Merge for up to date #56
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| name: CodSpeed | ||
|
|
||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| pull_request: | ||
| # `workflow_dispatch` allows CodSpeed to trigger backtest | ||
| # performance analysis in order to generate initial data. | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
|
|
||
| jobs: | ||
| benchmarks: | ||
| name: Run benchmarks | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - uses: actions/setup-node@v4 | ||
| with: | ||
| node-version: 22 | ||
| cache: npm | ||
|
|
||
| - name: Install dependencies | ||
| run: npm ci | ||
|
|
||
| - name: Run benchmarks | ||
| uses: CodSpeedHQ/action@v4 | ||
|
Check warning on line 32 in .github/workflows/codspeed.yml
|
||
| with: | ||
| mode: simulation | ||
| run: npx vitest bench --run | ||
|
Comment on lines
+12
to
+35
There was a problem hiding this comment. 1. Unpinned codspeed action The CodSpeed workflow runs CodSpeedHQ/action@v4 (floating tag) while granting id-token: write, which increases supply-chain risk because the executed action code can change without review. Pinning to a commit SHA is needed to make the workflow execution immutable. Agent Prompt
|
||
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,52 @@ | ||||||||||||||||||||
| # This workflow uses actions that are not certified by GitHub. | ||||||||||||||||||||
| # They are provided by a third-party and are governed by | ||||||||||||||||||||
| # separate terms of service, privacy policy, and support | ||||||||||||||||||||
| # documentation. | ||||||||||||||||||||
| # ESLint is a tool for identifying and reporting on patterns | ||||||||||||||||||||
| # found in ECMAScript/JavaScript code. | ||||||||||||||||||||
| # More details at https://github.com/eslint/eslint | ||||||||||||||||||||
| # and https://eslint.org | ||||||||||||||||||||
|
|
||||||||||||||||||||
| name: ESLint | ||||||||||||||||||||
|
|
||||||||||||||||||||
| on: | ||||||||||||||||||||
| push: | ||||||||||||||||||||
| branches: [ "main" ] | ||||||||||||||||||||
| pull_request: | ||||||||||||||||||||
| # The branches below must be a subset of the branches above | ||||||||||||||||||||
| branches: [ "main" ] | ||||||||||||||||||||
| schedule: | ||||||||||||||||||||
| - cron: '19 1 * * 0' | ||||||||||||||||||||
|
|
||||||||||||||||||||
| jobs: | ||||||||||||||||||||
| eslint: | ||||||||||||||||||||
| name: Run eslint scanning | ||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||
| permissions: | ||||||||||||||||||||
| contents: read | ||||||||||||||||||||
| security-events: write | ||||||||||||||||||||
| actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status | ||||||||||||||||||||
| steps: | ||||||||||||||||||||
| - name: Checkout code | ||||||||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||||||||
|
|
||||||||||||||||||||
| - name: Install ESLint | ||||||||||||||||||||
| run: | | ||||||||||||||||||||
| npm install eslint@8.10.0 | ||||||||||||||||||||
|
There was a problem hiding this comment. P2: CI pins ESLint 8.10.0 even though the repository is configured for ESLint 9, creating inconsistent lint results. Prompt for AI agents |
||||||||||||||||||||
| npm install @microsoft/eslint-formatter-sarif@3.1.0 | ||||||||||||||||||||
|
Comment on lines
+34
to
+36
Contributor
There was a problem hiding this comment. 🚩 ESLint workflow installs a separate eslint@8 instead of using the project's eslint@9 Beyond the missing 
Was this helpful? React with 👍 or 👎 to provide feedback.
Comment on lines
+33
to
+36
There was a problem hiding this comment. suggestion (bug_risk): The workflow pins ESLint to 8.10.0, which likely diverges from the project’s configured ESLint version. Here the workflow installs Suggested implementation:
Comment on lines
+33
to
+36
There was a problem hiding this comment. P2 | Confidence: High The workflow installs eslint@8.10.0 globally via npm install, but the project’s package.json declares "eslint": "^9" as a devDependency. This creates a version mismatch: CI may run linting with a much older version (8.10.0) that could produce different results or miss rules/configurations defined for ESLint 9. Additionally, the workflow does not use the project’s local ESLint installation (npx eslint will pick up the globally installed one), leading to potential false passes or failures. To ensure consistency, CI should either use the project’s locally installed ESLint or align the installed version with the project’s requirement.
Suggested change
Evidence: path:package.json |
||||||||||||||||||||
|
|
||||||||||||||||||||
| - name: Run ESLint | ||||||||||||||||||||
| env: | ||||||||||||||||||||
| SARIF_ESLINT_IGNORE_SUPPRESSED: "true" | ||||||||||||||||||||
| run: npx eslint . | ||||||||||||||||||||
| --config .eslintrc.js | ||||||||||||||||||||
|
There was a problem hiding this comment. P1: Workflow references a non-existent ESLint config file ( Prompt for AI agents |
||||||||||||||||||||
| --ext .js,.jsx,.ts,.tsx | ||||||||||||||||||||
|
Comment on lines
+33
to
+43
There was a problem hiding this comment. 🟠 Architect Review — HIGH The ESLint workflow step references a Suggestion: Either add and maintain the Fix in Cursor | Fix in VSCode Claude (Use Cmd/Ctrl + Click for best experience) Prompt for AI Agent 🤖This is an **Architect / Logical Review** comment left during a code review. These reviews are first-class, important findings — not optional suggestions. Do NOT dismiss this as a 'big architectural change' just because the title says architect review; most of these can be resolved with a small, localized fix once the intent is understood.
**Path:** .github/workflows/eslint.yml
**Line:** 33:43
**Comment:**
*HIGH: The ESLint workflow step references a `.eslintrc.js` config that does not exist anywhere in the repo, so `npx eslint . --config .eslintrc.js` cannot run with the specified configuration.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
If a suggested approach is provided above, use it as the authoritative instruction. If no explicit code suggestion is given, you MUST still draft and apply your own minimal, localized fix — do not punt back with 'no suggestion provided, review manually'. Keep the change as small as possible: add a guard clause, gate on a loading state, reorder an await, wrap in a conditional, etc. Do not refactor surrounding code or expand scope beyond the finding.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix |
||||||||||||||||||||
| --format @microsoft/eslint-formatter-sarif | ||||||||||||||||||||
| --output-file eslint-results.sarif | ||||||||||||||||||||
|
Comment on lines
+41
to
+45
Contributor
There was a problem hiding this comment. 🔴 ESLint workflow references non-existent The new ESLint workflow at Prompt for agentsWas this helpful? React with 👍 or 👎 to provide feedback. |
||||||||||||||||||||
| continue-on-error: true | ||||||||||||||||||||
|
|
||||||||||||||||||||
| - name: Upload analysis results to GitHub | ||||||||||||||||||||
| uses: github/codeql-action/upload-sarif@v3 | ||||||||||||||||||||
| with: | ||||||||||||||||||||
| sarif_file: eslint-results.sarif | ||||||||||||||||||||
| wait-for-processing: true | ||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
P2: Workflow actions are pinned to mutable tags (
@v4) instead of immutable commit SHAs, weakening CI supply-chain integrity.Prompt for AI agents