Refactor: Improve Build Workflow #576
Conversation
|
Warning Rate limit exceeded@victorkl400 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 15 minutes and 16 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughRemoved the standalone build-size workflow and consolidated its functionality into an updated lint-build-test workflow that uses pull_request_target, adds guarded external-PR commentary, updates actions, and includes an internal package-size comparison step. (45 words) Changes
Sequence Diagram(s)mermaid Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
Poem
Pre-merge checks✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Size Change: 0 B Total Size: 5.76 MB ℹ️ View Unchanged
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (2)
.github/workflows/lint-build-test.yaml (2)
36-38: Minor formatting and style issues in the comment body.
- Line 36: "Eg." should be styled as "e.g.," (lowercase with comma) per standard English conventions.
- Line 38: Excessive indentation before "Next steps:" creates awkward spacing.
🔎 Proposed fix
Since this PR comes from a forked repository, the lint and build will only run for internal PRs for security reasons. - Please ensure that your PR is coming from a meaningful branch name. Eg. feature/my-feature **not main** + Please ensure that your PR is coming from a meaningful branch name, e.g., feature/my-feature **not main** - **Next steps:** + **Next steps:** 1. A maintainer will review your code
65-72: Consider enabling compression for more accurate size analysis.The
compression: nonesetting means the size comparison doesn't account for how files will actually be served (typically gzipped or brotli-compressed). Consider usingcompression: gziporcompression: brotlifor a more realistic size impact assessment.🔎 Proposed change
- name: Compare package sizes uses: preactjs/compressed-size-action@946a292cd35bd1088e0d7eb92b69d1a8d5b5d76a # v2 with: repo-token: ${{ secrets.GITHUB_TOKEN }} pattern: "packages/vechain-kit/dist/**/*" exclude: "{**/node_modules/**}" - compression: none + compression: gzip minimum-change-threshold: 1000
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/build-size.yaml.github/workflows/lint-build-test.yaml
💤 Files with no reviewable changes (1)
- .github/workflows/build-size.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build-size-check
- GitHub Check: e2e-test
🔇 Additional comments (1)
.github/workflows/lint-build-test.yaml (1)
52-58: Action version updates look good.The updates to
actions/checkout@v4andactions/setup-node@v4are appropriate. The Node.js setup correctly uses the.nvmrcfile for version management and enables yarn caching for faster builds.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/lint-build-test.yaml (1)
49-55: Checkout still doesn’t test PR changes underpull_request_target.With
pull_request_target,actions/checkout@v4without an explicitref/repositorychecks out the base branch, so this job currently builds and lintsmain, not the PR’s code—even for internal PRs and for external PRs withsafe-to-build. That makes the CI signal misleading and effectively useless for catching regressions.To both respect the gating you’ve added and actually exercise the PR code, explicitly check out the PR head commit from the PR’s repository (and avoid persisting credentials):
Proposed checkout fix
- name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v4 + with: + repository: ${{ github.event.pull_request.head.repo.full_name }} + ref: ${{ github.event.pull_request.head.sha }} + fetch-depth: 0 + persist-credentials: falseThis keeps the
pull_request_targetsecurity posture (thanks to your gating + minimal permissions) while ensuring builds/lints are run against the actual PR code.In GitHub Actions, for workflows triggered by `pull_request_target`, what commit does `actions/checkout@v4` check out when `ref` is omitted, and what is the recommended pattern to safely build/test the PR’s head commit (including for forks) while minimizing token permissions?
🧹 Nitpick comments (1)
.github/workflows/lint-build-test.yaml (1)
33-41: Clarify external‑PR guidance text to match actual behavior.The message says “lint and build will only run for internal PRs,” but the job condition also allows external PRs once a maintainer adds the
safe-to-buildlabel. To avoid confusing contributors, consider rephrasing to something like “lint and build won’t run automatically for forked PRs; a maintainer can trigger them by adding thesafe-to-buildlabel,” while keeping the numbered steps.
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/lint-build-test.yaml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build-size-check
PR description
This PR updates the
Lint & BuildGitHub Actions workflow to run viapull_request_target, add an “external PR” guidance comment job, and adjust concurrency grouping.Also bumps
checkout/setup-nodefrom v3 to v4, switches build/lint commands toyarn build+yarn lint, and adds a compressed-size check onpackages/vechain-kit/dist.Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.