Skip to content

Replace fast-glob with tinyglobby and update deps and CI actions #1

Open
nakrovati wants to merge 6 commits into
unovue:mainfrom
nakrovati:refactor/reduce-deps-count
Open

Replace fast-glob with tinyglobby and update deps and CI actions #1
nakrovati wants to merge 6 commits into
unovue:mainfrom
nakrovati:refactor/reduce-deps-count

Conversation

@nakrovati

@nakrovati nakrovati commented Apr 4, 2026

Copy link
Copy Markdown
  1. Update PNPM to 10.34. 3
  2. Replace fast-glob with tinyglobby - tinyglobby has 15 fewer dependencies (2 vs. 17)
  3. Remove npm-run-all - it's unused and outdated
  4. Update the dev dependencies while maintaining compatibility with Node.js 18
  5. Fix Eslint errors
  6. Dedupe deps
  7. Update CI GitHub actions

Summary by CodeRabbit

  • Chores

    • Upgraded CI and release workflows to newer major action versions and bumped pnpm/tooling versions; updated package manager entry.
  • Refactor

    • Replaced the project's globbing dependency with a lighter alternative.
    • Reordered exports and refined internal transform logic and newline handling.
  • Configuration

    • Added workspace setting to restrict built dependencies.
  • Tests

    • Updated tests to use the new glob module and made snapshot assertions async.

Review Change Stack

@coderabbitai

coderabbitai Bot commented Apr 4, 2026

Copy link
Copy Markdown

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Upgrade CI/release workflows, bump pnpm and devDependencies, replace fast-glob with tinyglobby in code and tests, and refactor Vue transform/type-removal logic with small test and export/import reorderings.

Changes

Repository updates and transform refactor

Layer / File(s) Summary
Workflows: CI and release action bumps
.github/workflows/ci.yml, .github/workflows/release.yml
Bumped GitHub Actions usages: actions/checkout@v6, pnpm/action-setup@v5, actions/setup-node@v6. Other workflow inputs/commands unchanged.
Package manifest and deps
package.json
Updated packageManager to pnpm@10.28.2; removed fast-glob and added tinyglobby; multiple devDependency version bumps (eslint, tsup, vitest, bumpp, etc.) and removal of npm-run-all.
pnpm workspace config
pnpm-workspace.yaml
Add onlyBuiltDependencies: ["esbuild"] to workspace config.
Glob library migration (code + tests)
src/cli-lib.ts, src/cli-lib.test.ts
Replace default fast-glob with named { glob } from tinyglobby; update Vitest mocks and dynamic imports to match new export. Runtime call sites preserved.
Tests, exports, and small import reorderings
src/index.ts, src/transformFile.ts, src/transform.test.ts
Reordered some re-exports and moved a type-only import; made a snapshot assertion asynchronous and reformatted a test call. No API signature changes.
Vue transform and type-removal refactor
src/transform.ts
Refactor import styles; normalize CRLF to LF; route .vue through transformVue; tighten defineProps/defineEmits regexes; adjust emits extraction; change newline-run marker strategy and Babel/comment post-processing; update loc tuple formatting. No exported signatures changed.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🐰 I hopped through code both neat and wild,

swapped tiny globs and tuned the build,
bumped the tools, smoothed regex seams,
nipped blank lines and tidied dreams,
a little hop — the tests still smiled.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 25.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title accurately summarizes the main changes: replacing fast-glob with tinyglobby and updating dependencies/CI actions, which are the primary objectives of the PR.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)

23-29: Pin workflow actions to commit SHAs instead of floating major version tags.

Lines 23–29 currently use floating tags (@v6, @v5, @v6). For improved security and release integrity, pin each action to its full commit SHA and rotate intentionally:

      - name: Checkout
-       uses: actions/checkout@v6
+       uses: actions/checkout@<40-char-sha>

      - name: Install pnpm
-       uses: pnpm/action-setup@v5
+       uses: pnpm/action-setup@<40-char-sha>

      - name: Set node
-       uses: actions/setup-node@v6
+       uses: actions/setup-node@<40-char-sha>
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 23 - 29, Replace the floating action
tags with pinned commit SHAs: for the actions used (actions/checkout,
pnpm/action-setup, actions/setup-node) update their usages to reference the
specific full commit SHA instead of `@v6` / `@v5` / `@v6`; locate the three lines
using "uses: actions/checkout", "uses: pnpm/action-setup", and "uses:
actions/setup-node" and substitute each tag with the corresponding full commit
SHA obtained from the action's repository (and add a short comment noting the
SHA and date for rotation policy).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@package.json`:
- Around line 59-69: The package.json declares engines.node as ">=18" but
includes vitest (vitest@3.2.4) and ESLint (eslint@9.39.4) which require Node
>=20.0.0 and >=18.18.0 respectively; update the engines.node constraint in
package.json (the "engines.node" field) to ">=20.0.0" (or a compatible >=20
range) so vitest and eslint requirements are satisfied, then run npm install and
CI to validate; look for references to vitest and eslint in the
dependencies/devDependencies to confirm compatibility.

In `@src/transform.ts`:
- Line 14: Change the suppression comment in src/transform.ts from "//
`@ts-expect-error`: No typinggs needed" to use the correct spelling "typings"
(i.e., "// `@ts-expect-error`: No typings needed") so the rationale reads
correctly; update the comment text near the existing `@ts-expect-error` usage to
fix the typo without altering behavior.
- Line 149: The current extraction for emitsContent uses content.match on a
regex with `.*?` which fails on multiline arrays; update the match in
src/transform.ts where emitsContent is assigned (the content.match(...) call
that sets emitsContent) to use a dot-all-aware pattern (either enable the regex
`s`/dotAll flag or replace `.*?` with a character class that matches newlines,
e.g., `[\s\S]*?`) so multiline `emits` arrays are captured; keep the same
capture group and fallback behavior (?.[1] || '').

---

Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 23-29: Replace the floating action tags with pinned commit SHAs:
for the actions used (actions/checkout, pnpm/action-setup, actions/setup-node)
update their usages to reference the specific full commit SHA instead of `@v6` /
`@v5` / `@v6`; locate the three lines using "uses: actions/checkout", "uses:
pnpm/action-setup", and "uses: actions/setup-node" and substitute each tag with
the corresponding full commit SHA obtained from the action's repository (and add
a short comment noting the SHA and date for rotation policy).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c79c8a5b-6365-4c56-b0d3-b90c6af9e434

📥 Commits

Reviewing files that changed from the base of the PR and between 6b3f600 and 2a03cea.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (9)
  • .github/workflows/ci.yml
  • .github/workflows/release.yml
  • package.json
  • src/cli-lib.test.ts
  • src/cli-lib.ts
  • src/index.ts
  • src/transform.test.ts
  • src/transform.ts
  • src/transformFile.ts

Comment thread package.json Outdated
Comment on lines +59 to +69
"@antfu/eslint-config": "^3.16.0",
"@babel/traverse": "^7.29.0",
"@types/babel__core": "^7.20.5",
"@types/babel__traverse": "^7.20.5",
"@types/babel__traverse": "^7.28.0",
"@types/node": "18.15.11",
"bumpp": "^9.4.1",
"eslint": "^9.2.0",
"bumpp": "^10.4.1",
"eslint": "^9.39.4",
"npm-run-all": "^4.1.5",
"rimraf": "^5.0.7",
"tsup": "^8.0.2",
"vitest": "^1.6.0"
"rimraf": "^5.0.10",
"tsup": "^8.5.1",
"vitest": "^3.2.4"

@coderabbitai coderabbitai Bot Apr 4, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

python - <<'PY'
import json, urllib.parse, urllib.request

packages = {
    "eslint": "9.39.4",
    "vitest": "3.2.4",
    "tsup": "8.5.1",
    "bumpp": "10.4.1",
    "@antfu/eslint-config": "3.16.0",
    "@babel/traverse": "7.29.0",
}

for name, version in packages.items():
    encoded = urllib.parse.quote(name, safe="")
    url = f"https://registry.npmjs.org/{encoded}/{version}"
    with urllib.request.urlopen(url, timeout=20) as r:
        data = json.load(r)
    print(f"{name}@{version} -> engines.node={data.get('engines', {}).get('node')}")
PY

Repository: unovue/detypes

Length of output: 2640


🏁 Script executed:

# Find and read package.json to see current engine specification
git ls-files | grep -E "^package\.json$"

Repository: unovue/detypes

Length of output: 70


🌐 Web query:

eslint 9.39.4 node version requirement

💡 Result:

ESLint 9.39.4 requires Node.js ^18.18.0, ^20.9.0, or >=21.1.0.

Citations:


🌐 Web query:

vitest 3.2.4 minimum node version

💡 Result:

Node.js >= 20.0.0

Citations:


🌐 Web query:

tsup 8.5.1 node engine requirement

💡 Result:

tsup 8.5.1 requires Node.js ^14.18.0 or higher.

Citations:


🏁 Script executed:

cat -n package.json | grep -A 3 -B 3 '"engines"'

Repository: unovue/detypes

Length of output: 199


Tighten Node engine floor to accommodate vitest 3.2.4 requirements.

Lines 59–69 include vitest@3.2.4, which requires Node.js >=20.0.0. The current engines.node: ">=18" declaration is incompatible with this dependency. ESLint 9.39.4 also requires at least Node.js 18.18.0. Update the engine constraint to:

  "engines": {
-    "node": ">=18"
+    "node": ">=20"
  },
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 59 - 69, The package.json declares engines.node as
">=18" but includes vitest (vitest@3.2.4) and ESLint (eslint@9.39.4) which
require Node >=20.0.0 and >=18.18.0 respectively; update the engines.node
constraint in package.json (the "engines.node" field) to ">=20.0.0" (or a
compatible >=20 range) so vitest and eslint requirements are satisfied, then run
npm install and CI to validate; look for references to vitest and eslint in the
dependencies/devDependencies to confirm compatibility.

@nakrovati nakrovati Apr 4, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Vitest 3.2.4 supports Node.js 18 - https://npmx.dev/package-code/vitest/v/3.2.4/package.json.

The older version of ESLint used in the library also didn't support Node.js <18.18.0 - https://npmx.dev/package-code/eslint/v/9.2.0/package.json

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nakrovati, you're absolutely right on both points. I apologize for the incorrect review comment.

  1. Vitest 3.2.4 and Node 18: As you pointed out, Vitest 3.x supports Node.js 18. The >=20.0.0 requirement only applies to Vitest 4.0, not 3.x. The existing learning in my knowledge base already captures this.

  2. ESLint pre-existing constraint: ESLint v9.0.0 introduced the Node.js requirement of ^18.18.0 || ^20.9.0 || >=21.1.0, dropping support for all versions prior to v18.18.0. Since eslint@9.2.0 (the version used before this PR) had the same requirement, the slight looseness of engines.node: ">=18" relative to ESLint's actual minimum of 18.18.0 was a pre-existing condition, not something introduced by this PR. This PR doesn't make the situation any worse.

I'll record this for future reviews.


✏️ Learnings added
Learnt from: nakrovati
Repo: unovue/detypes PR: 1
File: package.json:59-69
Timestamp: 2026-04-04T23:55:49.992Z
Learning: In the unovue/detypes repository, the engines.node field is ">=18". ESLint 9.x (from v9.0.0 onwards, including v9.2.0 used before PR `#1` and v9.39.4 used after) requires Node.js ^18.18.0 || ^20.9.0 || >=21.1.0. This slight looseness of engines.node relative to ESLint's actual minimum (18.18.0 vs 18.0.0) is a pre-existing condition that predates PR `#1`, not a regression introduced by it. Do not flag this as a new issue in PRs to this repo.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.


🧠 Learnings used
Learnt from: nakrovati
Repo: unovue/detypes PR: 1
File: package.json:59-69
Timestamp: 2026-04-04T23:51:17.463Z
Learning: When reviewing a Node project’s package.json, do not flag Vitest engine incompatibility if the project uses vitest@^3.x (e.g., 3.2.4) and its engines.node is >=18. The Node.js >=20.0.0 engine requirement was introduced in Vitest 4.0, not Vitest 3.x; Vitest 3.x supports Node.js 18.

Comment thread src/transform.ts Outdated
Comment thread src/transform.ts Outdated
@nakrovati
nakrovati force-pushed the refactor/reduce-deps-count branch from 2a03cea to 16e5f1a Compare April 4, 2026 23:46
@nakrovati
nakrovati force-pushed the refactor/reduce-deps-count branch from 3a48a76 to 9c8c034 Compare May 24, 2026 00:57

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)

23-29: 🏗️ Heavy lift

Consider pinning GitHub Actions to commit SHAs for supply chain security.

The workflow uses mutable tag references (@v6, @v5) instead of immutable commit SHAs. Tag references can be moved by attackers with repository access, creating a supply chain risk. This pattern also appears in .github/workflows/release.yml.

While this is a pre-existing pattern (not introduced by this PR), consider migrating to SHA pinning with version comments for better supply chain security:

- uses: actions/checkout@<SHA>  # v6.x.x
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 23 - 29, The workflow uses mutable
action tags (actions/checkout@v6, pnpm/action-setup@v5, actions/setup-node@v6)
which should be pinned to commit SHAs for supply-chain security; update each
`uses:` entry to the corresponding immutable commit SHA (keeping a trailing
comment with the human-readable tag like `# v6.x.x`) and apply the same SHA-pin
changes in the other workflow file referenced (.github/workflows/release.yml),
ensuring you replace each tag reference with the exact commit SHA for that
action while preserving version comments for readability.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 23-29: The workflow uses mutable action tags (actions/checkout@v6,
pnpm/action-setup@v5, actions/setup-node@v6) which should be pinned to commit
SHAs for supply-chain security; update each `uses:` entry to the corresponding
immutable commit SHA (keeping a trailing comment with the human-readable tag
like `# v6.x.x`) and apply the same SHA-pin changes in the other workflow file
referenced (.github/workflows/release.yml), ensuring you replace each tag
reference with the exact commit SHA for that action while preserving version
comments for readability.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f5228861-8134-459c-bc7b-afe30c16be09

📥 Commits

Reviewing files that changed from the base of the PR and between 3a48a76 and 9c8c034.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (9)
  • .github/workflows/ci.yml
  • .github/workflows/release.yml
  • package.json
  • src/cli-lib.test.ts
  • src/cli-lib.ts
  • src/index.ts
  • src/transform.test.ts
  • src/transform.ts
  • src/transformFile.ts
✅ Files skipped from review due to trivial changes (3)
  • src/transformFile.ts
  • src/cli-lib.test.ts
  • src/index.ts

@nakrovati
nakrovati force-pushed the refactor/reduce-deps-count branch 2 times, most recently from 455e152 to 7702705 Compare May 24, 2026 01:35

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

♻️ Duplicate comments (1)
src/transform.ts (1)

141-142: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Use a newline-safe, bounded emits capture regex.

Line 142 can fail for multiline arrays and can over-capture due greedy .* with optional closing bracket. Use a bounded bracket capture like [\s\S]*? to reliably restore defineEmits(...).

Suggested fix
-      // eslint-disable-next-line regexp/optimal-quantifier-concatenation
-      emitsContent = content.match(/\semits:\s(\[.*\]?)/)?.[1] || ''
+      emitsContent = content.match(/\semits:\s(\[[\s\S]*?\])/)?.[1] || ''
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/transform.ts` around lines 141 - 142, The current capture for
emitsContent uses a greedy single-line regex and can fail on multiline arrays;
update the match in the emitsContent assignment to use a newline-safe,
non-greedy bracket capture (e.g., capture the contents between square brackets
with a pattern like \[([\s\S]*?)\]) so multiline emits arrays are correctly
captured and you don't over-capture; modify the code that assigns emitsContent
(the content.match(...) call) to use this bounded, non-greedy regex and keep the
fallback to '' unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 23-29: CI workflow currently references mutable action tags
(actions/checkout@v6, pnpm/action-setup@v5, actions/setup-node@v6); replace each
`uses:` entry with the corresponding full commit SHA for the specific release
you intend to pin (e.g., actions/checkout@<full-sha>,
pnpm/action-setup@<full-sha>, actions/setup-node@<full-sha>) so the workflow
uses immutable references, and update the commit SHAs when you intentionally
upgrade the actions; locate those three `uses:` lines and swap the tag suffixes
for the matching full commit SHAs from each action's GitHub repository.

In @.github/workflows/release.yml:
- Around line 12-20: Replace floating major tags with pinned commit SHAs for
each action referenced (actions/checkout, pnpm/action-setup, actions/setup-node)
by updating their version strings to the corresponding full commit SHA;
additionally, in the actions/checkout step (the block using actions/checkout)
add persist-credentials: false to disable credential persistence. Ensure the
three action uses are updated to SHA pins and that only the checkout step
includes the persist-credentials: false key.

---

Duplicate comments:
In `@src/transform.ts`:
- Around line 141-142: The current capture for emitsContent uses a greedy
single-line regex and can fail on multiline arrays; update the match in the
emitsContent assignment to use a newline-safe, non-greedy bracket capture (e.g.,
capture the contents between square brackets with a pattern like \[([\s\S]*?)\])
so multiline emits arrays are correctly captured and you don't over-capture;
modify the code that assigns emitsContent (the content.match(...) call) to use
this bounded, non-greedy regex and keep the fallback to '' unchanged.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: dc51766b-7f07-4c81-b66f-f20fd9eab63b

📥 Commits

Reviewing files that changed from the base of the PR and between 9c8c034 and 74efc42.

⛔ Files ignored due to path filters (1)
  • pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml
📒 Files selected for processing (10)
  • .github/workflows/ci.yml
  • .github/workflows/release.yml
  • package.json
  • pnpm-workspace.yaml
  • src/cli-lib.test.ts
  • src/cli-lib.ts
  • src/index.ts
  • src/transform.test.ts
  • src/transform.ts
  • src/transformFile.ts
✅ Files skipped from review due to trivial changes (4)
  • pnpm-workspace.yaml
  • src/index.ts
  • src/cli-lib.test.ts
  • src/transformFile.ts

Comment thread .github/workflows/ci.yml
Comment on lines +23 to +29
uses: actions/checkout@v6

- name: Install pnpm
uses: pnpm/action-setup@v2
uses: pnpm/action-setup@v5

- name: Set node
uses: actions/setup-node@v3
uses: actions/setup-node@v6

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/ci.yml"
echo "== File = $FILE"
if [ -f "$FILE" ]; then
  nl -ba "$FILE" | sed -n '1,120p'
else
  echo "Missing $FILE"
  exit 1
fi

echo
echo "== uses: lines containing actions/checkout, pnpm/action-setup, actions/setup-node"
rg -n "uses:\s*(actions/checkout|pnpm/action-setup|actions/setup-node)@" "$FILE" || true

echo
echo "== All uses: action references in ci.yml (for context)"
rg -n "uses:\s*[^#\s]+@" "$FILE" || true

echo
echo "== Check if any commit-SHA pinning is used in ci.yml"
rg -n "uses:\s*[^#\s]+@[0-9a-f]{7,40}\b" "$FILE" || true

Repository: unovue/detypes

Length of output: 154


🏁 Script executed:

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/ci.yml"
echo "== File = $FILE"
test -f "$FILE"

echo
echo "== First 120 lines with line numbers (fallback to awk)"
awk '{printf "%5d  %s\n", NR, $0}' "$FILE" | sed -n '1,120p'

echo
echo "== uses: lines containing actions/checkout, pnpm/action-setup, actions/setup-node"
rg -n "uses:\s*(actions/checkout|pnpm/action-setup|actions/setup-node)@" "$FILE" || true

echo
echo "== All uses: action references in ci.yml (context)"
rg -n "uses:\s*[^#\s]+@" "$FILE" || true

echo
echo "== Check if any uses are pinned to commit-SHA in ci.yml"
rg -n "uses:\s*[^#\s]+@[0-9a-f]{7,40}\b" "$FILE" || true

Repository: unovue/detypes

Length of output: 1853


Pin GitHub Actions to commit SHAs (ci.yml supply-chain hardening)

.github/workflows/ci.yml uses unpinned action tags on Lines 23/26/29: actions/checkout@v6, pnpm/action-setup@v5, and actions/setup-node@v6. Pinning these uses: to full commit SHAs reduces CI supply-chain risk.

Suggested hardening patch
-      - name: Checkout
-        uses: actions/checkout@v6
+      - name: Checkout
+        uses: actions/checkout@<full-commit-sha>

-      - name: Install pnpm
-        uses: pnpm/action-setup@v5
+      - name: Install pnpm
+        uses: pnpm/action-setup@<full-commit-sha>

-      - name: Set node
-        uses: actions/setup-node@v6
+      - name: Set node
+        uses: actions/setup-node@<full-commit-sha>
🧰 Tools
🪛 zizmor (1.25.2)

[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)


[error] 26-26: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)


[error] 29-29: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 23 - 29, CI workflow currently
references mutable action tags (actions/checkout@v6, pnpm/action-setup@v5,
actions/setup-node@v6); replace each `uses:` entry with the corresponding full
commit SHA for the specific release you intend to pin (e.g.,
actions/checkout@<full-sha>, pnpm/action-setup@<full-sha>,
actions/setup-node@<full-sha>) so the workflow uses immutable references, and
update the commit SHAs when you intentionally upgrade the actions; locate those
three `uses:` lines and swap the tag suffixes for the matching full commit SHAs
from each action's GitHub repository.

Comment on lines +12 to +20
- uses: actions/checkout@v6
with:
fetch-depth: 0

- name: Install pnpm
uses: pnpm/action-setup@v2
uses: pnpm/action-setup@v5

- name: Set node
uses: actions/setup-node@v3
uses: actions/setup-node@v6

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Harden release workflow: pin actions and disable checkout credential persistence.

In .github/workflows/release.yml (release steps), the workflow uses floating major action tags (actions/checkout@v6, pnpm/action-setup@v5, actions/setup-node@v6). Pin these to full commit SHAs, and add persist-credentials: false to the checkout step to reduce token/credential exposure.

Suggested hardening patch
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@<full-commit-sha>
         with:
           fetch-depth: 0
+          persist-credentials: false

-      - name: Install pnpm
-        uses: pnpm/action-setup@v5
+      - name: Install pnpm
+        uses: pnpm/action-setup@<full-commit-sha>

-      - name: Set node
-        uses: actions/setup-node@v6
+      - name: Set node
+        uses: actions/setup-node@<full-commit-sha>
🧰 Tools
🪛 zizmor (1.25.2)

[warning] 12-14: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)


[error] 12-12: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)


[error] 17-17: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)


[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)


[error] 20-20: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): this step

(cache-poisoning)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/release.yml around lines 12 - 20, Replace floating major
tags with pinned commit SHAs for each action referenced (actions/checkout,
pnpm/action-setup, actions/setup-node) by updating their version strings to the
corresponding full commit SHA; additionally, in the actions/checkout step (the
block using actions/checkout) add persist-credentials: false to disable
credential persistence. Ensure the three action uses are updated to SHA pins and
that only the checkout step includes the persist-credentials: false key.

@nakrovati
nakrovati force-pushed the refactor/reduce-deps-count branch from 74efc42 to 7a85ab0 Compare June 15, 2026 17:25
Update PNPM to version 10.34.3, because the current version of PNPM has
many vulnerabilities: https://github.com/pnpm/pnpm/security.
Remove `npm-run-all` - it is unused, deprecated, and has many
dependencies.
@nakrovati
nakrovati force-pushed the refactor/reduce-deps-count branch from 7a85ab0 to 6952b3d Compare June 15, 2026 17:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant