chore(tests) Report test coverage + upgrade security deps - #1485
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
📝 WalkthroughWalkthroughCoverage support is added for four packages and the data dashboard through shared Vitest configuration, V8 instrumentation, package scripts, Turbo orchestration, and a pull-request workflow that publishes reports. React Router, dependency, and workflow metadata are also updated. ChangesCoverage and toolchain updates
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant GitHubActions
participant Turbo
participant Vitest
participant CoverageReport
PullRequest->>GitHubActions: trigger coverage workflow
GitHubActions->>Turbo: run filtered coverage task
Turbo->>Vitest: execute target coverage script
Vitest->>CoverageReport: generate coverage reports
GitHubActions->>CoverageReport: publish reports
Possibly related PRs
Suggested reviewers: Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Coverage Report for utils (packages/utils)
File CoverageNo changed files found. |
@idos-network/client
@idos-network/consumer
@idos-network/credentials
@idos-network/enclave
@idos-network/issuer
@idos-network/kwil-infra
@idos-network/utils
commit: |
size-limit report 📦
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/coverage.yml:
- Around line 1-5: Update the Coverage workflow’s top-level configuration to add
concurrency keyed by the pull request number and enable cancel-in-progress,
ensuring older matrix runs for the same pull request are cancelled when a newer
commit triggers a run.
- Around line 7-9: Update the coverage workflow permissions and checkout
configuration so the job executing pull-request code has no pull-request write
access and uses checkout with persist-credentials disabled. Move coverage
reporting or PR metadata updates into a separate trusted job that receives
pull-requests: write only when required, while preserving the existing coverage
flow between the jobs.
- Around line 19-21: Update the checkout configuration using actions/checkout in
the coverage workflow: remove the explicit github.head_ref ref so the default
merge ref is used, or configure the pull request head repository together with
github.event.pull_request.head.sha as the ref. Do not continue checking out by
branch name alone.
- Line 19: Update every uses reference in the coverage workflow, including
actions/checkout, pnpm/action-setup, actions/setup-node, and
davelosert/vitest-coverage-report-action, to a full immutable commit SHA instead
of a version tag; preserve each action’s current version and configuration.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 8b5c37cf-735b-4864-ad1c-8f29776d47ec
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (13)
.changeset/young-mails-own.md.github/workflows/coverage.ymlcspell.config.yamlpackages/credentials/package.jsonpackages/credentials/vitest.config.tspackages/enclave/package.jsonpackages/enclave/vitest.config.tspackages/kwil-infra/package.jsonpackages/kwil-infra/vitest.config.tspackages/utils/package.jsonpackages/utils/vitest.config.tspnpm-workspace.yamlvitest.shared.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (12)
- GitHub Check: bundle-size
- GitHub Check: continuous-release
- GitHub Check: security-audit
- GitHub Check: coverage (credentials)
- GitHub Check: coverage (utils)
- GitHub Check: coverage (enclave)
- GitHub Check: changeset
- GitHub Check: coverage (kwil-infra)
- GitHub Check: quality
- GitHub Check: typecheck
- GitHub Check: test
- GitHub Check: Analyze (javascript-typescript)
🧰 Additional context used
🪛 GitHub Check: cspell
.github/workflows/coverage.yml
[warning] 39-39:
Unknown word (davelosert)
🪛 markdownlint-cli2 (0.23.0)
.changeset/young-mails-own.md
[warning] 8-8: First line in a file should be a top-level heading
(MD041, first-line-heading, first-line-h1)
🪛 zizmor (1.26.1)
.github/workflows/coverage.yml
[warning] 19-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 9-9: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level
(excessive-permissions)
[warning] 35-35: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 27-27: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 39-39: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 9-9: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
[info] 12-12: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
[warning] 3-5: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🔇 Additional comments (12)
vitest.shared.ts (1)
3-7: LGTM!pnpm-workspace.yaml (1)
96-96: LGTM!packages/credentials/package.json (1)
46-46: LGTM!Also applies to: 63-63
packages/credentials/vitest.config.ts (1)
3-8: LGTM!packages/enclave/package.json (1)
38-38: LGTM!Also applies to: 53-53
packages/enclave/vitest.config.ts (1)
3-8: LGTM!packages/kwil-infra/package.json (1)
46-46: LGTM!Also applies to: 59-59
packages/kwil-infra/vitest.config.ts (1)
3-8: LGTM!packages/utils/package.json (1)
51-51: LGTM!Also applies to: 71-71
packages/utils/vitest.config.ts (1)
3-8: LGTM!cspell.config.yaml (1)
34-34: LGTM!.changeset/young-mails-own.md (1)
1-8: 📐 Maintainability & Code QualityConfirm that four patch releases are intended.
This PR adds test and coverage tooling; verify that repository release policy requires publishing patch versions for these dev-only changes. Otherwise, remove the changeset to avoid unnecessary consumer-facing releases.
| permissions: | ||
| contents: read | ||
| pull-requests: write |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Do not grant PR-write credentials to the job that executes PR code.
This job checks out pull-request code and runs pnpm install plus coverage tests. With pull-requests: write and checkout’s persisted credentials, modified scripts/tests could use a write-capable token to alter PR metadata. Split coverage and reporting into separate trust boundaries; set persist-credentials: false as defense in depth.
Also applies to: 19-21, 32-35
🧰 Tools
🪛 zizmor (1.26.1)
[error] 9-9: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level
(excessive-permissions)
[warning] 9-9: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/coverage.yml around lines 7 - 9, Update the coverage
workflow permissions and checkout configuration so the job executing
pull-request code has no pull-request write access and uses checkout with
persist-credentials disabled. Move coverage reporting or PR metadata updates
into a separate trusted job that receives pull-requests: write only when
required, while preserving the existing coverage flow between the jobs.
Source: Linters/SAST tools
| matrix: | ||
| package: [credentials, enclave, kwil-infra, utils] | ||
| steps: | ||
| - uses: actions/checkout@v6 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Files matching coverage.yml:"
fd -a 'coverage\.yml$' . || true
echo
echo "Relevant workflow lines:"
if [ -f .github/workflows/coverage.yml ]; then
nl -ba .github/workflows/coverage.yml | sed -n '1,80p'
fi
echo
echo "Search for action uses in this workflow or nearby workflows:"
python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/coverage.yml')
if p.exists():
for i, line in enumerate(p.read_text().splitlines(), 1):
if 'uses:' in line:
print(f'{i}: {line.strip()}')
else:
print('.github/workflows/coverage.yml not found')
PY
echo
echo "Repository policy references mentioning pinning/tags/immutable SHAs:"
rg -n --hidden -i 'pin|immutable|sha|commit|tags|action' .github README* docs . 2>/dev/null | head -n 120 || trueRepository: idos-network/idos-sdk-js
Length of output: 258
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Files matching coverage.yml:"
find . -path '*/.github/workflows/*coverage.yml' -type f -print || true
echo
echo "Relevant workflow lines:"
if [ -f .github/workflows/coverage.yml ]; then
awk '{printf("%6d\t%s\n", NR, $0)}' .github/workflows/coverage.yml | sed -n '1,80p'
fi
echo
echo "Action references in workflow:"
if [ -f .github/workflows/coverage.yml ]; then
awk -v n=0 '{n++; if(/uses:/) print n": "$0}' .github/workflows/coverage.yml
fi
echo
echo "Repository policy references mentioning action pinning/tags/immutable SHAs:"
rg -n --hidden -i 'pin|immutable|sha|commit|tags|action' .github README* docs . 2>/dev/null | head -n 160 || trueRepository: idos-network/idos-sdk-js
Length of output: 50381
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Renovate workflow pinning configuration:"
python3 - <<'PY'
from pathlib import Path
p = Path('.github/renovate.json')
if p.exists():
print(p.read_text()[:2000])
else:
print(".github/renovate.json not found")
PY
echo
echo "All GitHub Actions uses refs in coverage.yml:"
python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/coverage.yml')
if p.exists():
for i, line in enumerate(p.read_text().splitlines(), 1):
if 'uses:' in line:
ref = line.split('@', 1)[1].split()[0] if '@' in line else ''
sha_like = True
# lightweight git SHA patterns; tag-like versions are not commit SHAs
if ref.startswith(('v', 'x', '*', '/', ';')) or re := __import__('re').compile(r'^[0-9]+\.[0-9]+(\.[0-9]+).*'); sha_like = not bool(re.search(ref)):
pass
print(f"{i}: {line.strip()} | ref={ref} | likely_sha={sha_like}")
PY
echo
echo "Repository policy files mentioning immutable commit SHA / tag pinning:"
rg -n --hidden --glob '!**/*.svg' --glob '!**/*.png' --glob '!**/*.jpg' \
-i 'pin|immutable|commit SHA|commit sha|tag retarget|retargeting|allow tags|allow tags' .github README.md docs 2>/dev/null || trueRepository: idos-network/idos-sdk-js
Length of output: 1499
Pin all uses: refs to full commit SHAs.
actions/checkout@v6, pnpm/action-setup@v5, actions/setup-node@v6, and davelosert/vitest-coverage-report-action@v2 are mutable tag refs and can be retargeted. Use full commit SHAs for all action references in this workflow.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 19-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/coverage.yml at line 19, Update every uses reference in
the coverage workflow, including actions/checkout, pnpm/action-setup,
actions/setup-node, and davelosert/vitest-coverage-report-action, to a full
immutable commit SHA instead of a version tag; preserve each action’s current
version and configuration.
Source: Linters/SAST tools
| - uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ github.head_ref }} |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Workflow files =="
git ls-files '.github/workflows/*' || true
echo
echo "== coverage.yml context =="
if [ -f .github/workflows/coverage.yml ]; then
cat -n .github/workflows/coverage.yml
else
echo "coverage.yml not found"
fi
echo
echo "== Search for PR workflow patterns =="
rg -n "actions/checkout|github\.head_ref|github\.event\.pull_request\.head\.sha|head_sha|base_ref" .github/workflows || trueRepository: idos-network/idos-sdk-js
Length of output: 3087
🌐 Web query:
GitHub actions github.head_ref pull request on fork actions/checkout ref event pull_request head ref
💡 Result:
When a pull request is opened from a forked repository, using ref: ${{ github.head_ref }} in the actions/checkout step will typically fail because github.head_ref is empty or refers to a branch name that does not exist in the base repository's context [1][2]. The actions/checkout action defaults to the context of the base repository [1]. Because the fork's branch is not present in the base repository, actions/checkout cannot find or check out that reference directly by name [1][2]. Recommended Approaches: 1. Use GitHub CLI (gh) (Recommended) The most robust way to check out a pull request from a fork is to use the GitHub CLI, which automatically handles the fork/remote configuration [1]: - name: Check out PR branch env: GH_TOKEN: ${{ github.token }} run: gh pr checkout ${{ github.event.pull_request.number }} 2. Explicitly Configure Repository and Ref If you must use actions/checkout, you can manually point it to the fork's repository and the head reference [3]. Note that this approach is subject to security restrictions when using pull_request_target [4][5]: - uses: actions/checkout@v4 with: repository: ${{ github.event.pull_request.head.repo.full_name }} ref: ${{ github.event.pull_request.head.ref }} Security Considerations: - pull_request: Workflows triggered by pull_request run in a less privileged context and generally have restricted access to secrets [3]. - pull_request_target: Workflows triggered by pull_request_target run in the context of the base repository with access to secrets [4][3]. By default, actions/checkout refuses to check out fork code in this context to prevent "pwn request" attacks [5][6]. If you require this, you must set allow-unsafe-pr-checkout: true only after verifying that the workflow is secure [4][5]. For most CI/CD scenarios, referencing the commit SHA directly is safer than referencing a branch name [7]: - uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.sha }}
Citations:
- 1: fix: use gh pr checkout to handle fork PRs in license-check workflow github/github-mcp-server#1709
- 2: Head_ref not found for PR's from forked repositories actions/checkout#694
- 3: https://eclipse-score.github.io/score/main/contribute/ci/publishing-gh-pages.html
- 4: https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target
- 5: https://github.com/actions/checkout
- 6: https://github.com/actions/checkout?tab=readme-ov-file
- 7: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
Use the PR SHA or remove the explicit checkout ref.
github.head_ref is a branch name and may refer to a branch in a forked repository not present in the checked-out base repository. Remove the ref to use the default merge ref, or set repository: ${{ github.event.pull_request.head.repo.full_name }} with ref: ${{ github.event.pull_request.head.sha }}.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 19-21: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 19-19: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/coverage.yml around lines 19 - 21, Update the checkout
configuration using actions/checkout in the coverage workflow: remove the
explicit github.head_ref ref so the default merge ref is used, or configure the
pull request head repository together with github.event.pull_request.head.sha as
the ref. Do not continue checking out by branch name alone.
Coverage Report for credentials (packages/credentials)
File CoverageNo changed files found. |
Coverage Report for kwil-infra (packages/kwil-infra)
File CoverageNo changed files found. |
Coverage Report for data-dashboard (apps/idos-data-dashboard)
File CoverageNo changed files found. |
Coverage Report for enclave (packages/enclave)
File CoverageNo changed files found. |
Strnadj
changed the title
1 participant
Summary by CodeRabbit