Switch to ESM, switch to Rolldown, bump deps, switch dev tools#56
Merged
Conversation
Signed-off-by: Guillaume Bonnet <mrsquaare@mrsquaare.fr>
Signed-off-by: Guillaume Bonnet <mrsquaare@mrsquaare.fr>
Signed-off-by: Guillaume Bonnet <mrsquaare@mrsquaare.fr>
Signed-off-by: Guillaume Bonnet <mrsquaare@mrsquaare.fr>
Signed-off-by: Guillaume Bonnet <mrsquaare@mrsquaare.fr>
Signed-off-by: Guillaume Bonnet <mrsquaare@mrsquaare.fr>
WalkthroughUpdates build and CI tooling, adds OxFMT/Oxlint configs, introduces Rolldown build config, migrates cleanup to ESM, removes ESLint config, bumps package metadata/dependencies, and replaces workflow steps with a new setup-env composite action and streamlined GitHub Actions workflow. Changes
Sequence Diagram(s)sequenceDiagram
participant PR as Pull Request / Trigger
participant Runner as GitHub Actions Runner
participant Checkout as actions/checkout
participant SetupEnv as .github/actions/setup-env
participant PNPM as pnpm (installer)
participant Node as Node.js setup
participant Scripts as repo scripts (build/test)
PR->>Runner: workflow triggered
Runner->>Checkout: checkout repository
Runner->>SetupEnv: run composite setup action
SetupEnv->>PNPM: install pnpm (pnpm/action-setup)
SetupEnv->>Node: setup Node 20 (actions/setup-node)
SetupEnv->>Runner: dependencies installed (pnpm install)
Runner->>Scripts: run lint/build/test scripts (via pnpm)
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Suggested labels
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
rolldown.config.ts (1)
3-21: Deduplicate the repeated bundle config.Both entries only differ by
inputandoutput.file. Pulling the shared options into a small helper will make future build changes less error-prone.Refactor sketch
import { defineConfig } from "rolldown"; +const createBundle = (input: string, file: string) => ({ + input, + output: { + file, + format: "esm", + comments: false, + }, + platform: "node" as const, +}); + export default defineConfig([ - { - input: "src/index.ts", - output: { - file: "lib/index.js", - format: "esm", - comments: false, - }, - platform: "node", - }, - { - input: "src/cleanup.ts", - output: { - file: "lib/cleanup.js", - format: "esm", - comments: false, - }, - platform: "node", - }, + createBundle("src/index.ts", "lib/index.js"), + createBundle("src/cleanup.ts", "lib/cleanup.js"), ]);🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@rolldown.config.ts` around lines 3 - 21, The two config objects passed into defineConfig are duplicated except for input and output.file; extract the shared settings into a small factory helper (e.g., makeConfig or createBundleConfig) that accepts inputPath and outputFile and returns an object with the common output (format: "esm", comments: false) and platform: "node", then replace the two inline objects with calls to that helper (referencing defineConfig, input, output.file, output.format, comments, and platform to locate where to change).package.json (1)
33-33: Consider pinning to stable Rolldown once available.Using a release candidate (
1.0.0-rc.7) for build tooling is acceptable, but be aware that RC versions may introduce breaking changes between releases. Consider upgrading to a stable version once Rolldown reaches 1.0.0.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` at line 33, The package.json currently pins the build tool dependency "rolldown" to the release candidate "1.0.0-rc.7"; update the version field for "rolldown" to the stable 1.0.0 (or the first stable semver you adopt) once it is released and consider using a stable pin (e.g., "1.0.0" or a caret range like "^1.0.0" per your project's dependency policy) to avoid tracking RC releases in the future.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/cleanup.ts`:
- Around line 8-11: Remove the duplicate warning by logging only once: inside
the block that checks "error instanceof Error" (the cleanup code that stops the
SSH agent), replace the two console.warn calls with a single console.warn that
conditionally includes error.message/details when the error is an Error and
otherwise logs a generic message; ensure the code path that handles Error
instances does not fall through to the generic console.warn so you don't emit
two warnings.
---
Nitpick comments:
In `@package.json`:
- Line 33: The package.json currently pins the build tool dependency "rolldown"
to the release candidate "1.0.0-rc.7"; update the version field for "rolldown"
to the stable 1.0.0 (or the first stable semver you adopt) once it is released
and consider using a stable pin (e.g., "1.0.0" or a caret range like "^1.0.0"
per your project's dependency policy) to avoid tracking RC releases in the
future.
In `@rolldown.config.ts`:
- Around line 3-21: The two config objects passed into defineConfig are
duplicated except for input and output.file; extract the shared settings into a
small factory helper (e.g., makeConfig or createBundleConfig) that accepts
inputPath and outputFile and returns an object with the common output (format:
"esm", comments: false) and platform: "node", then replace the two inline
objects with calls to that helper (referencing defineConfig, input, output.file,
output.format, comments, and platform to locate where to change).
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f6643f79-1fb6-4b09-9165-243cacb207c7
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (12)
.codacy.yml.oxfmtrc.json.oxlintrc.jsonCONTRIBUTING.mdREADME.mdeslint.config.mjslib/cleanup.jslib/index.jspackage.jsonrolldown.config.tssrc/cleanup.tssrc/index.ts
💤 Files with no reviewable changes (1)
- eslint.config.mjs
Signed-off-by: Guillaume Bonnet <mrsquaare@mrsquaare.fr>
MrSquaare
changed the title
There was a problem hiding this comment.
🧹 Nitpick comments (3)
.github/actions/setup-env/action.yml (1)
8-14: Pin these action references to full commit SHAs.
pnpm/action-setup@v4andactions/setup-node@v6are mutable tags. Since this helper is reused across CI jobs, pin them to full-length SHAs and keep the human-readable version in a comment. GitHub’s hardening guidance calls a full commit SHA the only immutable way to consume an action. (docs.github.com)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/actions/setup-env/action.yml around lines 8 - 14, Replace the mutable action references `pnpm/action-setup@v4` and `actions/setup-node@v6` with their corresponding full commit SHAs (e.g. `pnpm/action-setup@<full-sha>` and `actions/setup-node@<full-sha>`), keeping the human-readable tag (v4 / v6) as a comment for clarity; update the `uses:` entries where those two strings appear and verify the SHAs point to the intended commits on each action's repository per GitHub hardening guidance..github/workflows/pull-request.yml (2)
14-14: Pinactions/checkouthere as well.All three jobs reference
actions/checkoutthrough the mutablev6tag. In the test job, that step runs before local action code and shell steps that later consume SSH private keys, so a full commit SHA is the safer default. GitHub documents full-length SHAs as the only immutable action reference. (docs.github.com)Also applies to: 33-33, 52-52
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/pull-request.yml at line 14, Replace the mutable actions/checkout@v6 references with an immutable full commit SHA in every job that uses it (the three occurrences of actions/checkout in the workflow) so the checkout action is pinned; locate the steps referencing actions/checkout@v6 and update them to actions/checkout@<full-commit-sha> (use the corresponding full-length commit SHA for the version you want to pin) to ensure reproducible, immutable action resolution.
3-7: Declare least-privilege workflow permissions.This workflow does not set
permissions, so every job inherits the repository defaultGITHUB_TOKENscope. These jobs only appear to need read access to repository contents, so it is safer to lock that in at the workflow level and only widen a job if it later needs more. GitHub recommends granting the minimum required access because actions can readgithub.tokeneven when it is not passed explicitly. (docs.github.com)🔒 Suggested hardening
name: Pull Request on: pull_request: branches: - main workflow_dispatch: + +permissions: + contents: read jobs:🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/pull-request.yml around lines 3 - 7, Add a top-level least-privilege permissions block to the workflow so the GITHUB_TOKEN is limited to read-only repo contents; specifically, add a permissions section (e.g., permissions: contents: read) alongside the existing on: pull_request / workflow_dispatch settings so jobs inherit only read access and can be widened per-job if needed.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/actions/setup-env/action.yml:
- Around line 8-14: Replace the mutable action references `pnpm/action-setup@v4`
and `actions/setup-node@v6` with their corresponding full commit SHAs (e.g.
`pnpm/action-setup@<full-sha>` and `actions/setup-node@<full-sha>`), keeping the
human-readable tag (v4 / v6) as a comment for clarity; update the `uses:`
entries where those two strings appear and verify the SHAs point to the intended
commits on each action's repository per GitHub hardening guidance.
In @.github/workflows/pull-request.yml:
- Line 14: Replace the mutable actions/checkout@v6 references with an immutable
full commit SHA in every job that uses it (the three occurrences of
actions/checkout in the workflow) so the checkout action is pinned; locate the
steps referencing actions/checkout@v6 and update them to
actions/checkout@<full-commit-sha> (use the corresponding full-length commit SHA
for the version you want to pin) to ensure reproducible, immutable action
resolution.
- Around line 3-7: Add a top-level least-privilege permissions block to the
workflow so the GITHUB_TOKEN is limited to read-only repo contents;
specifically, add a permissions section (e.g., permissions: contents: read)
alongside the existing on: pull_request / workflow_dispatch settings so jobs
inherit only read access and can be widened per-job if needed.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 2b7ac0ec-d003-45ba-9bba-8e8bf3273d26
📒 Files selected for processing (4)
.github/actions/setup-env/action.yml.github/workflows/pull-request.yml.oxfmtrc.json.oxlintrc.json
🚧 Files skipped from review as they are similar to previous changes (2)
- .oxfmtrc.json
- .oxlintrc.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
Related issue(s)
Description
Summary by CodeRabbit
Release Notes
Chores
New Features
Style