Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -78,14 +78,15 @@ jobs:
WITH_RSDOCTOR=1 pnpm turbo run build --filter="./packages/*"

- name: πŸ“Š Analyze bundle differences
uses: ./internals/bundle-analysis-action
uses: consentdotio/github-actions/bundle-analysis-action@main
with:
base_dir: .bundle-base
current_dir: .
github_token: ${{ secrets.GITHUB_TOKEN }}
pr_number: ${{ github.event.pull_request.number }}
skip_comment: false
fail_on_increase: false
header: "bundle-analysis"
Comment on lines +81 to +89
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟑 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash

echo "=== Fetching action.yml from consentdotio/github-actions/bundle-analysis-action ==="
curl -s https://raw.githubusercontent.com/consentdotio/github-actions/main/bundle-analysis-action/action.yml

echo ""
echo "=== Checking for available releases/tags ==="
gh api repos/consentdotio/github-actions/releases --paginate --jq '.[] | {tag_name, published_at}' 2>/dev/null | head -20 || echo "Could not fetch releases via gh cli"

echo ""
echo "=== Trying alternative: fetch releases via curl ==="
curl -s https://api.github.com/repos/consentdotio/github-actions/releases | jq -r '.[] | "\(.tag_name) - \(.published_at)"' 2>/dev/null | head -10

Repository: consentdotio/runners

Length of output: 3323


Pin the remote action to a specific commit SHA; the header parameter is valid.

The header: "bundle-analysis" input is correctly specifiedβ€”it's a documented, optional input parameter with that exact default value. However, the action reference using @main remains a concern. The action repository has no published releases or tags, making SHA pinning the only way to ensure reproducible deployments and prevent unexpected breakage from main branch changes. Pin to a specific commit (e.g., consentdotio/github-actions/bundle-analysis-action@<commit-sha>).

πŸ€– Prompt for AI Agents
.github/workflows/analysis-bundle.yml lines 81-89: the workflow currently
references consentdotio/github-actions/bundle-analysis-action@main which should
be pinned to a specific commit SHA for reproducible runs; replace the @main ref
with the repository commit SHA (e.g.,
consentdotio/github-actions/bundle-analysis-action@<commit-sha>) by finding the
desired commit in that repo and updating the workflow file, then commit the
change so the action runs against the exact pinned commit; leave the header
input as-is.


- name: πŸ“€ Upload bundle diff report
if: always()
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,9 @@ jobs:
- name: ✨ Format code
run: pnpm fmt

- name: πŸ“š Format Documentation
run: pnpm fmt:docs

- name: πŸ“¦ Format package.json
run: npx --yes sort-package-json "package.json" "packages/*/package.json"

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ jobs:
run: pnpm install --frozen-lockfile

- name: πŸ‘€ Type Check
run: pnpm turbo run check-types
run: pnpm turbo run typecheck

- name: 🧹 Run Biome with Reviewdog
uses: mongolyy/reviewdog-action-biome@v2.1.0
Expand Down
78 changes: 0 additions & 78 deletions .github/workflows/deploy-docs-main.yml

This file was deleted.

132 changes: 132 additions & 0 deletions .github/workflows/deploy-docs-reusable.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,132 @@
name: Reusable Deploy Docs

on:
workflow_call:
inputs:
ref:
description: "Git ref to checkout"
required: false
type: string
target:
description: "Deployment target (production/staging)"
required: false
type: string
header:
description: "Comment header identifier"
required: true
type: string
assign_alias_on_branch:
description: "Branch to assign alias on"
required: false
type: string
alias_domains:
description: "Alias domains (newline-separated)"
required: false
type: string
deploy_on_push_branches:
description: "Branches to deploy on push"
required: false
type: string
deploy_on_pr_base_branches:
description: "PR base branches to deploy previews"
required: false
type: string
only_if_changed:
description: "Only deploy if changed"
required: false
type: string
default: "false"
change_globs:
description: "Change detection globs (newline-separated)"
required: false
type: string
check_template_changes:
description: "Check template changes"
required: false
type: string
default: "false"
secrets:
CONSENT_APP_ID:
required: true
CONSENT_APP_PRIVATE_KEY:
required: true
VERCEL_TOKEN:
required: true
VERCEL_PROJECT_ID:
required: true
VERCEL_ORG_ID:
required: true
CONSENT_GIT_TOKEN:
required: true

permissions:
contents: read
issues: write
pull-requests: write
deployments: write

jobs:
deploy:
runs-on: ubuntu-latest
steps:
- name: πŸ“₯ Checkout repository
uses: actions/checkout@v4
with:
ref: ${{ inputs.ref }}
fetch-depth: 0

# πŸ“¦ Setup pnpm (used by docs template/scripts)
- name: πŸ“¦ Setup pnpm
uses: pnpm/action-setup@v4
with:
run_install: false

- name: ♻️ Setup pnpm cache
uses: actions/setup-node@v4
with:
node-version: 20
cache: "pnpm"

- name: πŸ“₯ Install workspace deps
run: pnpm install --frozen-lockfile

- name: β–² Runner Deployment
id: runner-docs
uses: consentdotio/github-actions/docs-preview-action@main
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

# First, let's check if this is a real action by searching for references to it
rg "consentdotio/github-actions" --type yaml

Repository: consentdotio/runners

Length of output: 46


🌐 Web query:

consentdotio/github-actions docs-preview-action versions releases

πŸ’‘ Result:

I can look that up β€” do you mean the GitHub repository consentdotio/docs-preview-action (or a different owner/repo)? Confirm the exact repo name and whether you want tags, releases, or Marketplace versions, and I’ll fetch the release/version list.


🏁 Script executed:

# Find and read the workflow file
find . -name "deploy-docs-reusable.yml" -type f

Repository: consentdotio/runners

Length of output: 108


🏁 Script executed:

# Search for consentdotio anywhere in the repo
rg "consentdotio" --type yaml

Repository: consentdotio/runners

Length of output: 46


🏁 Script executed:

# List all yaml files to understand the repo structure
fd -e yml -e yaml | head -20

Repository: consentdotio/runners

Length of output: 98


🏁 Script executed:

# Read the workflow file around line 95
cat -n ./.github/workflows/deploy-docs-reusable.yml | sed -n '90,105p'

Repository: consentdotio/runners

Length of output: 706


🏁 Script executed:

# Check if there's documentation about the action
find . -name "*.md" -type f | xargs rg "docs-preview-action" 2>/dev/null

Repository: consentdotio/runners

Length of output: 48


🏁 Script executed:

# Check git history to see if this reference has been stable
git log --oneline -n 20 -- ./.github/workflows/deploy-docs-reusable.yml 2>/dev/null || echo "Git history not available"

Repository: consentdotio/runners

Length of output: 137


🏁 Script executed:

# Check if there's a docs-preview-action action file in the repo
find . -path "*/github-actions/*" -o -path "*/actions/*" -o -name "*docs-preview*" 2>/dev/null

Repository: consentdotio/runners

Length of output: 115


🌐 Web query:

consentdotio github-actions repository docs-preview-action releases

πŸ’‘ Result:

I can look that up β€” do you want me to search GitHub for the consentdotio/docs-preview-action repository and list its releases now?


🏁 Script executed:

# Check if there's a local actions directory
find . -type d -name "actions" -o -type d -name ".github/actions"

Repository: consentdotio/runners

Length of output: 97


🏁 Script executed:

# Look at the broader GitHub workflows context
ls -la .github/workflows/

Repository: consentdotio/runners

Length of output: 508


🏁 Script executed:

# Check if there are any comments or documentation in the workflow about the action
cat ./.github/workflows/deploy-docs-reusable.yml | head -20

Repository: consentdotio/runners

Length of output: 554


🏁 Script executed:

# Read the full workflow file
cat ./.github/workflows/deploy-docs-reusable.yml

Repository: consentdotio/runners

Length of output: 3831


Pin the GitHub action to a specific version; @main is unsafe for production workflows.

This workflow pins all other actions to specific versions (actions/checkout@v4, actions/setup-node@v4, pnpm/action-setup@v4) but uses @main for the custom docs-preview-action. Using @main introduces stability and security risksβ€”the action could change unexpectedly, breaking deployments or introducing vulnerabilities. Pin to a specific release tag instead (e.g., @v1.0.0).

Verify the available version tags in the consentdotio/github-actions repository and update accordingly.

πŸ€– Prompt for AI Agents
.github/workflows/deploy-docs-reusable.yml around line 95: the workflow uses
consentdotio/github-actions/docs-preview-action@main which is unsafe for
production; replace @main with a specific released tag (e.g., @v1.0.0) by
checking the consentdotio/github-actions repository for available version tags
or releases and update the workflow to pin the action to that exact tag or
commit SHA to ensure stability and security.

with:
# Auth
GITHUB_TOKEN: ${{ github.token }}
github_app_id: ${{ secrets.CONSENT_APP_ID }}
github_app_private_key: ${{ secrets.CONSENT_APP_PRIVATE_KEY }}
github_app_installation_id: 81013186

# Production target
target: ${{ inputs.target }}

# Comment behavior
header: ${{ inputs.header }}
append: "true"
hide_details: "true"

# Vercel
vercel_token: ${{ secrets.VERCEL_TOKEN }}
vercel_project_id: ${{ secrets.VERCEL_PROJECT_ID }}
vercel_org_id: ${{ secrets.VERCEL_ORG_ID }}

assign_alias_on_branch: ${{ inputs.assign_alias_on_branch }}
alias_domains: ${{ inputs.alias_domains }}

# Branch deployment policies
deploy_on_push_branches: ${{ inputs.deploy_on_push_branches }}
deploy_on_pr_base_branches: ${{ inputs.deploy_on_pr_base_branches }}

# Orchestration & gating
consent_git_token: ${{ secrets.CONSENT_GIT_TOKEN }}
docs_template_repo: consentdotio/runner-docs
only_if_changed: ${{ inputs.only_if_changed }}
change_globs: ${{ inputs.change_globs }}
check_template_changes: ${{ inputs.check_template_changes }}
Comment on lines +93 to +128
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | πŸ”΅ Trivial

Hardcoded github_app_installation_id needs documentation or configuration.

Line 101 hardcodes github_app_installation_id: 81013186, which is environment/organization-specific. This should either be:

  1. Documented with a comment explaining why this specific ID is used,
  2. Extracted as a workflow input for flexibility, or
  3. Kept as a constant if it's truly organization-wide, but documented.

Add a comment explaining the significance of this ID:

           github_app_id: ${{ secrets.CONSENT_APP_ID }}
           github_app_private_key: ${{ secrets.CONSENT_APP_PRIVATE_KEY }}
+          # Organization-wide Consent.io GitHub App installation ID for runner-docs
           github_app_installation_id: 81013186

Alternatively, consider extracting this as a workflow input if different repositories or organizations need different installation IDs.

πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: β–² Runner Deployment
id: runner-docs
uses: consentdotio/github-actions/docs-preview-action@main
with:
# Auth
GITHUB_TOKEN: ${{ github.token }}
github_app_id: ${{ secrets.CONSENT_APP_ID }}
github_app_private_key: ${{ secrets.CONSENT_APP_PRIVATE_KEY }}
github_app_installation_id: 81013186
# Production target
target: ${{ inputs.target }}
# Comment behavior
header: ${{ inputs.header }}
append: "true"
hide_details: "true"
# Vercel
vercel_token: ${{ secrets.VERCEL_TOKEN }}
vercel_project_id: ${{ secrets.VERCEL_PROJECT_ID }}
vercel_org_id: ${{ secrets.VERCEL_ORG_ID }}
assign_alias_on_branch: ${{ inputs.assign_alias_on_branch }}
alias_domains: ${{ inputs.alias_domains }}
# Branch deployment policies
deploy_on_push_branches: ${{ inputs.deploy_on_push_branches }}
deploy_on_pr_base_branches: ${{ inputs.deploy_on_pr_base_branches }}
# Orchestration & gating
consent_git_token: ${{ secrets.CONSENT_GIT_TOKEN }}
docs_template_repo: consentdotio/runner-docs
only_if_changed: ${{ inputs.only_if_changed }}
change_globs: ${{ inputs.change_globs }}
check_template_changes: ${{ inputs.check_template_changes }}
- name: β–² Runner Deployment
id: runner-docs
uses: consentdotio/github-actions/docs-preview-action@main
with:
# Auth
GITHUB_TOKEN: ${{ github.token }}
github_app_id: ${{ secrets.CONSENT_APP_ID }}
github_app_private_key: ${{ secrets.CONSENT_APP_PRIVATE_KEY }}
# Organization-wide Consent.io GitHub App installation ID for runner-docs
github_app_installation_id: 81013186
# Production target
target: ${{ inputs.target }}
# Comment behavior
header: ${{ inputs.header }}
append: "true"
hide_details: "true"
# Vercel
vercel_token: ${{ secrets.VERCEL_TOKEN }}
vercel_project_id: ${{ secrets.VERCEL_PROJECT_ID }}
vercel_org_id: ${{ secrets.VERCEL_ORG_ID }}
assign_alias_on_branch: ${{ inputs.assign_alias_on_branch }}
alias_domains: ${{ inputs.alias_domains }}
# Branch deployment policies
deploy_on_push_branches: ${{ inputs.deploy_on_push_branches }}
deploy_on_pr_base_branches: ${{ inputs.deploy_on_pr_base_branches }}
# Orchestration & gating
consent_git_token: ${{ secrets.CONSENT_GIT_TOKEN }}
docs_template_repo: consentdotio/runner-docs
only_if_changed: ${{ inputs.only_if_changed }}
change_globs: ${{ inputs.change_globs }}
check_template_changes: ${{ inputs.check_template_changes }}
πŸ€– Prompt for AI Agents
.github/workflows/deploy-docs-reusable.yml lines 93 to 128: the
github_app_installation_id is hardcoded to 81013186 which is organization/repo
specific; either document why this exact ID is required or make it configurable.
Add a concise comment above that line explaining the ID’s scope/validity and why
it is safe to hardcode (if it truly is org-wide), or refactor the workflow to
accept an input (e.g., github_app_installation_id) and replace the hardcoded
value with that input, updating the workflow inputs and README usage examples
accordingly.


# Branding customization
comment_marker_prefix: "runner"

Comment on lines +131 to +132
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟑 Minor

Remove trailing blank line at end of file.

YAMLlint flags excess blank lines. Remove the trailing blank line to conform to style standards.

🧰 Tools
πŸͺ› YAMLlint (1.37.1)

[error] 132-132: too many blank lines (1 > 0)

(empty-lines)

πŸ€– Prompt for AI Agents
.github/workflows/deploy-docs-reusable.yml around lines 131-132: the file ends
with an extra trailing blank line which causes yamllint to flag excess blank
lines; remove the final empty line so the file ends immediately after the last
line containing 'comment_marker_prefix: "runner"' (ensure no additional newline
beyond a single terminating newline if your editor inserts one).

Comment on lines +129 to +132
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟑 Minor

Remove trailing blank lines.

YAMLlint reports trailing blank lines at the end of the file. Remove them to maintain consistent formatting.

           # Branding customization
           comment_marker_prefix: "runner"
-
πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Branding customization
comment_marker_prefix: "runner"
# Branding customization
comment_marker_prefix: "runner"
🧰 Tools
πŸͺ› YAMLlint (1.37.1)

[error] 132-132: too many blank lines (1 > 0)

(empty-lines)

πŸ€– Prompt for AI Agents
.github/workflows/deploy-docs-reusable.yml lines 129-132: the file currently
ends with one or more trailing blank lines which YAMLlint flags; remove the
extra blank lines at the end of the file so the file ends immediately after the
last YAML line (ensure no empty newline-only lines remain after the final
content).

72 changes: 72 additions & 0 deletions .github/workflows/deploy-docs.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,72 @@
# πŸš€ Runner docs deployment workflow (Unified)
name: Deploy docs

on:
# πŸ“Œ Trigger on PRs that modify docs (build previews for reviews)
pull_request:
branches:
- "**"
# πŸ“Œ Manual trigger for production deployments
workflow_dispatch:
inputs:
branch:
description: "Branch to deploy (main for production, or any branch for staging)"
required: true
type: string

permissions:
contents: read
issues: write
pull-requests: write
deployments: write

jobs:
Comment on lines +1 to +23
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | πŸ”΅ Trivial

Add documentation about required setup and prerequisites.

The workflow relies on external services (Vercel, consent.io GitHub app) and secrets without documenting prerequisite setup. Consider adding a comment block or referencing documentation that explains:

  • How to set up the Vercel integration
  • How to configure the consent.io GitHub app
  • Which secrets need to be created and where

Optional: Add a documentation comment at the top of the file:

 # πŸš€ Runner docs deployment workflow (Unified)
 name: Deploy docs
+
+# Prerequisites:
+# 1. Repository secrets must be configured:
+#    - CONSENT_APP_ID: Consent.io GitHub App ID
+#    - CONSENT_APP_PRIVATE_KEY: Consent.io GitHub App private key
+#    - VERCEL_TOKEN: Vercel API token
+#    - VERCEL_PROJECT_ID: Vercel project ID
+#    - VERCEL_ORG_ID: Vercel organization ID
+#    - CONSENT_GIT_TOKEN: Git token for consent.io repos
+# 2. Vercel project must be configured and linked to this repository
+# 3. Consent.io GitHub App must be installed on this repository
πŸ€– Prompt for AI Agents
.github/workflows/deploy-docs.yml lines 1-27: Add a short top-of-file
documentation block describing required external integrations and secrets;
explicitly list Vercel integration setup steps or a link to docs, consent.io
GitHub app configuration steps or link, and enumerate required
repository/organization secrets (names and purpose) and where to configure them
(Repo Settings -> Secrets or Org Settings), so maintainers know prerequisites
before using the workflow.

setup:
runs-on: ubuntu-latest
outputs:
alias_domains: ${{ steps.set-vars.outputs.alias_domains }}
steps:
- id: set-vars
run: |
if [ "${{ github.event_name }}" == "pull_request" ]; then
echo "alias_domains=pr-${{ github.event.pull_request.number }}.runner.dev" >> $GITHUB_OUTPUT
elif [ "${{ github.event.inputs.branch }}" == "main" ]; then
echo "alias_domains=runner.com" >> $GITHUB_OUTPUT
else
echo "alias_domains=${{ github.event.inputs.branch }}.runner.dev" >> $GITHUB_OUTPUT
fi
deploy:
needs: setup
concurrency:
group: ${{ github.event_name == 'pull_request' && 'docs-preview-' || 'docs-production-' }}${{ github.event_name == 'pull_request' && github.ref || github.event.inputs.branch }}
cancel-in-progress: true
uses: ./.github/workflows/deploy-docs-reusable.yml
with:
# Determine ref based on event type
ref: ${{ github.event_name == 'pull_request' && '' || github.event.inputs.branch }}
# Production for manual dispatch, staging for PRs
target: ${{ github.event_name == 'workflow_dispatch' && 'production' || '' }}
# Header based on event type
header: ${{ github.event_name == 'pull_request' && 'runner-docs-preview' || 'runner-docs-production' }}
# Alias assignment
assign_alias_on_branch: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.branch || '' }}
# Alias domains
alias_domains: ${{ needs.setup.outputs.alias_domains }}
# Branch deployment policies
deploy_on_push_branches: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.branch || '' }}
deploy_on_pr_base_branches: ${{ github.event_name == 'pull_request' && 'main,**' || '' }}
# Change detection
only_if_changed: ${{ github.event_name == 'pull_request' && 'true' || 'false' }}
change_globs: |
docs/**
changelog/**
packages/*/src/**
packages/*/package.json
check_template_changes: "true"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | πŸ”΄ Critical

Fix input type mismatch: check_template_changes must be boolean, not string.

Line 65 passes "true" (string) but the reusable workflow expects a boolean type. This will cause the workflow to fail or behave unexpectedly.

Apply this diff to remove the quotes:

-      check_template_changes: "true"
+      check_template_changes: true
πŸ“ Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
check_template_changes: "true"
check_template_changes: true
🧰 Tools
πŸͺ› actionlint (1.7.9)

65-65: input "check_template_changes" is typed as string by reusable workflow "./.github/workflows/deploy-docs-reusable.yml". bool value cannot be assigned

(expression)

πŸ€– Prompt for AI Agents
.github/workflows/deploy-docs.yml around line 65: the input
check_template_changes is passed as a string ("true") but the reusable workflow
expects a boolean; change the value to a bare boolean true (remove the quotes)
so YAML emits a boolean rather than a string, ensuring the input type matches
the called workflow's schema.

secrets:
CONSENT_APP_ID: ${{ secrets.CONSENT_APP_ID }}
CONSENT_APP_PRIVATE_KEY: ${{ secrets.CONSENT_APP_PRIVATE_KEY }}
VERCEL_TOKEN: ${{ secrets.VERCEL_TOKEN }}
VERCEL_PROJECT_ID: ${{ secrets.VERCEL_PROJECT_ID }}
VERCEL_ORG_ID: ${{ secrets.VERCEL_ORG_ID }}
CONSENT_GIT_TOKEN: ${{ secrets.CONSENT_GIT_TOKEN }}
Loading
Loading