Skip to content

"add workflow-templates EsLint and audit" - #2

Merged
drtechie merged 3 commits into
PSMRI:mainfrom
PayalKumari10:main
Sep 12, 2024
Merged

"add workflow-templates EsLint and audit"#2
drtechie merged 3 commits into
PSMRI:mainfrom
PayalKumari10:main

Conversation

@PayalKumari10

@PayalKumari10 PayalKumari10 commented Sep 11, 2024

Copy link
Copy Markdown
Contributor

Related Issue

Fixes #3

Description

This pull request configures GitHub Actions to improve code quality and security monitoring. It includes:

  • ESLint Workflow: Runs ESLint on code changes in the main branch to ensure code quality.
  • npm Audit Workflow: Runs npm audit on changes to package.json or package-lock.json to check for vulnerabilities.

Type of PR

  • Feature enhancement

Acceptance Criteria

  • GitHub Actions workflow is set up and running for every pull request.
  • Linting errors are detected and must be resolved before merging.
  • npm audit checks for vulnerabilities when dependencies are modified.

Additional Notes

  • The workflow templates are added in the .github/workflow-templates/ directory and referenced via workflow_call in other repositories.

  • Review the workflow files for accuracy and test the workflows after merging.

  • New Features

    • Introduced an ESLint template for automated linting checks on JavaScript and TypeScript files.
    • Added a GitHub Actions workflow for continuous linting on code pushes and pull requests.
    • Implemented an NPM Audit template to check for vulnerabilities in project dependencies.
    • Created a GitHub Actions workflow for security audits triggered by changes to dependency files.
  • Impact

    • Enhances code quality and security by automating linting and vulnerability checks during development.

@coderabbitai

coderabbitai Bot commented Sep 11, 2024

Copy link
Copy Markdown

Walkthrough

This pull request introduces new workflow templates for linting JavaScript and TypeScript code and auditing dependencies in Node.js projects. It adds configuration files for ESLint and npm audit, establishing automated checks for code quality and security vulnerabilities. The ESLint workflow triggers on pushes and pull requests to the main and develop branches, while the npm audit workflow activates on changes to the package configuration files. These additions enhance the development process by ensuring consistent code quality and security checks.

Changes

Files Change Summary
workflow-templates/eslint.properties.json, workflow-templates/eslint.yml Added ESLint template and GitHub Actions workflow for linting JavaScript and TypeScript files on push and pull request events.
workflow-templates/npm-audit.properties.json, workflow-templates/npm-audit.yml Added npm audit template and GitHub Actions workflow for auditing dependencies on pull requests that modify package.json or package-lock.json.

Sequence Diagram(s)

sequenceDiagram
    participant Developer
    participant GitHub
    participant ESLint
    participant NpmAudit

    Developer->>GitHub: Push code changes
    GitHub->>ESLint: Trigger linting workflow
    ESLint->>Developer: Return linting results

    Developer->>GitHub: Open pull request
    GitHub->>NpmAudit: Trigger npm audit workflow
    NpmAudit->>Developer: Return audit results
Loading

Poem

🐰 In the code garden, we hop and play,
With linting and audits, we brighten the day.
Clean code is our treasure, so shiny and bright,
Bugs and vulnerabilities, we chase out of sight!
With each little change, our project will bloom,
A safe, happy home, where no errors loom! 🌼


Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between 356564f and 06334f8.

Files selected for processing (1)
  • workflow-templates/eslint.yml (1 hunks)
Files skipped from review as they are similar to previous changes (1)
  • workflow-templates/eslint.yml

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share
Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>.
    • Generate unit testing code for this file.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai generate unit testing code for this file.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai generate interesting stats about this repository and render them as a table.
    • @coderabbitai show all the console.log statements in this repository.
    • @coderabbitai read src/utils.ts and generate unit testing code.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 0

Outside diff range and nitpick comments (1)
workflow-templates/npm-audit.yml (1)

16-18: LGTM, but consider uploading the audit report as an artifact.

The npm audit command is correctly configured to fail the workflow if vulnerabilities are found.

Consider adding a step to upload the npm audit report as an artifact for easier review:

+      - name: Upload npm audit report
+        uses: actions/upload-artifact@v2
+        if: failure()
+        with:
+          name: npm-audit-report
+          path: npm-audit-report.json
Review details

Configuration used: CodeRabbit UI
Review profile: CHILL

Commits

Files that changed from the base of the PR and between f4cd8cb and a67652f.

Files selected for processing (4)
  • workflow-templates/eslint.properties.json (1 hunks)
  • workflow-templates/eslint.yml (1 hunks)
  • workflow-templates/npm-audit.properties.json (1 hunks)
  • workflow-templates/npm-audit.yml (1 hunks)
Files skipped from review due to trivial changes (3)
  • workflow-templates/eslint.properties.json
  • workflow-templates/eslint.yml
  • workflow-templates/npm-audit.properties.json
Additional comments not posted (3)
workflow-templates/npm-audit.yml (3)

1-2: LGTM!

The workflow name is appropriate.


3-7: LGTM!

The workflow trigger is correctly configured to run the npm audit when the package configuration files are changed.


9-15: LGTM!

The "audit" job is correctly configured to set up the environment for running the npm audit.

on:
push:
branches:
- main

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's add main, master and develop branches

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

okay i will add

Comment thread workflow-templates/eslint.yml Outdated
with:
node-version: '16'
- run: npm install
- run: npm run lint

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So we need to only lint changed files in the PR

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sure

Comment thread workflow-templates/npm-audit.yml Outdated
run: npm install
- name: Run npm audit
run: npm audit
continue-on-error: false # Ensure PRs are blocked if vulnerabilities are found

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can skip this for now.
Sometimes there won't be fixes yet for new vulnerabilities

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok @drtechie sir, I have done it, please have a look.

@drtechie
drtechie merged commit f4c902e into PSMRI:main Sep 12, 2024
@VedantKhairnar

Copy link
Copy Markdown

Hey there,
Thanks for your contribution.
As part of Augtoberfest, we want to reward you for your contributions, so pls fill out this form by 19th Sept.
Thanks.

@drtechie

Copy link
Copy Markdown
Member

@PayalKumari10 will you create the follow-up PRs for implementing the Actions in UI repos?
Please provide an ETA.

@PayalKumari10

Copy link
Copy Markdown
Contributor Author

@PayalKumari10 will you create the follow-up PRs for implementing the Actions in UI repos? Please provide an ETA.

Ok @drtechie sir , As soon as I complete this work, I will inform you. As soon as possible. Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[C4GT Community]: Configure GitHub Actions to run ESLint on changed files and npm audit on package.json changes

3 participants