Conversation
Available PR Commands
See: https://github.com/tahminator/codebloom/wiki/CI-Commands |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - name: Post /review command | ||
| uses: ./.github/composite/send-message | ||
| with: | ||
| prId: ${{ github.event.prId || github.event.pull_request.number }} | ||
| message: "/review" | ||
| token: ${{ env.GH_PAT }} | ||
|
|
||
| - name: Post /describe command |
Check failure
Code scanning / CodeQL
Checkout of untrusted code in a privileged context Critical
| - name: Post /describe command | ||
| uses: ./.github/composite/send-message | ||
| with: | ||
| prId: ${{ github.event.prId || github.event.pull_request.number }} | ||
| message: "/describe" | ||
| token: ${{ env.GH_PAT }} | ||
|
|
||
| - name: Post /improve command |
Check failure
Code scanning / CodeQL
Checkout of untrusted code in a privileged context Critical
|
/review |
|
/describe |
|
/improve |
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
|
Preparing PR description... |
PR Reviewer Guide 🔍Here are some key observations to aid the review process:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| - name: Post /review command | ||
| uses: ./.github/composite/send-message | ||
| with: | ||
| prId: ${{ github.event.prId || github.event.pull_request.number }} | ||
| message: "/review" | ||
| token: ${{ env.GH_PAT }} |
There was a problem hiding this comment.
Suggestion: The newly added steps, including Post /review command and similar steps for /describe and /improve, are configured to run unconditionally on all pull_request and issue_comment events. This will lead to repetitive and excessive comment spam on the PR. These steps should be made conditional to execute only when explicitly intended, such as when triggered by workflow_dispatch or a specific slash command. [possible issue, importance: 9]
| - name: Post /review command | |
| uses: ./.github/composite/send-message | |
| with: | |
| prId: ${{ github.event.prId || github.event.pull_request.number }} | |
| message: "/review" | |
| token: ${{ env.GH_PAT }} | |
| - name: Post /review command | |
| if: github.event_name == 'workflow_dispatch' # Or other specific conditions | |
| uses: ./.github/composite/send-message | |
| with: | |
| prId: ${{ github.event.prId || github.event.pull_request.number }} | |
| message: "/review" | |
| token: ${{ env.GH_PAT }} |
| prId: | ||
| description: "PR to deploy" | ||
| required: false |
There was a problem hiding this comment.
Suggestion: The prId input for workflow_dispatch is marked as required: false. If the workflow is manually dispatched without providing a prId, the send-message action's prId parameter will resolve to an empty value, as github.event.pull_request.number is not available for workflow_dispatch events. This could lead to the action failing or targeting an incorrect PR. Consider making prId required: true for workflow_dispatch to ensure a valid PR context. [possible issue, importance: 8]
| prId: | |
| description: "PR to deploy" | |
| required: false | |
| prId: | |
| description: "PR to deploy" | |
| required: true |
| - name: Post /review command | ||
| uses: ./.github/composite/send-message | ||
| with: | ||
| prId: ${{ github.event.prId || github.event.pull_request.number }} | ||
| message: "/review" | ||
| token: ${{ env.GH_PAT }} | ||
|
|
||
| - name: Post /describe command | ||
| uses: ./.github/composite/send-message | ||
| with: | ||
| prId: ${{ github.event.prId || github.event.pull_request.number }} | ||
| message: "/describe" | ||
| token: ${{ env.GH_PAT }} | ||
|
|
||
| - name: Post /improve command | ||
| uses: ./.github/composite/send-message | ||
| with: | ||
| prId: ${{ github.event.prId || github.event.pull_request.number }} | ||
| message: "/improve" | ||
| token: ${{ env.GH_PAT }} |
There was a problem hiding this comment.
Suggestion: The new steps that post /review, /describe, and /improve commands are likely to create an infinite loop if the send-message composite action posts comments to the PR, as this workflow is also triggered by issue_comment events. Additionally, allowing any issue_comment to trigger these steps using a GH_PAT could lead to abuse. To prevent both issues, these steps should only execute when explicitly triggered by workflow_dispatch or by a trusted user's issue_comment, and not by the bot itself. [possible issue, importance: 10]
| - name: Post /review command | |
| uses: ./.github/composite/send-message | |
| with: | |
| prId: ${{ github.event.prId || github.event.pull_request.number }} | |
| message: "/review" | |
| token: ${{ env.GH_PAT }} | |
| - name: Post /describe command | |
| uses: ./.github/composite/send-message | |
| with: | |
| prId: ${{ github.event.prId || github.event.pull_request.number }} | |
| message: "/describe" | |
| token: ${{ env.GH_PAT }} | |
| - name: Post /improve command | |
| uses: ./.github/composite/send-message | |
| with: | |
| prId: ${{ github.event.prId || github.event.pull_request.number }} | |
| message: "/improve" | |
| token: ${{ env.GH_PAT }} | |
| - name: Post /review command | |
| if: github.event_name == 'workflow_dispatch' || (github.event_name == 'issue_comment' && github.event.comment.author_association == 'MEMBER' && github.actor != 'github-actions[bot]') | |
| uses: ./.github/composite/send-message | |
| with: | |
| prId: ${{ github.event.inputs.prId || github.event.pull_request.number }} | |
| message: "/review" | |
| token: ${{ env.GH_PAT }} | |
| - name: Post /describe command | |
| if: github.event_name == 'workflow_dispatch' || (github.event_name == 'issue_comment' && github.event.comment.author_association == 'MEMBER' && github.actor != 'github-actions[bot]') | |
| uses: ./.github/composite/send-message | |
| with: | |
| prId: ${{ github.event.inputs.prId || github.event.pull_request.number }} | |
| message: "/describe" | |
| token: ${{ env.GH_PAT }} | |
| - name: Post /improve command | |
| if: github.event_name == 'workflow_dispatch' || (github.event_name == 'issue_comment' && github.event.comment.author_association == 'MEMBER' && github.actor != 'github-actions[bot]') | |
| uses: ./.github/composite/send-message | |
| with: | |
| prId: ${{ github.event.inputs.prId || github.event.pull_request.number }} | |
| message: "/improve" | |
| token: ${{ env.GH_PAT }} |
| workflow_dispatch: | ||
| inputs: | ||
| prId: | ||
| description: "PR to deploy" | ||
| required: false | ||
| repository: | ||
| description: "The repository from which the slash command was dispatched" | ||
| required: false | ||
| comment-id: | ||
| description: "The comment-id of the slash command" | ||
| required: false | ||
| author: | ||
| description: "The author that triggered this actions" | ||
| required: false |
There was a problem hiding this comment.
Suggestion: The workflow_dispatch inputs repository, comment-id, and author are defined but not utilized in the newly added steps. If these inputs are not intended for use by the send-message composite action or other parts of this workflow, they should be removed to maintain clarity and avoid unnecessary complexity. [general, importance: 5]
| workflow_dispatch: | |
| inputs: | |
| prId: | |
| description: "PR to deploy" | |
| required: false | |
| repository: | |
| description: "The repository from which the slash command was dispatched" | |
| required: false | |
| comment-id: | |
| description: "The comment-id of the slash command" | |
| required: false | |
| author: | |
| description: "The author that triggered this actions" | |
| required: false | |
| workflow_dispatch: | |
| inputs: | |
| prId: | |
| description: "PR to deploy" | |
| required: false |
2 participants
801
Description of changes
Checklist before review
Screenshots
Dev
Staging