-
-
Notifications
You must be signed in to change notification settings - Fork 1
feat: Add GitHub Pages deployment workflow #20
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
This commit introduces a GitHub Actions workflow to automatically build and deploy the application to GitHub Pages. - Adds a new workflow file at `.github/workflows/deploy.yml` that triggers on pushes to the `main` branch. - The workflow installs dependencies, builds the application, and deploys the `dist` directory to the `gh-pages` branch. - Configures `package.json` with the `homepage` URL for correct asset pathing. - Updates `vite.config.js` with the `base` path for the same reason. - Modifies the `test` script in `package.json` to `vitest run` to prevent it from running in watch mode in CI environments.
Reviewer's GuideAdds a fully automated GitHub Actions workflow that builds the React application on pushes to main and deploys the output to the gh-pages branch, with accompanying adjustments to project configuration for correct asset paths and CI-friendly test execution. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hey there - I've reviewed your changes and they look great!
Blocking issues:
- An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. (link)
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location> `.github/workflows/deploy.yml:27` </location>
<code_context>
uses: peaceiris/actions-gh-pages@v3
</code_context>
<issue_to_address>
**security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha):** An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
*Source: opengrep*
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
| run: npm run build | ||
|
|
||
| - name: Deploy | ||
| uses: peaceiris/actions-gh-pages@v3 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
security (yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha): An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.
Source: opengrep
This commit introduces a GitHub Actions workflow to automatically build and deploy the application to GitHub Pages.
.github/workflows/deploy.ymlthat triggers on pushes to themainbranch.distdirectory to thegh-pagesbranch.package.jsonwith thehomepageURL for correct asset pathing.vite.config.jswith thebasepath for the same reason.testscript inpackage.jsontovitest runto prevent it from running in watch mode in CI environments.Summary by Sourcery
Add GitHub Pages deployment workflow and configure project settings for correct asset routing and CI testing
New Features:
Enhancements:
CI: