Add comprehensive GitHub workflows and automation infrastructure by Copilot · Pull Request #48 · objectstack-ai/objectui

Copilot · 2026-01-15T00:45:44Z

Implements complete CI/CD automation including security scanning, dependency management, and project maintenance workflows.

New Workflows

Security & Quality

CodeQL analysis for vulnerability detection (push/PR/weekly)
Gitleaks secret scanning to prevent credential leaks
Bundle size tracking with automatic PR comments

Automation

Dependabot with smart auto-merge (patch/minor) and grouped updates
Auto-labeling PRs via 112 file-pattern rules
Stale issue/PR management (60d/45d thresholds)
Automatic changelog generation from conventional commits

Improvements

CI Pipeline

Added pnpm store caching across all jobs (test/lint/build)
Multi-version testing matrix (Node 18.x, 20.x)
Codecov integration with proper token handling

Developer Experience

Issue templates (bug/feature) with structured fields
PR template with comprehensive checklist
Workflow documentation (.github/WORKFLOWS.md)
Status badges in README

Configuration

# dependabot.yml - Grouped updates
groups:
  patch-updates:
    patterns: ["*"]
    update-types: ["patch"]
  react:
    patterns: ["react*", "@types/react*"]

# labeler.yml - Pattern-based labeling
'package: core':
  - changed-files:
    - any-glob-to-any-file: 'packages/core/**/*'

All workflows follow least-privilege permissions, use commit-pinned actions where security-critical, and include proper error handling.

Original prompt

添加和完善必要的github工作流

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

vercel · 2026-01-15T00:45:50Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
objectui-playground	Ready	Preview, Comment	Jan 15, 2026 1:10am

Co-authored-by: huangyiirene <7665279+huangyiirene@users.noreply.github.com>

Copilot

Pull request overview

This PR adds comprehensive GitHub automation workflows and improves existing CI/CD infrastructure for the Object UI repository. The changes establish automated processes for security scanning, dependency management, issue/PR lifecycle management, and enhanced continuous integration.

Changes:

Added 8 new GitHub workflow files for automated processes (CodeQL security scanning, Dependabot auto-merge, stale issue management, PR auto-labeling, bundle size checks, secret scanning, and changelog generation)
Enhanced existing CI workflow with improved pnpm caching and Codecov token support
Added complete issue/PR template system with bug reports, feature requests, and PR guidelines
Created comprehensive workflow documentation and configuration files

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
cliff.toml	Configuration for git-cliff changelog generation tool with conventional commit parsing
README.md	Added CI and CodeQL workflow status badges
CONTRIBUTING.md	Added detailed documentation about automated workflows and contributor tips
.github/workflows/stale.yml	Automated stale issue/PR management with configurable timeframes
.github/workflows/size-check.yml	Bundle size monitoring and PR comment reporting
.github/workflows/secret-scan.yml	Gitleaks integration for secret detection
.github/workflows/labeler.yml	Automatic PR labeling based on changed files
.github/workflows/dependabot-auto-merge.yml	Automated approval and merging of Dependabot updates
.github/workflows/codeql.yml	CodeQL security analysis for vulnerability detection
.github/workflows/ci.yml	Enhanced CI with pnpm store caching and Codecov token
.github/workflows/changelog.yml	Automated CHANGELOG.md generation on releases
.github/labeler.yml	Configuration mapping file paths to PR labels
.github/dependabot.yml	Dependabot configuration for npm and GitHub Actions updates
.github/WORKFLOWS.md	Comprehensive documentation of all workflow functionality
.github/PULL_REQUEST_TEMPLATE.md	Standardized PR template with checklist and metadata
.github/ISSUE_TEMPLATE/feature_request.md	Structured feature request template
.github/ISSUE_TEMPLATE/config.yml	Issue template configuration with external links
.github/ISSUE_TEMPLATE/bug_report.md	Structured bug report template

Copilot · 2026-01-15T00:54:21Z

+              # Calculate sizes for main bundle files
+              for file in "$pkg"/*.js; do
+                if [ -f "$file" ] && [ ! -f "${file}.map" ]; then
+                  size=$(stat -f%z "$file" 2>/dev/null || stat -c%s "$file" 2>/dev/null || echo "0")


The stat command syntax varies between BSD (macOS) and GNU (Linux) systems. While the fallback chain is correct, this workflow runs on ubuntu-latest, so the BSD syntax -f%z will always fail first. Consider reordering to try the GNU syntax first for efficiency, or simply use the GNU syntax since the workflow explicitly targets Ubuntu.

Suggested change

size=$(stat -f%z "$file" 2>/dev/null || stat -c%s "$file" 2>/dev/null || echo "0")

size=$(stat -c%s "$file" 2>/dev/null || echo "0")

Copilot · 2026-01-15T00:54:22Z

+
+              # Calculate sizes for main bundle files
+              for file in "$pkg"/*.js; do
+                if [ -f "$file" ] && [ ! -f "${file}.map" ]; then


The condition [ ! -f "${file}.map" ] checks for the non-existence of a .map file, but the constructed filename is incorrect. If $file is dist/bundle.js, this checks for dist/bundle.js.map, not dist/bundle.map. Use [ ! -f "${file%.js}.js.map" ] or adjust the logic to correctly identify source map files.

Suggested change

if [ -f "$file" ] && [ ! -f "${file}.map" ]; then

if [ -f "$file" ] && [ ! -f "${file%.js}.js.map" ]; then

Copilot · 2026-01-15T00:54:22Z

+split_commits = false
+# regex for preprocessing the commit messages
+commit_preprocessors = [
+    { pattern = '\((\w+\s)?#([0-9]+)\)', replace = "([#${2}](https://github.com/objectstack-ai/objectui/issues/${2}))"},


The URL hardcodes the organization name as objectstack-ai, but the README and other files reference objectql/objectui. This inconsistency will cause broken issue links in the generated changelog. Verify the correct organization name and update accordingly.

Suggested change

{ pattern = '$(\w+\s)?#([0-9]+)$', replace = "([#${2}](https://github.com/objectstack-ai/objectui/issues/${2}))"},

{ pattern = '$(\w+\s)?#([0-9]+)$', replace = "([#${2}](https://github.com/objectql/objectui/issues/${2}))"},

Copilot · 2026-01-15T00:54:22Z

+    url: https://www.objectui.org
+    about: Check our documentation for guides and API references
+  - name: 💡 Feature Request
+    url: https://github.com/objectstack-ai/objectui/discussions/categories/ideas


Similar to the cliff.toml issue, this URL references objectstack-ai organization, but other parts of the codebase suggest the repository might be under a different organization. Verify the correct GitHub organization and repository path.

Suggested change

url: https://github.com/objectstack-ai/objectui/discussions/categories/ideas

url: https://github.com/objectql/objectui/discussions/categories/ideas

Copilot · 2026-01-15T00:54:23Z

+[![CI](https://github.com/objectstack-ai/objectui/workflows/CI/badge.svg)](https://github.com/objectstack-ai/objectui/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/objectstack-ai/objectui/workflows/CodeQL%20Security%20Scan/badge.svg)](https://github.com/objectstack-ai/objectui/actions/workflows/codeql.yml)


The badge URLs in the example use objectstack-ai as the organization, which may not match the actual repository organization. Ensure these example URLs reflect the correct GitHub organization path to avoid confusion when contributors copy them.

Suggested change

[![CI](https://github.com/objectstack-ai/objectui/workflows/CI/badge.svg)](https://github.com/objectstack-ai/objectui/actions/workflows/ci.yml)

[![CodeQL](https://github.com/objectstack-ai/objectui/workflows/CodeQL%20Security%20Scan/badge.svg)](https://github.com/objectstack-ai/objectui/actions/workflows/codeql.yml)

[![CI](https://github.com/objectql/objectui/workflows/CI/badge.svg)](https://github.com/objectql/objectui/actions/workflows/ci.yml)

[![CodeQL](https://github.com/objectql/objectui/workflows/CodeQL%20Security%20Scan/badge.svg)](https://github.com/objectql/objectui/actions/workflows/codeql.yml)

Copilot · 2026-01-15T00:54:23Z

+      - name: Get pnpm store directory
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - name: Setup pnpm cache
+        uses: actions/cache@v4
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-
+


This pattern of manually setting up pnpm cache is duplicated across three jobs (test, lint, build). Consider extracting this into a composite action or using a reusable workflow to reduce duplication and improve maintainability.

Suggested change

- name: Get pnpm store directory

shell: bash

run: |

echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV

- name: Setup pnpm cache

uses: actions/cache@v4

with:

path: ${{ env.STORE_PATH }}

key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }}

restore-keys: |

${{ runner.os }}-pnpm-store-

…ce duplication Co-authored-by: huangyiirene <7665279+huangyiirene@users.noreply.github.com>

github-advanced-security · 2026-01-15T00:56:21Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

Co-authored-by: huangyiirene <7665279+huangyiirene@users.noreply.github.com>

github-actions · 2026-01-15T00:57:18Z

✅ All checks passed!

✅ Type check passed
✅ Tests passed
✅ Lint check completed

github-actions · 2026-01-15T00:58:17Z

✅ All checks passed!

✅ Type check passed
✅ Tests passed
✅ Lint check completed

github-actions · 2026-01-15T01:08:07Z

✅ All checks passed!

✅ Type check passed
✅ Tests passed
✅ Lint check completed

github-actions · 2026-01-15T01:12:08Z

✅ All checks passed!

✅ Type check passed
✅ Tests passed
✅ Lint check completed

github-actions · 2026-01-15T01:12:27Z

✅ All checks passed!

✅ Type check passed
✅ Tests passed
✅ Lint check completed

Initial plan

3766150

Copilot AI assigned Copilot and huangyiirene Jan 15, 2026

vercel Bot deployed to Preview January 15, 2026 00:46

View deployment

Copilot started work on behalf of huangyiirene January 15, 2026 00:46

View session

Add comprehensive GitHub workflows and configurations

ee99612

Co-authored-by: huangyiirene <7665279+huangyiirene@users.noreply.github.com>

vercel Bot deployed to Preview January 15, 2026 00:50

View deployment

Add workflow documentation, badges, and additional workflows

20942f2

Co-authored-by: huangyiirene <7665279+huangyiirene@users.noreply.github.com>

vercel Bot deployed to Preview January 15, 2026 00:53

View deployment

huangyiirene requested a review from Copilot January 15, 2026 00:53

Add comprehensive workflow implementation summary

4c52dd8

Co-authored-by: huangyiirene <7665279+huangyiirene@users.noreply.github.com>

vercel Bot deployed to Preview January 15, 2026 00:54

View deployment

Copilot AI reviewed Jan 15, 2026

View reviewed changes

github-actions Bot added documentation Improvements or additions to documentation configuration ci/cd labels Jan 15, 2026

Fix code review issues: improve cross-platform compatibility and redu…

1b0ad74

…ce duplication Co-authored-by: huangyiirene <7665279+huangyiirene@users.noreply.github.com>

vercel Bot deployed to Preview January 15, 2026 00:56

View deployment

Pin stale action to specific commit hash for better security

fd7ce2c

Co-authored-by: huangyiirene <7665279+huangyiirene@users.noreply.github.com>

vercel Bot deployed to Preview January 15, 2026 00:57

View deployment

Copilot AI changed the title ~~[WIP] Add and improve necessary GitHub workflows~~ Add comprehensive GitHub workflows and automation infrastructure Jan 15, 2026

Copilot AI requested a review from huangyiirene January 15, 2026 00:59

Copilot finished work on behalf of huangyiirene January 15, 2026 00:59

huangyiirene added 2 commits January 15, 2026 09:09

删除 secret-scan.yml

041dfb1

删除 WORKFLOW_IMPLEMENTATION.md

3a47a17

vercel Bot deployed to Preview January 15, 2026 01:10

View deployment

huangyiirene marked this pull request as ready for review January 15, 2026 01:14

huangyiirene merged commit df7816f into main Jan 15, 2026
11 checks passed

	size=$(stat -f%z "$file" 2>/dev/null \|\| stat -c%s "$file" 2>/dev/null \|\| echo "0")
	size=$(stat -c%s "$file" 2>/dev/null \|\| echo "0")

	if [ -f "$file" ] && [ ! -f "${file}.map" ]; then
	if [ -f "$file" ] && [ ! -f "${file%.js}.js.map" ]; then

	{ pattern = '\((\w+\s)?#([0-9]+)\)', replace = "([#${2}](https://github.com/objectstack-ai/objectui/issues/${2}))"},
	{ pattern = '\((\w+\s)?#([0-9]+)\)', replace = "([#${2}](https://github.com/objectql/objectui/issues/${2}))"},

	url: https://github.com/objectstack-ai/objectui/discussions/categories/ideas
	url: https://github.com/objectql/objectui/discussions/categories/ideas

		[![CI](https://github.com/objectstack-ai/objectui/workflows/CI/badge.svg)](https://github.com/objectstack-ai/objectui/actions/workflows/ci.yml)
		[![CodeQL](https://github.com/objectstack-ai/objectui/workflows/CodeQL%20Security%20Scan/badge.svg)](https://github.com/objectstack-ai/objectui/actions/workflows/codeql.yml)

Conversation

Copilot AI commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New Workflows

Improvements

Configuration

Uh oh!

vercel Bot commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

github-advanced-security AI commented Jan 15, 2026

Uh oh!

github-actions Bot commented Jan 15, 2026

Uh oh!

github-actions Bot commented Jan 15, 2026

Uh oh!

github-actions Bot commented Jan 15, 2026

Uh oh!

github-actions Bot commented Jan 15, 2026

Uh oh!

github-actions Bot commented Jan 15, 2026

Uh oh!

Uh oh!

This branch was successfully deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jan 15, 2026 •

edited

Loading

vercel Bot commented Jan 15, 2026 •

edited

Loading