm install --no-audit --no-fund --no-save --ignore-scripts --prefix "$VERCEL_DIR" vercel@33.4.1.github/workflows/vercel-prod.yaml (1)
49-59: Deduplicate npm-blacklist runs; root-only or matrix.Same redundancy here. Keep a single root scan or use a matrix over targets.
Option A (root-only):
- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - with: - working-directory: packages/orderbook - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - with: - working-directory: packages/ui-componentsOption B (matrix):
jobs: Deploy-Preview: + strategy: + matrix: + dir: ['.', 'packages/orderbook', 'packages/ui-components'] steps: - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - with: - working-directory: packages/orderbook - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - with: - working-directory: packages/ui-components + - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main + with: + working-directory: ${{ matrix.dir }}.github/workflows/vercel-preview-pr-target.yaml (1)
62-72: Deduplicate npm-blacklist runs; root-only or matrix.Same duplication here; consolidate to reduce maintenance/noise.
Option A (root-only):
- uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - with: - working-directory: packages/orderbook - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - with: - working-directory: packages/ui-componentsOption B (matrix):
jobs: Deploy-Preview-PR: + strategy: + matrix: + dir: ['.', 'packages/orderbook', 'packages/ui-components'] steps: - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - with: - working-directory: packages/orderbook - - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main - with: - working-directory: packages/ui-components + - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main + with: + working-directory: ${{ matrix.dir }}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (3)
.github/workflows/vercel-preview-pr-target.yaml(1 hunks).github/workflows/vercel-preview.yaml(1 hunks).github/workflows/vercel-prod.yaml(1 hunks)
🧰 Additional context used
🧠 Learnings (1)
📓 Common learnings
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:14:22.646Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, I must consistently report the PR size after EVERY new commit in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number" without any formatting blocks. The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and can be included either as part of the review or as a separate comment.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:14:22.646Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, I must consistently report the PR size after EVERY new commit in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number" without any additional text or formatting blocks. The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and can be included either as part of the review or as a separate comment.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T21:26:31.566Z
Learning: For PR #1884 and future PRs in rainlanguage/rain.orderbook repository, provide PR size reports in a separate comment with ONLY the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number", without any additional text or explanation. Reports should exclude irrelevant files such as lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock).
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T23:09:27.578Z
Learning: For PR #1884 in rainlanguage/rain.orderbook repository, I must always reassess the PR size after each new commit, calculating the total changes up to the very latest commit and ensuring accuracy of the report. The calculation must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and report in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number".
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:46:08.530Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, the PR size report should be the only content in the comment - no text before it, no text after it, no formatting blocks, just the raw report in the exact format: "TOTAL=number\nADDITIONS=number\nDELETIONS=number". The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock).
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T21:24:53.708Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, provide a separate comment after each review with PR size statistics in the format: `TOTAL=number ADDITIONS=number DELETIONS=number`, excluding lock files like package-lock.json and cargo.lock.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T21:24:53.708Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, provide a separate comment after each review with PR size statistics in the format: `TOTAL=number ADDITIONS=number DELETIONS=number`, excluding lock files like package-lock.json and cargo.lock.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T21:24:53.708Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, provide a separate comment after each review with PR size statistics in the format: `TOTAL=number ADDITIONS=number DELETIONS=number`, excluding lock files like package-lock.json and cargo.lock.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T21:24:53.708Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, provide a separate comment after each review with PR size statistics in the format: `TOTAL=number ADDITIONS=number DELETIONS=number`, excluding lock files like package-lock.json and cargo.lock.
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (17)
- GitHub Check: build-tauri (ubuntu-22.04, true)
- GitHub Check: test
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-legal)
- GitHub Check: standard-tests (ubuntu-latest, rainix-wasm-test)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-artifacts)
- GitHub Check: standard-tests (ubuntu-latest, test-js-bindings)
- GitHub Check: standard-tests (ubuntu-latest, rainix-wasm-artifacts)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-test)
- GitHub Check: standard-tests (ubuntu-latest, rainix-rs-artifacts, true)
- GitHub Check: standard-tests (ubuntu-latest, rainix-rs-static)
- GitHub Check: standard-tests (ubuntu-latest, ob-rs-test, true)
- GitHub Check: standard-tests (ubuntu-latest, rainix-sol-static)
- GitHub Check: git-clean
- GitHub Check: test
- GitHub Check: test
- GitHub Check: Deploy-Docs-Preview
- GitHub Check: Deploy-Preview-Push
🔇 Additional comments (1)
.github/workflows/vercel-preview-pr-target.yaml (1)
73-80: LGTM on hardened local/pinned Vercel install.Good use of --ignore-scripts and absolute path verification.
Comment on lines
+62
to
+72
| # check for npm package blacklists pkgs across all packages | ||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/orderbook | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/ui-components | ||
|
|
Contributor
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Fail fast: run blacklist before the build step.
Move blacklist ahead of the build to abort earlier on violations.
🤖 Prompt for AI Agents
.github/workflows/vercel-preview-pr-target.yaml lines 62-72: the npm-blacklist
checks run after the build; move the three uses of
rainlanguage/github-chore/.github/actions/npm-blacklist@main (root and the two
with working-directory: packages/orderbook and packages/ui-components) to a
point in the job before the build step so the workflow fails fast on blacklist
violations; ensure you preserve their inputs and relative ordering and update
any step dependencies if the build previously depended on them.
| env: | ||
| PUBLIC_WALLETCONNECT_PROJECT_ID: ${{ secrets.WALLETCONNECT_PROJECT_ID }} | ||
|
|
||
| # check for npm package blacklists pkgs across all packages |
Contributor
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Fail fast: move blacklist checks before the build.
Place blacklist steps before the webapp build to save CI time when a blocklist hit would fail anyway.
🤖 Prompt for AI Agents
.github/workflows/vercel-preview.yaml around line 66: the blacklist/npm package
check step currently runs after the webapp build, wasting CI cycles when a
blocklisted package would fail the job; move the blacklist check steps to run
before the webapp build step (place them earlier in the job sequence or in a
separate pre-build job/step that runs on the same runner), ensure their
outputs/exit codes still fail the workflow on detection, and update any step
dependencies (needs/if conditions) so the build depends on the blacklist step
passing.
🧹 Nitpick (assertive)
Nit: fix comment wording.
Use “Check npm package blacklist across all workspaces.”
- # check for npm package blacklists pkgs across all packages
+ # Check npm package blacklist across all workspaces📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| # check for npm package blacklists pkgs across all packages | |
| # Check npm package blacklist across all workspaces |
🤖 Prompt for AI Agents
.github/workflows/vercel-preview.yaml around line 66: the comment currently
reads "check for npm package blacklists pkgs across all packages" which is
unclear and grammatically off; replace it with "Check npm package blacklist
across all workspaces." to match style and clarity.
Comment on lines
+49
to
+59
| # check for npm package blacklists pkgs across all packages | ||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/orderbook | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/ui-components | ||
|
|
Contributor
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Fail fast: run blacklist before build.
Move blacklist steps before packages/webapp build to avoid wasted cycles on failures.
🤖 Prompt for AI Agents
.github/workflows/vercel-prod.yaml around lines 49-59: the npm-blacklist steps
currently run after the packages/webapp build causing wasted work on failures;
move the three npm-blacklist steps (root, packages/orderbook,
packages/ui-components) to run before the packages/webapp build step in the
job's steps sequence so they execute and can fail-fast, preserving their with:
working-directory settings and any required names or uses, and ensure any step
that depends on blacklist results still runs after them.
hardyjosh
approved these changes
Sep 11, 2025
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
.github/workflows/npm-package-release.yml (1)
82-92: Deduplicate or matrix-ize per‑package runs.You’re running root + two scoped steps. If the root scan already covers all workspaces, drop the per‑package ones; otherwise, prefer a matrix to avoid repetition.
Example (outside this hunk, restructure the job):
strategy: matrix: workdir: ["", "packages/orderbook", "packages/ui-components"] steps: - name: NPM blacklist (matrix) uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha> with: working-directory: ${{ matrix.workdir }}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: ASSERTIVE
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/npm-package-release.yml(1 hunks)
🧰 Additional context used
🧠 Learnings (6)
📓 Common learnings
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:14:22.646Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, I must consistently report the PR size after EVERY new commit in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number" without any formatting blocks. The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and can be included either as part of the review or as a separate comment.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:14:22.646Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, I must consistently report the PR size after EVERY new commit in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number" without any additional text or formatting blocks. The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and can be included either as part of the review or as a separate comment.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T23:09:27.578Z
Learning: For PR #1884 in rainlanguage/rain.orderbook repository, I must always reassess the PR size after each new commit, calculating the total changes up to the very latest commit and ensuring accuracy of the report. The calculation must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock) and report in the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number".
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T21:26:31.566Z
Learning: For PR #1884 and future PRs in rainlanguage/rain.orderbook repository, provide PR size reports in a separate comment with ONLY the exact format "TOTAL=number\nADDITIONS=number\nDELETIONS=number", without any additional text or explanation. Reports should exclude irrelevant files such as lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock).
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T22:46:08.530Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, the PR size report should be the only content in the comment - no text before it, no text after it, no formatting blocks, just the raw report in the exact format: "TOTAL=number\nADDITIONS=number\nDELETIONS=number". The report must exclude lock files (package-lock.json, yarn.lock, pnpm-lock.yaml, cargo.lock).
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T21:24:53.708Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, provide a separate comment after each review with PR size statistics in the format: `TOTAL=number ADDITIONS=number DELETIONS=number`, excluding lock files like package-lock.json and cargo.lock.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T21:24:53.708Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, provide a separate comment after each review with PR size statistics in the format: `TOTAL=number ADDITIONS=number DELETIONS=number`, excluding lock files like package-lock.json and cargo.lock.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T21:24:53.708Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, provide a separate comment after each review with PR size statistics in the format: `TOTAL=number ADDITIONS=number DELETIONS=number`, excluding lock files like package-lock.json and cargo.lock.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T21:24:53.708Z
Learning: For PR #1884 in rainlanguage/rain.orderbook, provide a separate comment after each review with PR size statistics in the format: `TOTAL=number ADDITIONS=number DELETIONS=number`, excluding lock files like package-lock.json and cargo.lock.
Learnt from: rouzwelt
PR: rainlanguage/rain.orderbook#0
File: :0-0
Timestamp: 2025-05-21T21:25:47.873Z
Learning: After each new commit review for rainlanguage/rain.orderbook repository, generate a PR size report in a separate comment with the format: "TOTAL=number ADDITIONS=number DELETIONS=number". This report should exclude irrelevant files such as lock files (e.g., package-lock.json, cargo.lock).
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/ui-components/**/*.{svelte,ts,js} : UI components: run tests with `npm run test -w rainlanguage/ui-components`
Applied to files:
.github/workflows/npm-package-release.yml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/orderbook/**/*.{ts,tsx} : Orderbook package: run tests with `npm run test -w rainlanguage/orderbook`
Applied to files:
.github/workflows/npm-package-release.yml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/ui-components/**/*.{svelte,ts,js} : UI components: build with `npm run build -w rainlanguage/ui-components`
Applied to files:
.github/workflows/npm-package-release.yml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/ui-components/**/*.{svelte,ts,js} : UI components: lint/format check with `npm run svelte-lint-format-check -w rainlanguage/ui-components`
Applied to files:
.github/workflows/npm-package-release.yml
📚 Learning: 2025-09-06T07:12:25.751Z
Learnt from: CR
PR: rainlanguage/rain.orderbook#0
File: .github/copilot-instructions.md:0-0
Timestamp: 2025-09-06T07:12:25.751Z
Learning: Applies to packages/orderbook/**/*.{ts,tsx} : Orderbook package: type/lint check with `npm run check -w rainlanguage/orderbook`
Applied to files:
.github/workflows/npm-package-release.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: git-clean
- GitHub Check: Deploy-Preview-Push
- GitHub Check: Deploy-Docs-Preview
🔇 Additional comments (2)
.github/workflows/npm-package-release.yml (2)
82-92: Fail fast — run npm-blacklist before builds/testsMove the npm-blacklist steps earlier in the workflow (immediately after checkout or right after dependency install) to catch policy violations sooner and save CI minutes.
- Confirm whether rainlanguage/github-chore/.github/actions/npm-blacklist requires node_modules. If it does, add an install step before the blacklist checks (suggested: nix develop -c npm ci). If it does not, place the blacklist checks immediately after checkout.
82-92: Add explicit install (npm ci) or document that Nix provides installsThe release workflow (.github/workflows/npm-package-release.yml) does not run npm ci — it only uses nix develop -c ... and then npm pack/publish. Either add an explicit install step before the "Build UI Components" step:
- name: Install deps (CI) run: nix develop -c npm ciOr, if Nix dev shells already install Node deps (see flake.nix npm install usages), add a clear comment in the workflow stating installs are handled by Nix.
Comment on lines
+82
to
+92
| # check for npm package blacklists pkgs across all orderbook related packages | ||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/orderbook | ||
|
|
||
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | ||
| with: | ||
| working-directory: packages/ui-components | ||
|
|
Contributor
There was a problem hiding this comment.
🧹 Nitpick (assertive)
Add explicit step names for readability.
Unnamed steps make triage noisy. Give each a distinct name, e.g., “NPM blacklist (root)”, “NPM blacklist (orderbook)”, “NPM blacklist (ui-components)”.
Apply:
- - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
+ - name: NPM blacklist (root)
+ uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
- - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
+ - name: NPM blacklist (orderbook)
+ uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
with:
working-directory: packages/orderbook
- - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
+ - name: NPM blacklist (ui-components)
+ uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
with:
working-directory: packages/ui-components📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| # check for npm package blacklists pkgs across all orderbook related packages | |
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | |
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | |
| with: | |
| working-directory: packages/orderbook | |
| - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main | |
| with: | |
| working-directory: packages/ui-components | |
| # check for npm package blacklists pkgs across all orderbook related packages | |
| - name: NPM blacklist (root) | |
| uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha> | |
| - name: NPM blacklist (orderbook) | |
| uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha> | |
| with: | |
| working-directory: packages/orderbook | |
| - name: NPM blacklist (ui-components) | |
| uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha> | |
| with: | |
| working-directory: packages/ui-components |
🤖 Prompt for AI Agents
.github/workflows/npm-package-release.yml around lines 82 to 92: the three
workflow steps invoking
rainlanguage/github-chore/.github/actions/npm-blacklist@main are unnamed which
reduces readability; add an explicit name: field for each step (for example "NPM
blacklist (root)", "NPM blacklist (orderbook)", "NPM blacklist
(ui-components)"), leaving the uses and with: blocks intact so each step is
clearly labeled in the Actions UI.
Pin the action to a commit SHA (avoid @main).
Using a moving ref is a supply‑chain risk. Pin each npm‑blacklist step to a specific commit SHA from rainlanguage/github-chore.
Apply:
- - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
+ - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
- - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
+ - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
with:
working-directory: packages/orderbook
- - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@main
+ - uses: rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha>
with:
working-directory: packages/ui-componentsReplace with the exact immutable digest. I can fetch and fill it in if you prefer.
🤖 Prompt for AI Agents
.github/workflows/npm-package-release.yml lines 82-92: the workflow uses
rainlanguage/github-chore/.github/actions/npm-blacklist@main in three steps
which is a moving ref; replace each '@main' with the same specific commit SHA
(the immutable git digest) to pin the action, i.e., update the three uses lines
so they reference
rainlanguage/github-chore/.github/actions/npm-blacklist@<commit-sha> (replace
<commit-sha> with the exact SHA provided), leaving everything else in those
steps unchanged.
Contributor
|
@coderabbitai assess this PR size classification for the totality of the PR with the following criterias and report it in your comment: S/M/L PR Classification Guidelines:This guide helps classify merged pull requests by effort and complexity rather than just line count. The goal is to assess the difficulty and scope of changes after they have been completed. Small (S)Characteristics:
Review Effort: Would have taken 5-10 minutes Examples:
Medium (M)Characteristics:
Review Effort: Would have taken 15-30 minutes Examples:
Large (L)Characteristics:
Review Effort: Would have taken 45+ minutes Examples:
Additional Factors to ConsiderWhen deciding between sizes, also consider:
Notes:
|
Contributor
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chainSIZE=M 🏁 Script executed: Length of output: 282 🏁 Script executed: Length of output: 624 SIZE=M 🧠 Learnings used |
4 tasks
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
npm ciSolution
Checks
By submitting this for review, I'm confirming I've done the following:
Summary by CodeRabbit