ci: add widget build, tvOS TestFlight, and issue_comment trigger#97
ci: add widget build, tvOS TestFlight, and issue_comment trigger#97
Conversation
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 16 minutes and 0 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughModified Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (2 inconclusive)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/testflight.yml:
- Around line 64-66: The current check uses body.includes('/testflight') which
matches mentions inside quotes or code blocks; replace that broad includes check
on context.payload.comment.body (and the matching check near the existing
parser) with a strict line-oriented match that only triggers when a line begins
with the slash command (i.e., test body with a multiline regex equivalent that
looks for a line starting with "/testflight" followed by end-of-line or
whitespace), and update the early-return branch (where core.info('No /testflight
command — skipping') is logged) to use this stricter test so it aligns with the
parser used later (the parser referenced near line 93).
- Around line 92-99: The slash-command parsing currently accepts any
non-whitespace token (variables line, versionMatch, buildMatch, netbirdMatch) —
update the validations so that before calling core.setOutput you verify the
values match strict patterns: require version to match a semantic version like
^\d+\.\d+\.\d+(-[A-Za-z0-9.-]+)?$, require build-number to be digits only ^\d+$,
and require netbird-ref to only contain safe Git ref characters (e.g.
^[A-Za-z0-9._\/-]+$); if any value fails validation, do not call core.setOutput
for that key and fail early (use core.setFailed or throw) with a clear error so
invalid or malicious inputs are rejected immediately.
- Around line 59-90: Add a same-repo guard before enabling /testflight: after
identifying it's a PR comment (and before setting outputs), call
github.rest.pulls.get (or reuse the existing pulls.get) to inspect
pr.data.head.repo.full_name and compare it to
`${context.repo.owner}/${context.repo.repo}` (or
context.payload.repository.full_name); if they differ, log and return. Apply
this check in the issue_comment branch (around the code that obtains the PR and
before core.setOutput('ref', ...)) so fork PRs are blocked from running with
repo secrets.
- Around line 83-88: The code destructures the result of github.rest.pulls.get
into { data: pr } and then incorrectly accesses pr.data.head.sha, which is
undefined; update the core.setOutput call to read the head SHA from pr.head.sha
(i.e., use the already-destructured pr returned from github.rest.pulls.get) so
core.setOutput('ref', pr.head.sha) is used instead.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f2b3e0ee-c77e-4ac7-9efc-9843dcb241d4
📒 Files selected for processing (1)
.github/workflows/testflight.yml
|
Build failed (iOS) |
|
/testflight |
|
Build failed (iOS) |
) The response from github.rest.pulls.get is destructured as `const { data: pr } = ...` on line 102, so `pr` is already the PR object. Lines 110, 111, and 115 then did `pr.data.head.*` — double dereference — which crashed with 'Cannot read properties of undefined (reading head)' the first time anyone commented /testflight after PR #97 landed the issue_comment handler.
3 participants
Description
/testflight
Summary by CodeRabbit
/testflightcommand (requires collaborator write/admin permissions)