Add Deno workflow for linting and testing - #4259
Conversation
This workflow installs Deno and runs linting and tests on push and pull request events.
📝 WalkthroughWalkthroughAdded a GitHub Actions workflow for Deno validation. The workflow runs on pushes and pull requests targeting ChangesDeno CI validation
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
.github/workflows/deno.yml (2)
25-26: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin
actions/checkoutto a full commit SHA.Line 26 uses mutable
@v4, while Line 30 is SHA-pinned. Pinactions/checkoutto an audited full-length SHA as well. GitHub identifies full-length SHA pinning as the immutable option. (docs.github.com)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/deno.yml around lines 25 - 26, Update the actions/checkout step in the Setup repo workflow to replace the mutable `@v4` reference with the audited, full-length commit SHA used for the approved checkout version, matching the existing SHA-pinning convention in the workflow.
28-32: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPin a supported Deno toolchain.
Line 30 pins the action to v1.1.2, but Line 32 selects a moving
v1.xrange. CI can validate different patch releases over time. The currentsetup-denodocumentation uses@v2and defaults to Denov2.x; the current Deno LTS line is v2.9. (github.com)Verify the repository's intended runtime. If Deno 2 is supported, update the action and pin the exact supported Deno version or a version file. If Deno 1 is required, pin the exact Deno 1 patch and document the constraint.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/deno.yml around lines 28 - 32, Update the “Setup Deno” workflow step to use the repository’s intended runtime explicitly: if Deno 2 is supported, migrate the setup action to the v2 release and pin an exact supported Deno 2 version or version file; otherwise retain Deno 1 while replacing the moving v1.x selector with an exact patch version and documenting the constraint. Keep the action reference and deno-version setting consistent.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/deno.yml:
- Around line 41-42: Update the “Run tests” workflow step to remove Deno’s
blanket -A permission and replace it with only the specific --allow-* flags
required by the test suite, preserving the existing test command and behavior.
- Around line 38-42: Update the workflow steps around “Run linter” and “Run
tests” to use the repository’s declared package scripts, including npm run lint
and the appropriate package-defined test command, after installing Node
dependencies; alternatively remove the Deno workflow if Deno is not part of the
project setup. Do not retain Deno-only commands.
- Around line 25-26: Update the actions/checkout@v4 step in the workflow to set
persist-credentials to false, preventing the GitHub token from being stored in
local Git configuration before the deno test -A step runs.
---
Nitpick comments:
In @.github/workflows/deno.yml:
- Around line 25-26: Update the actions/checkout step in the Setup repo workflow
to replace the mutable `@v4` reference with the audited, full-length commit SHA
used for the approved checkout version, matching the existing SHA-pinning
convention in the workflow.
- Around line 28-32: Update the “Setup Deno” workflow step to use the
repository’s intended runtime explicitly: if Deno 2 is supported, migrate the
setup action to the v2 release and pin an exact supported Deno 2 version or
version file; otherwise retain Deno 1 while replacing the moving v1.x selector
with an exact patch version and documenting the constraint. Keep the action
reference and deno-version setting consistent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: e9196646-cb20-43b8-92d1-8d07e21c2017
📒 Files selected for processing (1)
.github/workflows/deno.yml
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
TeamPiped/Piped(manual)
| - name: Setup repo | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- workflow excerpt ---\n'
sed -n '1,120p' .github/workflows/deno.yml 2>/dev/null || true
printf '\n--- checkout usages in workflows ---\n'
rg -n "actions/checkout|persist-credentials|deno test|mocha|jest|npm test|yarn test" .github/workflows 2>/dev/null || true
printf '\n--- action checkout v4 docs availability? ---\n'
python3 - <<'PY'
import urllib.request
url="https://raw.githubusercontent.com/actions/checkout/v4/README.md"
try:
text=urllib.request.urlopen(url, timeout=15).read().decode()
print("README found", len(text))
for term in ["persist-credentials", "This action", "git config", "credential"]:
print(term, ":", term.lower() in text.lower())
lines=text.splitlines()
for i,l in enumerate(lines):
if "persist-credentials" in l.lower() or "default" in l.lower():
print(f"{i+1}: {l[:220]}")
except Exception as e:
print(type(e).__name__, e)
PYRepository: TeamPiped/Piped
Length of output: 244
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow excerpt ---'
sed -n '1,120p' .github/workflows/deno.yml 2>/dev/null || true
printf '%s\n' ''
printf '%s\n' '--- checkout usage and test/script steps ---'
rg -n "actions/checkout|persist-credentials|deno test|mocha|jest|npm test|yarn test|scripts/|pnpm test" .github/workflows 2>/dev/null || true
printf '%s\n' ''
printf '%s\n' '--- action checkout v4 README default ---'
python3 - <<'PY'
import urllib.request
url="https://raw.githubusercontent.com/actions/checkout/v4/README.md"
try:
text=urllib.request.urlopen(url, timeout=15).read().decode()
print("README bytes:", len(text))
idx=text.lower().find("persist-credentials")
print("mentions persist-credentials:", idx != -1)
if idx != -1 and idx > 200:
start=max(0, idx-500)
end=min(len(text), idx+700)
print(text[start:end])
except Exception as e:
print(type(e).__name__, e)
PYRepository: TeamPiped/Piped
Length of output: 2144
🌐 Web query:
actions/checkout v4 README persist-credentials default true
💡 Result:
In the actions/checkout v4 action, the persist-credentials input defaults to true [1][2]. When set to true (the default), the action configures the authentication token or SSH key in the local git configuration [3][4]. This allows subsequent git commands executed within your workflow steps to use these credentials automatically [3][5]. The token is removed during the post-job cleanup process [3][4]. If you wish to prevent this behavior for security reasons or because it is not needed, you can explicitly set persist-credentials to false in your workflow configuration [3][4]. Example usage: - uses: actions/checkout@v4 with: persist-credentials: false
Citations:
- 1: https://github.com/actions/checkout/blob/v4/action.yml
- 2: https://github.com/actions/checkout/blob/v4.1.1/action.yml
- 3: https://github.com/actions/checkout/blob/v4/README.md
- 4: https://github.com/actions/checkout/?tab=readme-ov-file
- 5: https://github.com/actions/checkout
Disable checkout credential persistence.
actions/checkout@v4 persists the GitHub token in local Git configuration by default. The later deno test -A step runs PR-controlled code that can read .git/config and exfiltrate the read-only token. Set persist-credentials: false, since this job has no authenticated Git operations after checkout.
🔒 Proposed fix
- name: Setup repo
uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Setup repo | |
| uses: actions/checkout@v4 | |
| - name: Setup repo | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.28.0)
[warning] 25-26: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deno.yml around lines 25 - 26, Update the
actions/checkout@v4 step in the workflow to set persist-credentials to false,
preventing the GitHub token from being stored in local Git configuration before
the deno test -A step runs.
Source: Linters/SAST tools
| - name: Run linter | ||
| run: deno lint | ||
|
|
||
| - name: Run tests | ||
| run: deno test -A |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "Deno configuration and version files:"
fd -HI -t f \
-g 'deno.json' \
-g 'deno.jsonc' \
-g 'deno.lock' \
-g '.dvmrc' \
-g '.tool-versions' . || true
echo "Deno test candidates:"
rg --files -g '!node_modules/**' -g '!dist/**' |
rg '(^|/)(__tests__/|.*(_test|\.test)\.(ts|tsx|mts|js|mjs|jsx)$)' || true
echo "Declared package scripts:"
rg -n '"(scripts|lint|test|build)"|eslint|jest|vite' package.jsonRepository: TeamPiped/Piped
Length of output: 1162
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Relevant files:"
git ls-files | sed -n '1,220p' | rg '(^|/)(deno\.jsonc?$|package\.json$|.*test\.(ts|tsx|js|jsx|mjs|mts)$|.*(_test).*\.(ts|tsx|js|jsx|mjs|mts)$|__tests__/.*\.(ts|tsx|js|jsx|mjs|mts)|\.github/workflows/deno\.yml$)' || true
echo
echo ".github/workflows/deno.yml:"
if [ -f .github/workflows/deno.yml ]; then
cat -n .github/workflows/deno.yml
else
echo "missing"
fi
echo
echo "package.json scripts:"
python3 - <<'PY'
import json
from pathlib import Path
p=Path('package.json')
if not p.exists():
print('missing')
else:
data=json.loads(p.read_text())
print(json.dumps(data.get('scripts', {}), indent=2, sort_keys=True))
PY
echo
echo "Potential Deno commands/config references:"
rg --hidden --glob '!node_modules/**' --glob '!dist/**' --glob '!coverage/**' '(deno\.jsonc?$|DENO|deno lint|deno test|deno run|deno cache|deno fmt)' || trueRepository: TeamPiped/Piped
Length of output: 1786
Run the repository’s declared checks instead of Deno-only commands.
.github/workflows/deno.yml has no deno.json/deno.lock or Deno test candidates and does not install Node dependencies, but package.json defines npm run lint. Run the project’s declared checks, or remove this workflow if Deno is not part of the repo setup.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deno.yml around lines 38 - 42, Update the workflow steps
around “Run linter” and “Run tests” to use the repository’s declared package
scripts, including npm run lint and the appropriate package-defined test
command, after installing Node dependencies; alternatively remove the Deno
workflow if Deno is not part of the project setup. Do not retain Deno-only
commands.
| - name: Run tests | ||
| run: deno test -A |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- workflow excerpt ---\n'
if [ -f .github/workflows/deno.yml ]; then
nl -ba .github/workflows/deno.yml | sed -n '1,140p'
else
echo ".github/workflows/deno.yml not found"
fi
printf '\n--- test commands using deno test / permissions ---\n'
rg -n "deno test|allow-" .github deno.json deno.jsonc src test tests scripts 2>/dev/null || true
printf '\n--- tracked relevant files ---\n'
git ls-files | sed -n '1,200p' | grep -E '(^\.github/workflows/deno\.yml$|deno\.(json|jsonc)|test|tests)' || trueRepository: TeamPiped/Piped
Length of output: 244
🏁 Script executed:
#!/bin/bash
set -euo pipefail
cat -n .github/workflows/deno.yml | sed -n '1,140p'
printf '\n--- test commands using deno test / permissions ---\n'
rg -n "deno test|allow-" .github deno.json deno.jsonc src test tests scripts 2>/dev/null || true
printf '\n--- tracked relevant files ---\n'
git ls-files | grep -E '(^\.github/workflows/deno\.yml$|deno\.(json|jsonc)|test|tests)' || trueRepository: TeamPiped/Piped
Length of output: 1721
Remove blanket permissions from pull-request tests.
-A grants all Deno permissions, which allows test code to request filesystem, environment, network, subprocess, and FFI access. Use only the --allow-* flags required by the test suite.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/deno.yml around lines 41 - 42, Update the “Run tests”
workflow step to remove Deno’s blanket -A permission and replace it with only
the specific --allow-* flags required by the test suite, preserving the existing
test command and behavior.
1 participant
This workflow installs Deno and runs linting and tests on push and pull request events.
Summary by CodeRabbit