Support preview release using pkg-pr-new #54
Conversation
WalkthroughA new GitHub Actions workflow named Changes
Possibly related PRs
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
Deploying svelte-maplibre-gl with
|
| Latest commit: |
f24d393
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://111a99f4.svelte-maplibre-gl.pages.dev |
| Branch Preview URL: | https://pkg-pr-new.svelte-maplibre-gl.pages.dev |
commit: |
ciscorn
changed the title
ciscorn
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Outside diff range and nitpick comments (1)
.github/workflows/preview.yml (1)
17-20: Consider using LTS Node.js versionNode.js 22 is currently in pre-release status. Consider using Node.js 20 (LTS) for better stability in the CI environment.
- uses: actions/setup-node@v4 with: - node-version: 22 + node-version: 20 cache: 'pnpm'
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
.github/workflows/preview.yml(1 hunks)package.json(1 hunks)
🔇 Additional comments (1)
package.json (1)
74-74: Verify pkg-pr-new package security and stability
The package is in early development (v0.0.37). Let's verify:
- Package security
- Recent releases and maintenance status
- Community adoption
✅ Verification successful
Let me gather more information about the package usage and its repository to make a more informed decision.
Package appears to be legitimate but requires careful integration
The package pkg-pr-new shows positive indicators:
- Maintained by StackBlitz organization (reputable company)
- No security vulnerabilities reported
- MIT licensed
- Recently updated (Dec 13, 2024)
- Hosted on GitHub under stackblitz-labs
However, due to its early development stage (v0.0.37):
- Ensure proper error handling is implemented when using this package
- Keep track of updates as breaking changes are more likely in pre-1.0 versions
- Consider pinning the exact version instead of using the caret (^) to prevent unexpected updates
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Check package details and security info
echo "Checking npm package info..."
curl -s https://registry.npmjs.org/pkg-pr-new | jq '{
"latest_version": .["dist-tags"].latest,
"maintainers": .maintainers,
"modified": .time.modified,
"downloads_last_week": .downloads_last_week
}'
# Check for known vulnerabilities
echo "Checking for vulnerabilities..."
gh api graphql -f query='
{
securityVulnerabilities(first: 5, ecosystem: NPM, package: "pkg-pr-new") {
nodes {
advisory {
summary
severity
publishedAt
}
}
}
}'
Length of output: 900
Script:
#!/bin/bash
# Check package.json for dependencies on this package
echo "Checking package usage..."
rg -l "pkg-pr-new" --type json
# Get repository info if available
echo "Checking repository info..."
curl -s https://registry.npmjs.org/pkg-pr-new | jq '{
"repository": .repository,
"homepage": .homepage,
"license": .license,
"description": .description
}'
# Check if package is used in source code
echo "Checking imports in source code..."
rg -l "pkg-pr-new"
Length of output: 719
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| pull_request: |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Add permissions and consider restricting PR triggers
The workflow should:
- Declare required permissions explicitly
- Consider restricting PR triggers to trusted sources to prevent unauthorized preview releases
name: Preview Release
on:
push:
branches:
- main
pull_request:
+ types: [opened, synchronize]
+ branches:
+ - main
+
+permissions:
+ contents: read
+ packages: write📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| types: [opened, synchronize] | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| packages: write |
| - name: Publish packages preview with pkg-pr-new CLI | ||
| run: pnpx pkg-pr-new publish |
There was a problem hiding this comment.
Add authentication setup for package publishing
The publish step needs:
- Authentication setup for the package registry
- Error handling for failed publishes
- Conditional execution based on branch/PR context
- name: Publish packages preview with pkg-pr-new CLI
+ env:
+ NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+ if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
run: pnpx pkg-pr-new publish📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Publish packages preview with pkg-pr-new CLI | |
| run: pnpx pkg-pr-new publish | |
| - name: Publish packages preview with pkg-pr-new CLI | |
| env: | |
| NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} | |
| if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository | |
| run: pnpx pkg-pr-new publish |
Summary by CodeRabbit
New Features
Documentation