chore: 오픈소스 운영 인프라 구축 - #86
Merged
Merged
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthrough이 PR은 저장소 운영 템플릿·로컬 검수 도구(husky/commitlint/lint-staged), 여러 GitHub Actions(이슈 중복 탐지·PR 검사·릴리즈·알림), 문서·매니페스트 및 코드/테스트 포맷 정리를 포함합니다. Changes오픈소스 운영 인프라 구축
Estimated code review effort: ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🧹 Nitpick comments (1)
.github/workflows/pr-checks.yml (1)
38-39: ⚡ Quick win
verify잡에needs: issue-link를 추가해 정책 강제와 CI 낭비를 줄여주세요.현재는
issue-link실패 여부와 무관하게verify가 병렬 실행됩니다. Line 38에서 의존성을 걸면 “이슈-먼저” 정책이 실제 실행 순서로도 보장됩니다.🔧 제안 패치
verify: + needs: issue-link runs-on: ubuntu-latest🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-checks.yml around lines 38 - 39, The verify job is running in parallel with issue-link; add a dependency so verify waits for issue-link by adding needs: [issue-link] to the verify job definition (referencing the job name "verify" and the dependency job "issue-link") so the CI enforces the "issue-first" policy and avoids wasted runs.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-checks.yml:
- Around line 41-42: The checkout step currently uses actions/checkout@v4
without disabling credential persistence; update the checkout step (the step
that uses actions/checkout@v4) to include a with: block setting
persist-credentials: false so the step becomes: uses: actions/checkout@v4 and
under it add with: persist-credentials: false to prevent the runner from
retaining the clone token in git config.
- Line 23: Replace tag-based GitHub Action references with the pinned commit
SHAs at the listed sites: in .github/workflows/pr-checks.yml (23-23) replace
actions/github-script@v7 with
actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b; in
.github/workflows/pr-checks.yml (42-42) replace actions/checkout@v4 with
actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5; in
.github/workflows/pr-checks.yml (45-45) replace actions/setup-node@v4 with
actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020; and in
.github/workflows/issue-dedup.yml (19-19) replace actions/github-script@v7 with
actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b.
In @.github/workflows/release.yaml:
- Around line 74-86: The prepare step currently computes a new version from the
local package.json (variables pkg, base, major/minor/patch, newVersion,
prerelease) before the approval gate which leads to stale identical versions for
concurrent runs; change the workflow so version computation is re-done after the
approval/serialization step using the authoritative main branch state: fetch and
update refs (git fetch origin main --tags), read the package.json from
origin/main (e.g. git show origin/main:package.json or checkout a fresh main)
and then re-split base/version and recompute major/minor/patch and newVersion
(keeping the existing beta logic using context.runNumber) immediately before
running npm version / git tag / git push so each approved run derives its tag
from the latest main.
- Around line 27-29: 상단 워크플로 전체 권한 블록에서 현재 "permissions: contents: write"를 제거하고
전역 권한을 "read" 또는 "none"으로 축소한 다음, 실제로 푸시/태그/릴리즈를 수행하는 release 잡의 job-level
permissions에만 "contents: write"를 명시해 주세요; prepare 잡과 다른 사전/후속 잡들은 전역 축소된 권한을 그대로
사용하도록 하며 prepare 잡은 필요한 경우에만 package.json과 이벤트 payload를 읽을 수 있게 읽기 권한만 유지하도록
변경하세요 (참조: top-level permissions 설정과 prepare job 및 release job 이름).
- Line 44: Replace movable action refs with immutable commit SHAs: for each
listed site, replace the current uses value with the corresponding repository
commit SHA for that tag (e.g. change actions/checkout@v4 to
actions/checkout@<commit-sha>); specifically update
.github/workflows/release.yaml lines 44,50,107,112,154,179,196,210 to pin
actions/checkout@v4, actions/github-script@v7, actions/checkout@v4,
actions/setup-node@v4, actions/github-script@v7, softprops/action-gh-release@v2,
mnao305/chrome-extension-upload@v5.0.0, and actions/github-script@v7
respectively to their verified commit SHAs, and update
.github/workflows/discord-notify.yml line 25, plus the sibling sites in the
consolidated list (.github/workflows/pr-checks.yml lines 23,42,45;
.github/workflows/issue-dedup.yml line 19; .github/workflows/deploy-docs.yml
lines 24,28,33,39,49) to their respective immutable commit SHAs; fetch each SHA
from the action repo (or a trusted source), replace the `@tag` with @<sha>, and
ensure CI runs succeed.
- Around line 68-71: The workflow currently accepts
context.payload.client_payload.channel and .bump without validation (variables
channel and bump) and then uses channel as the environment; add whitelist
validation in the prepare step to allow only channel ∈ {stable, beta} and bump ∈
{patch, minor, major}, and immediately fail the job if values are outside those
sets (e.g., emit an error and exit non‑zero or call the appropriate GH Actions
fail mechanism), ensuring the validated values (not raw inputs) are emitted via
needs.prepare.outputs.channel/bump for downstream jobs to consume.
---
Nitpick comments:
In @.github/workflows/pr-checks.yml:
- Around line 38-39: The verify job is running in parallel with issue-link; add
a dependency so verify waits for issue-link by adding needs: [issue-link] to the
verify job definition (referencing the job name "verify" and the dependency job
"issue-link") so the CI enforces the "issue-first" policy and avoids wasted
runs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: a58a9259-fc69-43ed-9eb8-d4b73c0135f4
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json,!package-lock.json
📒 Files selected for processing (80)
.coderabbit.yaml.gitattributes.github/ISSUE_TEMPLATE/bug_report.yml.github/ISSUE_TEMPLATE/config.yml.github/ISSUE_TEMPLATE/feature_request.yml.github/workflows/discord-notify.yml.github/workflows/issue-dedup.yml.github/workflows/pr-checks.yml.github/workflows/release.yaml.github/workflows/versioning.yaml.husky/commit-msg.husky/pre-commitcommitlint.config.jsdocs/.vitepress/config.tsdocs/.vitepress/theme/AnnouncementBar.vuedocs/en/guide/advanced.mddocs/en/guide/basic.mddocs/en/guide/calendar.mddocs/en/guide/notice.mddocs/guide/advanced.mddocs/guide/notice.mddocs/ja/guide/advanced.mddocs/ja/guide/basic.mddocs/ja/guide/calendar.mddocs/ja/guide/notice.mddocs/public/google50ccec79ebc1bb24.htmldocs/zh/guide/advanced.mddocs/zh/guide/basic.mddocs/zh/guide/calendar.mddocs/zh/guide/notice.mdeslint.config.jsmanifest.config.tspackage.jsonpostcss.config.jssrc/__tests__/badge.test.tssrc/__tests__/currentWeek.test.tssrc/__tests__/filterData.test.tssrc/__tests__/generateKey.test.tssrc/__tests__/lmsKeywords.test.tssrc/__tests__/stringUtils.test.tssrc/__tests__/summarizeCourseData.test.tssrc/__tests__/transformCalendarEvents.test.tssrc/__tests__/transformCourseData.test.tssrc/components/ui/border-trail.tsxsrc/components/ui/card.tsxsrc/components/ui/context-menu.tsxsrc/components/ui/dropdown-menu.tsxsrc/components/ui/label.tsxsrc/hooks/use-mobile.tsxsrc/hooks/useCalendarEvents.tssrc/hooks/useCardData.tssrc/hooks/useCourseData.tsxsrc/hooks/useGetCourses.tssrc/hooks/useHiddenTasks.tssrc/lib/calendarUtils.tssrc/lib/courseStatus/badge.tssrc/lib/courseStatus/currentWeek.tssrc/lib/courseStatus/storage.tssrc/lib/dateUtils.tssrc/lib/deduplicateInto.tssrc/lib/fetchAssign.tssrc/lib/fetchCourseData.tssrc/lib/fetchQuiz.tssrc/lib/fetchVodAttendance.tssrc/lib/fetchVodProgress.tssrc/lib/injectCourseToggles.tssrc/lib/logger.tssrc/lib/parseCourses.tssrc/lib/stringUtils.tssrc/lib/transformCalendarEvents.tssrc/lib/transformCourseData.tssrc/mocks/loadMockData.tssrc/popover/dashboard/Dashboard.tsxsrc/popover/dashboard/components/DashboardHeader.tsxsrc/popover/dashboard/components/DueDateList.tsxsrc/popover/dashboard/components/VodList.tsxsrc/popover/player/components/PlayerIframe.tsxsrc/popover/player/components/PlayerPopoverContent.tsxsrc/popover/player/components/SortableItem.tsxsrc/styles/shadow.css
💤 Files with no reviewable changes (2)
- .github/workflows/versioning.yaml
- src/mocks/loadMockData.ts
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release.yaml (1)
106-113:⚠️ Potential issue | 🟡 Minor | ⚡ Quick win
persist-credentials: false를 설정하세요.RELEASE_TOKEN(PAT)을 사용할 때 기본값
persist-credentials: true로 인해 토큰이.git/config에 저장됩니다. 이후 단계나 액션에서 의도치 않게 자격 증명에 접근하거나, 아티팩트에.git디렉토리가 포함될 경우 토큰 노출 위험이 있습니다.수정 제안
- name: 리포지토리 체크아웃 uses: actions/checkout@v4 with: fetch-depth: 0 + persist-credentials: false # main 브랜치 보호를 우회해 버전 범프 커밋을 push 하려면 # 관리자 권한 PAT(RELEASE_TOKEN)이 필요하다. 미설정 시 기본 토큰으로 # 동작하지만 보호된 main push는 거부된다. token: ${{ secrets.RELEASE_TOKEN || github.token }}참고:
persist-credentials: false설정 시 이후git push명령에서 토큰을 명시적으로 사용해야 합니다. 현재 워크플로에서는git push origin main --follow-tags가 토큰 없이 실행되므로, remote URL에 토큰을 주입하거나 Git credential helper를 설정해야 합니다:git remote set-url origin "https://x-access-token:${{ secrets.RELEASE_TOKEN || github.token }}`@github.com/`${{ github.repository }}" git push origin main --follow-tags🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release.yaml around lines 106 - 113, Set the actions/checkout@v4 step to persist-credentials: false to avoid storing RELEASE_TOKEN in .git/config; then update the step that runs git push origin main --follow-tags to supply credentials explicitly (e.g., set the remote URL to include x-access-token:${{ secrets.RELEASE_TOKEN || github.token }} or configure a Git credential helper) so pushes still authenticate without persisting the token. Ensure the change targets the actions/checkout@v4 block (add persist-credentials: false) and the job/step that executes git push origin main --follow-tags (inject token into remote or credential helper).Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/release.yaml:
- Around line 106-113: Set the actions/checkout@v4 step to persist-credentials:
false to avoid storing RELEASE_TOKEN in .git/config; then update the step that
runs git push origin main --follow-tags to supply credentials explicitly (e.g.,
set the remote URL to include x-access-token:${{ secrets.RELEASE_TOKEN ||
github.token }} or configure a Git credential helper) so pushes still
authenticate without persisting the token. Ensure the change targets the
actions/checkout@v4 block (add persist-credentials: false) and the job/step that
executes git push origin main --follow-tags (inject token into remote or
credential helper).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 7d147b7f-d2fc-48d0-825e-1153c7bb11f0
📒 Files selected for processing (1)
.github/workflows/release.yaml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yaml:
- Around line 117-121: The checkout step using actions/checkout@v4 currently
omits persist-credentials and leaves the app token in the runner; update the
checkout step (the GitHub Action block that names "리포지토리 체크아웃" and uses
actions/checkout@v4) to include persist-credentials: false under its with:
section (alongside fetch-depth and token) so credentials are not persisted to
.git/config after checkout.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 110794c8-c9f9-4141-8bbc-68d6c4f75225
📒 Files selected for processing (1)
.github/workflows/release.yaml
6-keem
force-pushed
the
chore/oss-setup
branch
2 times, most recently
from
June 13, 2026 15:44
cf384bc to
4ef09cd
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/pr-checks.yml (1)
38-39: ⚡ Quick win이슈 참조 검증 실패 시에도 검증 잡이 계속 돌아 CI 리소스를 낭비합니다.
Line 38의
verify잡에needs: issue-link를 걸어 실패-조기종료 흐름으로 묶는 게 좋겠습니다.패치 제안
verify: + needs: issue-link runs-on: ubuntu-latest steps:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-checks.yml around lines 38 - 39, Add a dependency on the issue-link job to prevent wasteful runs: modify the verify job declaration (job name "verify") to include needs: ["issue-link"] so the verify job will be skipped/short-circuited when the issue-link job fails; ensure the YAML uses the correct indentation and array form for the needs field.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/issue-dedup.yml:
- Around line 80-82: The strict comparison in the duplicates filter can miss
matches when the model returns "number" as a string; update the filter that
assigns duplicates (the expression building duplicates from
JSON.parse(content).duplicates and candidates) to normalize types before
comparing — e.g., coerce both d.number and c.number to the same type
(Number(...) or String(...)) or parseInt/parseFloat as appropriate — so
candidates.some((c) => normalize(d.number) === normalize(c.number)) instead of
direct ===, ensuring NaN and null cases are handled consistently.
In `@CONTRIBUTING.md`:
- Line 39: 행 39의 코드 펜스에 언어 식별자가 누락되어 MD040 린트 경고가 발생하므로 해당 코드 블록의 여는 ```을
```text로 변경하고 제안된 예시 내용을 넣어 코드 블록이 텍스트 형식임을 명시하세요; 구체적으로 CONTRIBUTING.md의 해당 블록을
아래 패치 제안과 동일하게 +```text / <type>: <설명> / (예시) feat: 과제 마감 D-day 알림 추가 / fix: VOD
출석 파싱 오류 수정 / docs: 기여 가이드 추가 / ``` 형태로 업데이트하면 경고가 해소됩니다.
---
Nitpick comments:
In @.github/workflows/pr-checks.yml:
- Around line 38-39: Add a dependency on the issue-link job to prevent wasteful
runs: modify the verify job declaration (job name "verify") to include needs:
["issue-link"] so the verify job will be skipped/short-circuited when the
issue-link job fails; ensure the YAML uses the correct indentation and array
form for the needs field.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: fc89d4c6-5454-4f6b-824b-9eeadf48469c
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json,!package-lock.json
📒 Files selected for processing (84)
.coderabbit.yaml.gitattributes.github/ISSUE_TEMPLATE/bug_report.yml.github/ISSUE_TEMPLATE/config.yml.github/ISSUE_TEMPLATE/feature_request.yml.github/PULL_REQUEST_TEMPLATE.md.github/workflows/discord-notify.yml.github/workflows/issue-dedup.yml.github/workflows/pr-checks.yml.github/workflows/release.yaml.github/workflows/versioning.yaml.husky/commit-msg.husky/pre-commitCLAUDE.mdCODE_OF_CONDUCT.mdCONTRIBUTING.mdcommitlint.config.jsdocs/.vitepress/config.tsdocs/.vitepress/theme/AnnouncementBar.vuedocs/en/guide/advanced.mddocs/en/guide/basic.mddocs/en/guide/calendar.mddocs/en/guide/notice.mddocs/guide/advanced.mddocs/guide/notice.mddocs/ja/guide/advanced.mddocs/ja/guide/basic.mddocs/ja/guide/calendar.mddocs/ja/guide/notice.mddocs/public/google50ccec79ebc1bb24.htmldocs/zh/guide/advanced.mddocs/zh/guide/basic.mddocs/zh/guide/calendar.mddocs/zh/guide/notice.mdeslint.config.jsmanifest.config.tspackage.jsonpostcss.config.jssrc/__tests__/badge.test.tssrc/__tests__/currentWeek.test.tssrc/__tests__/filterData.test.tssrc/__tests__/generateKey.test.tssrc/__tests__/lmsKeywords.test.tssrc/__tests__/stringUtils.test.tssrc/__tests__/summarizeCourseData.test.tssrc/__tests__/transformCalendarEvents.test.tssrc/__tests__/transformCourseData.test.tssrc/components/ui/border-trail.tsxsrc/components/ui/card.tsxsrc/components/ui/context-menu.tsxsrc/components/ui/dropdown-menu.tsxsrc/components/ui/label.tsxsrc/hooks/use-mobile.tsxsrc/hooks/useCalendarEvents.tssrc/hooks/useCardData.tssrc/hooks/useCourseData.tsxsrc/hooks/useGetCourses.tssrc/hooks/useHiddenTasks.tssrc/lib/calendarUtils.tssrc/lib/courseStatus/badge.tssrc/lib/courseStatus/currentWeek.tssrc/lib/courseStatus/storage.tssrc/lib/dateUtils.tssrc/lib/deduplicateInto.tssrc/lib/fetchAssign.tssrc/lib/fetchCourseData.tssrc/lib/fetchQuiz.tssrc/lib/fetchVodAttendance.tssrc/lib/fetchVodProgress.tssrc/lib/injectCourseToggles.tssrc/lib/logger.tssrc/lib/parseCourses.tssrc/lib/stringUtils.tssrc/lib/transformCalendarEvents.tssrc/lib/transformCourseData.tssrc/mocks/loadMockData.tssrc/popover/dashboard/Dashboard.tsxsrc/popover/dashboard/components/DashboardHeader.tsxsrc/popover/dashboard/components/DueDateList.tsxsrc/popover/dashboard/components/VodList.tsxsrc/popover/player/components/PlayerIframe.tsxsrc/popover/player/components/PlayerPopoverContent.tsxsrc/popover/player/components/SortableItem.tsxsrc/styles/shadow.css
💤 Files with no reviewable changes (2)
- src/mocks/loadMockData.ts
- .github/workflows/versioning.yaml
✅ Files skipped from review due to trivial changes (67)
- .github/ISSUE_TEMPLATE/config.yml
- .github/ISSUE_TEMPLATE/feature_request.yml
- src/lib/fetchAssign.ts
- CLAUDE.md
- src/popover/dashboard/components/VodList.tsx
- src/tests/currentWeek.test.ts
- eslint.config.js
- postcss.config.js
- src/hooks/useHiddenTasks.ts
- docs/zh/guide/basic.md
- CODE_OF_CONDUCT.md
- .github/PULL_REQUEST_TEMPLATE.md
- docs/zh/guide/notice.md
- docs/ja/guide/basic.md
- src/popover/player/components/SortableItem.tsx
- src/tests/badge.test.ts
- docs/zh/guide/calendar.md
- docs/ja/guide/notice.md
- src/tests/lmsKeywords.test.ts
- docs/en/guide/notice.md
- src/lib/parseCourses.ts
- src/lib/courseStatus/currentWeek.ts
- src/lib/logger.ts
- src/tests/stringUtils.test.ts
- src/tests/generateKey.test.ts
- .gitattributes
- src/lib/transformCalendarEvents.ts
- src/lib/fetchCourseData.ts
- src/popover/dashboard/components/DashboardHeader.tsx
- src/tests/transformCalendarEvents.test.ts
- docs/guide/notice.md
- docs/ja/guide/advanced.md
- docs/ja/guide/calendar.md
- docs/en/guide/advanced.md
- src/lib/transformCourseData.ts
- src/components/ui/label.tsx
- src/hooks/use-mobile.tsx
- src/popover/player/components/PlayerIframe.tsx
- src/popover/dashboard/Dashboard.tsx
- src/hooks/useGetCourses.ts
- src/popover/dashboard/components/DueDateList.tsx
- src/lib/stringUtils.ts
- src/lib/fetchVodProgress.ts
- src/styles/shadow.css
- docs/en/guide/basic.md
- src/lib/courseStatus/storage.ts
- docs/en/guide/calendar.md
- src/components/ui/card.tsx
- src/lib/courseStatus/badge.ts
- src/lib/dateUtils.ts
- docs/.vitepress/theme/AnnouncementBar.vue
- src/lib/calendarUtils.ts
- docs/guide/advanced.md
- docs/zh/guide/advanced.md
- src/popover/player/components/PlayerPopoverContent.tsx
- src/components/ui/border-trail.tsx
- src/lib/deduplicateInto.ts
- .github/ISSUE_TEMPLATE/bug_report.yml
- src/components/ui/dropdown-menu.tsx
- src/hooks/useCourseData.tsx
- src/lib/injectCourseToggles.ts
- src/tests/filterData.test.ts
- src/lib/fetchQuiz.ts
- src/tests/summarizeCourseData.test.ts
- src/components/ui/context-menu.tsx
- src/lib/fetchVodAttendance.ts
- src/tests/transformCourseData.test.ts
🚧 Files skipped from review as they are similar to previous changes (9)
- commitlint.config.js
- .husky/commit-msg
- src/hooks/useCalendarEvents.ts
- .husky/pre-commit
- .coderabbit.yaml
- manifest.config.ts
- package.json
- docs/.vitepress/config.ts
- src/hooks/useCardData.ts
6-keem
force-pushed
the
chore/oss-setup
branch
3 times, most recently
from
June 13, 2026 15:57
d3348a7 to
1604d6e
Compare
- prettier --write 로 미준수 파일 전체 정규화 - 미사용 catch 변수 제거(no-unused-vars), eslint 생성물 ignore 추가 - .gitattributes 로 텍스트 LF 고정
- 이슈(버그/기능 YAML)·PR 템플릿(이슈 참조 필수), config.yml 중복 검색 안내 - CONTRIBUTING / CODE_OF_CONDUCT (코드펜스 언어 명시) - .gitignore: 모든 마크다운을 막던 *.md 규칙 제거 (문서 추적 가능하도록) - husky + lint-staged + commitlint(Conventional Commits) - CodeRabbit 설정(.coderabbit.yaml): 최초 자동 리뷰, 이후 재리뷰는 수동
- pr-checks: lint/prettier/build/test + 이슈 참조 가드(verify→issue-link 의존) - release: 승인 게이트(Environment), beta/stable prerelease 분기, GitHub App 단기 토큰 push(SHA 핀), Chrome 스토어 게시 기반(비활성) - discord-notify / issue-dedup(GitHub Models) / pr-autolabel - manifest 베타 채널 이름 분기, CLAUDE.md 갱신 보안 강화(CodeRabbit 리뷰 반영): - 모든 액션 커밋 SHA 핀 고정 (공급망 리스크) - repository_dispatch channel/bump 화이트리스트 검증 (승인 게이트 우회 차단) - contents:write를 release job으로 한정, checkout persist-credentials:false - release run 직렬화(concurrency)로 동시 머지 버전 충돌 방지 - run 스텝의 변수는 env로 전달 (스크립트 인젝션 방지)
Member
Author
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-autolabel.yml:
- Around line 46-61: The removal loop is running even when target is undefined,
causing MANAGED labels to be deleted despite the "라벨 변경 없음" message; modify the
code that iterates currentNames (the for (const name of currentNames) { ... }
block that calls github.rest.issues.removeLabel) so it only runs when target is
truthy—either move that loop to after the existing if (!target) {
core.info(...); return; } check or wrap the loop in if (target) { ... }—keeping
the core.info message and early return behavior unchanged.
In @.github/workflows/release.yaml:
- Around line 12-23: The workflow allows workflow_dispatch from any ref and
checks out an unconstrained ref, so running it from a non-main branch with
channel=stable can push that branch into main; fix by restricting triggers and
checkout/push behavior: add a branches restriction under on.workflow_dispatch to
only allow main, change the actions/checkout step to pin the checked-out ref to
the triggering commit (use github.sha or github.ref instead of an unconstrained
ref), and update the "변경사항 커밋 및 태그 (stable)" step to only run git push "$REMOTE"
HEAD:main when the workflow is actually running on main (e.g., guard with if:
github.ref == 'refs/heads/main' or use needs.prepare.outputs.channel == 'stable'
&& github.ref == 'refs/heads/main'), so non-main manual runs cannot update main;
also consider making stable push logic require an explicit confirmation input if
you want manual cross-branch runs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: c5630783-efa3-48da-a71f-a72dbc60347d
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json,!package-lock.json
📒 Files selected for processing (87)
.coderabbit.yaml.gitattributes.github/ISSUE_TEMPLATE/bug_report.yml.github/ISSUE_TEMPLATE/config.yml.github/ISSUE_TEMPLATE/feature_request.yml.github/PULL_REQUEST_TEMPLATE.md.github/workflows/deploy-docs.yml.github/workflows/discord-notify.yml.github/workflows/issue-dedup.yml.github/workflows/pr-autolabel.yml.github/workflows/pr-checks.yml.github/workflows/release.yaml.github/workflows/versioning.yaml.gitignore.husky/commit-msg.husky/pre-commitCLAUDE.mdCODE_OF_CONDUCT.mdCONTRIBUTING.mdcommitlint.config.jsdocs/.vitepress/config.tsdocs/.vitepress/theme/AnnouncementBar.vuedocs/en/guide/advanced.mddocs/en/guide/basic.mddocs/en/guide/calendar.mddocs/en/guide/notice.mddocs/guide/advanced.mddocs/guide/notice.mddocs/ja/guide/advanced.mddocs/ja/guide/basic.mddocs/ja/guide/calendar.mddocs/ja/guide/notice.mddocs/public/google50ccec79ebc1bb24.htmldocs/zh/guide/advanced.mddocs/zh/guide/basic.mddocs/zh/guide/calendar.mddocs/zh/guide/notice.mdeslint.config.jsmanifest.config.tspackage.jsonpostcss.config.jssrc/__tests__/badge.test.tssrc/__tests__/currentWeek.test.tssrc/__tests__/filterData.test.tssrc/__tests__/generateKey.test.tssrc/__tests__/lmsKeywords.test.tssrc/__tests__/stringUtils.test.tssrc/__tests__/summarizeCourseData.test.tssrc/__tests__/transformCalendarEvents.test.tssrc/__tests__/transformCourseData.test.tssrc/components/ui/border-trail.tsxsrc/components/ui/card.tsxsrc/components/ui/context-menu.tsxsrc/components/ui/dropdown-menu.tsxsrc/components/ui/label.tsxsrc/hooks/use-mobile.tsxsrc/hooks/useCalendarEvents.tssrc/hooks/useCardData.tssrc/hooks/useCourseData.tsxsrc/hooks/useGetCourses.tssrc/hooks/useHiddenTasks.tssrc/lib/calendarUtils.tssrc/lib/courseStatus/badge.tssrc/lib/courseStatus/currentWeek.tssrc/lib/courseStatus/storage.tssrc/lib/dateUtils.tssrc/lib/deduplicateInto.tssrc/lib/fetchAssign.tssrc/lib/fetchCourseData.tssrc/lib/fetchQuiz.tssrc/lib/fetchVodAttendance.tssrc/lib/fetchVodProgress.tssrc/lib/injectCourseToggles.tssrc/lib/logger.tssrc/lib/parseCourses.tssrc/lib/stringUtils.tssrc/lib/transformCalendarEvents.tssrc/lib/transformCourseData.tssrc/mocks/loadMockData.tssrc/popover/dashboard/Dashboard.tsxsrc/popover/dashboard/components/DashboardHeader.tsxsrc/popover/dashboard/components/DueDateList.tsxsrc/popover/dashboard/components/VodList.tsxsrc/popover/player/components/PlayerIframe.tsxsrc/popover/player/components/PlayerPopoverContent.tsxsrc/popover/player/components/SortableItem.tsxsrc/styles/shadow.css
💤 Files with no reviewable changes (3)
- src/mocks/loadMockData.ts
- .gitignore
- .github/workflows/versioning.yaml
✅ Files skipped from review due to trivial changes (63)
- .husky/pre-commit
- eslint.config.js
- src/popover/player/components/SortableItem.tsx
- src/lib/transformCalendarEvents.ts
- src/lib/fetchAssign.ts
- src/lib/fetchVodProgress.ts
- commitlint.config.js
- docs/guide/notice.md
- docs/zh/guide/basic.md
- docs/ja/guide/basic.md
- .github/ISSUE_TEMPLATE/feature_request.yml
- src/lib/dateUtils.ts
- src/popover/dashboard/Dashboard.tsx
- .coderabbit.yaml
- .gitattributes
- docs/en/guide/advanced.md
- src/lib/stringUtils.ts
- src/popover/dashboard/components/DashboardHeader.tsx
- src/tests/generateKey.test.ts
- src/lib/deduplicateInto.ts
- .github/ISSUE_TEMPLATE/config.yml
- docs/en/guide/calendar.md
- docs/ja/guide/calendar.md
- src/lib/courseStatus/storage.ts
- docs/.vitepress/theme/AnnouncementBar.vue
- .github/PULL_REQUEST_TEMPLATE.md
- src/hooks/useHiddenTasks.ts
- docs/en/guide/notice.md
- src/components/ui/label.tsx
- docs/guide/advanced.md
- src/tests/badge.test.ts
- src/popover/player/components/PlayerIframe.tsx
- docs/ja/guide/notice.md
- src/styles/shadow.css
- docs/zh/guide/notice.md
- postcss.config.js
- src/lib/parseCourses.ts
- src/lib/courseStatus/badge.ts
- src/lib/courseStatus/currentWeek.ts
- src/tests/transformCalendarEvents.test.ts
- docs/en/guide/basic.md
- docs/zh/guide/advanced.md
- src/components/ui/border-trail.tsx
- src/hooks/useCardData.ts
- src/lib/logger.ts
- src/tests/currentWeek.test.ts
- src/popover/dashboard/components/VodList.tsx
- src/tests/lmsKeywords.test.ts
- src/lib/fetchCourseData.ts
- src/hooks/useGetCourses.ts
- src/tests/summarizeCourseData.test.ts
- docs/ja/guide/advanced.md
- CONTRIBUTING.md
- src/popover/player/components/PlayerPopoverContent.tsx
- src/components/ui/card.tsx
- src/hooks/useCourseData.tsx
- src/lib/calendarUtils.ts
- src/tests/filterData.test.ts
- src/lib/fetchQuiz.ts
- src/components/ui/context-menu.tsx
- src/tests/transformCourseData.test.ts
- src/lib/injectCourseToggles.ts
- src/components/ui/dropdown-menu.tsx
🚧 Files skipped from review as they are similar to previous changes (14)
- docs/zh/guide/calendar.md
- .husky/commit-msg
- CODE_OF_CONDUCT.md
- src/tests/stringUtils.test.ts
- src/lib/fetchVodAttendance.ts
- .github/ISSUE_TEMPLATE/bug_report.yml
- src/lib/transformCourseData.ts
- src/hooks/useCalendarEvents.ts
- manifest.config.ts
- docs/.vitepress/config.ts
- .github/workflows/pr-checks.yml
- package.json
- .github/workflows/issue-dedup.yml
- src/hooks/use-mobile.tsx
3 tasks
This was referenced Jun 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #85
변경 내용
오픈소스 운영을 위한 기반 인프라 일괄 구축.
변경 유형
chore,ci)체크리스트
npm run lint/npm run build/npm run test통과Summary by CodeRabbit
Chores
Documentation
Style