Skip to content

ci: set up build and lint GitHub Action workflow #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Babin123456 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: set up build and lint GitHub Action workflow #31

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 22 additions & 4 deletions .github/workflows/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,30 @@
name: Test Workflow
name: CI Build and Lint

on:
push:
branches: [ main ]
pull_request:
branches: [ main ]

jobs:
test:
build:
runs-on: ubuntu-latest

steps:
- name: Hello
run: echo "Workflow is working!"
- name: Checkout Code
uses: actions/checkout@v4

@cubic-dev-ai cubic-dev-ai Bot Jun 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Pin actions/checkout to a full-length commit SHA and disable credential persistence here. The default checkout behavior stores the token in local git config, which is unnecessary for this workflow and broadens token exposure to later script steps.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/main.yml, line 15:

<comment>Pin `actions/checkout` to a full-length commit SHA and disable credential persistence here. The default checkout behavior stores the token in local git config, which is unnecessary for this workflow and broadens token exposure to later script steps.</comment>

<file context>
@@ -1,12 +1,30 @@
-      - name: Hello
-        run: echo "Workflow is working!"
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
</file context>


- name: Set up Node.js
uses: actions/setup-node@v4

@cubic-dev-ai cubic-dev-ai Bot Jun 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Pin actions/setup-node to a full-length commit SHA instead of the floating @v4 tag so workflow dependencies are immutable.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/main.yml, line 18:

<comment>Pin `actions/setup-node` to a full-length commit SHA instead of the floating `@v4` tag so workflow dependencies are immutable.</comment>

<file context>
@@ -1,12 +1,30 @@
+        uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 18
</file context>

with:
node-version: 18
cache: 'npm'
Comment on lines +14 to +21

@coderabbitai coderabbitai Bot Jun 26, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

resolve_tag() {
  local repo="$1"
  local tag="$2"

  local type sha
  read -r type sha < <(
    curl -fsSL "https://api.github.com/repos/${repo}/git/ref/tags/${tag}" \
      | jq -r '.object.type, .object.sha' \
      | paste - -)

  if [ "$type" = "tag" ]; then
    sha=$(curl -fsSL "https://api.github.com/repos/${repo}/git/tags/${sha}" | jq -r '.object.sha')
  fi

  echo "${repo}@${tag} -> ${sha}"
}

resolve_tag actions/checkout v4
resolve_tag actions/setup-node v4

Repository: itzzavdhesh/FlowCraft

Length of output: 250

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== .github/workflows/main.yml =="
cat -n .github/workflows/main.yml

echo
echo "== package.json =="
cat -n package.json

echo
echo "== Search for git/auth usage in workflow files =="
rg -n "persist-credentials|git |github-token|checkout@|setup-node@" .github/workflows . -g '!node_modules' -g '!dist' -g '!build'

Repository: itzzavdhesh/FlowCraft

Length of output: 2550

Pin the GitHub Actions and disable persisted checkout credentials.

actions/checkout@v4 and actions/setup-node@v4 are floating tags; pin both to immutable SHAs. Also set persist-credentials: false on checkout, since this workflow runs repo-controlled npm scripts and doesn’t need git auth left in the local config.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 14-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)

[error] 15-15: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/main.yml around lines 14 - 21, The workflow in the
Checkout Code and Set up Node.js steps uses floating action tags and leaves
checkout credentials persisted. Update the actions/checkout and
actions/setup-node references in the workflow to immutable commit SHAs, and add
persist-credentials: false to the Checkout Code step so repo-controlled npm
scripts do not retain git auth in local config.

Source: Linters/SAST tools


- name: Install Dependencies
run: npm ci

- name: Run Lint (Type Check)
run: npm run lint

- name: Build Project
run: npm run build
Loading