Skip to content

ci: update github workflows #382

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AlemTuzlak merged 2 commits into from
Mar 17, 2026
Merged

ci: update github workflows #382

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e40268c
ci: update github workflows
lachlancollins Mar 17, 2026
ae541e6
Capitalise
lachlancollins Mar 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/autofix.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.1
uses: actions/checkout@v6.0.2
- name: Setup Tools
uses: tanstack/config/.github/setup@main
uses: TanStack/config/.github/setup@main
- name: Fix formatting
run: pnpm format
- name: Apply fixes
Expand Down
29 changes: 16 additions & 13 deletions .github/workflows/pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,6 @@ name: PR

on:
pull_request:
paths-ignore:
- 'docs/**'
- 'media/**'
- '**/*.md'

concurrency:
group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
Expand All @@ -16,18 +12,19 @@ env:

permissions:
contents: read
pull-requests: write

Comment on lines 13 to 16
Copy link
Contributor

@coderabbitai coderabbitai bot Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Scope pull-requests: write to the job that needs it.

Setting write permission at workflow scope over-privileges test, preview, and provenance. Keep workflow-level permissions read-only and grant PR write only in version-preview.

Suggested permission scoping 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
+  version-preview:
+    permissions:
+      contents: read
+      pull-requests: write
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
permissions:
contents: read
pull-requests: write
permissions:
contents: read
jobs:
version-preview:
permissions:
contents: read
pull-requests: write
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/pr.yml around lines 13 - 16, The workflow currently grants
pull-requests: write at the top-level permissions block (permissions: contents:
read, pull-requests: write), which over-privileges jobs; remove or revert the
top-level pull-requests: write so workflow-level permissions remain read-only
and instead add a job-level permissions entry granting pull-requests: write only
to the version-preview job (e.g., under the job named version-preview add
permissions: pull-requests: write and keep other jobs like test, preview,
provenance without that write permission). Ensure the top-level permissions
block retains contents: read only and that only the version-preview job contains
the scoped pull-requests: write permission.

jobs:
test:
name: Test
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.1
uses: actions/checkout@v6.0.2
with:
fetch-depth: 0
- name: Setup Tools
uses: tanstack/config/.github/setup@main
uses: TanStack/config/.github/setup@main
- name: Get base and head commits for `nx affected`
uses: nrwl/nx-set-shas@v4.4.0
with:
Expand All @@ -39,11 +36,9 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.1
with:
fetch-depth: 0
uses: actions/checkout@v6.0.2
- name: Setup Tools
uses: tanstack/config/.github/setup@main
uses: TanStack/config/.github/setup@main
- name: Build Packages
run: pnpm run build:all
- name: Publish Previews
Expand All @@ -53,10 +48,18 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.1
with:
fetch-depth: 0
uses: actions/checkout@v6.0.2
- name: Check Provenance
uses: danielroe/provenance-action@v0.1.1
with:
fail-on-downgrade: true
version-preview:
name: Version Preview
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.2
- name: Setup Tools
uses: TanStack/config/.github/setup@main
- name: Changeset Preview
uses: TanStack/config/.github/changeset-preview@main
14 changes: 6 additions & 8 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,23 +23,21 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v6.0.1
uses: actions/checkout@v6.0.2
with:
fetch-depth: 0
- name: Setup Tools
uses: tanstack/config/.github/setup@main
uses: TanStack/config/.github/setup@main
- name: Run Tests
run: pnpm run test:ci
- name: Run Changesets (version or publish)
id: changesets
uses: changesets/action@v1.5.3
uses: changesets/action@v1.7.0
with:
version: pnpm run changeset:version
publish: pnpm run changeset:publish
commit: "ci: Version Packages"
title: "ci: Version Packages"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
commit: 'ci: Version Packages'
title: 'ci: Version Packages'
- name: Generate Docs
if: steps.changesets.outputs.published == 'true'
run: pnpm generate-docs
Expand All @@ -60,6 +58,6 @@ jobs:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Comment on PRs about release
if: steps.changesets.outputs.published == 'true'
uses: tanstack/config/.github/comment-on-release@main
uses: TanStack/config/.github/comment-on-release@main
with:
published-packages: ${{ steps.changesets.outputs.publishedPackages }}
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@
]
},
"devDependencies": {
"@changesets/cli": "^2.29.8",
"@changesets/cli": "^2.30.0",
"@faker-js/faker": "^10.1.0",
"@svitejs/changesets-changelog-github-compact": "^1.2.0",
"@tanstack/eslint-config": "0.3.3",
Expand Down
67 changes: 30 additions & 37 deletions pnpm-lock.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading