ci: clean up publish and docs deploy workflows#158
Conversation
Dependabot PRs trigger CI workflows that fail and show red badges. Security alerts (vulnerability_alerts) remain enabled via Terraform. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…o fix/ci-seo-lint-cleanup
jaysin586
added
the
skip-publish
|
Warning Review limit reached
More reviews will be available in 7 minutes and 57 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThis PR updates CI/CD workflows, tooling versions, and deployment infrastructure. Primary changes include migrating docs deployment from Cloudflare Pages to Workers, standardizing pnpm action versions to v6 across all workflows, refining publish job dependencies and version bumping logic, and upgrading Trunk plugin and tool versions alongside project dependencies. ChangesTooling and Infrastructure Updates
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🧹 Nitpick comments (1)
docs/scripts/generate-sitemap-manifest.mjs (1)
116-116: 💤 Low valueRemove no-op replace.
.replace(/: null/g, ': null')substitutes a string with itself — it has no effect and can be dropped.♻️ Proposed cleanup
.replace(/: "([^"]*)"/g, (_, value) => `: '${value}'`) - .replace(/: null/g, ': null')🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/scripts/generate-sitemap-manifest.mjs` at line 116, Remove the no-op string replacement call .replace(/: null/g, ': null') from the string processing chain in generate-sitemap-manifest.mjs; locate the expression that chains .replace calls (the occurrence of ".replace(/: null/g, ': null')") and delete that specific replace invocation so the surrounding replacements remain unchanged, then run the script or build to verify no behavioral change.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/cloudflare-deploy.yml:
- Line 36: The pnpm/action-setup@v6 step lacks a pnpm version to install causing
failure; either add a `with: version: "<pnpm-version>"` input to the
pnpm/action-setup@v6 step in the Cloudflare deploy workflow or add a root
package.json "packageManager": "pnpm@<pnpm-version>" field so the action can
resolve the version; update the step referencing pnpm/action-setup@v6 or the
root package.json accordingly and ensure the version string (e.g., "7.23.0") is
pinned.
In @.github/workflows/coveralls.yml:
- Line 26: The workflow step using "uses: pnpm/action-setup@v6" does not pin a
pnpm version and therefore can’t infer a deterministic version because
package.json lacks packageManager; update the coveralls workflow step to include
a pinned pnpm version by adding a with: version entry for the
pnpm/action-setup@v6 step (or alternatively add a packageManager field to the
root package.json) so that subsequent pnpm install --frozen-lockfile runs
deterministically.
In @.trunk/trunk.yaml:
- Line 17: The runtimes.enabled entry currently pins python@3.14.4 which is
unsupported by Checkov; update the runtimes.enabled value to pin a
Checkov-supported interpreter (e.g., change python@3.14.4 to python@3.13.x) so
Python-based linters like Checkov run correctly; verify the YAML value for
runtimes.enabled and ensure any dependent config referencing that runtime (e.g.,
Checkov enablement) continues to reference the updated python@3.13.x string.
In `@docs/scripts/generate-sitemap-manifest.mjs`:
- Line 115: The current replacement .replace(/: "([^"]*)"/g, (_, value) => `:
'${value}'`) (in generate-sitemap-manifest.mjs) turns double-quoted values into
single-quoted ones but does not escape inner single quotes, producing invalid JS
for strings like "User's Guide"; update the arrow function to escape single
quotes inside value before wrapping (e.g., transform value with a replace that
converts ' to \\' or otherwise escape single quotes) so the resulting `: '...'`
string is valid JavaScript.
In `@package.json`:
- Around line 109-110: Add a top-level packageManager field to package.json to
pin the pnpm version used by CI (e.g., "pnpm@X.Y.Z") so pnpm/action-setup@v6 has
a deterministic version to install; update package.json alongside the existing
volta.node and pnpm.overrides entries, ensuring the pinned version matches the
one expected by your workflows and CI.
In `@pnpm-workspace.yaml`:
- Around line 10-14: Remove the legacy onlyBuiltDependencies block and its
entries (the keys named onlyBuiltDependencies and the list items
'`@humanspeak/docs-kit`', esbuild, sharp, workerd) from the workspace config; if
you still need to restrict approved builds, replace it with the modern
allowBuilds setting using the same package names (use allowBuilds: with
appropriate entries) so pnpm v11+ uses the new behavior instead of the
deprecated field.
---
Nitpick comments:
In `@docs/scripts/generate-sitemap-manifest.mjs`:
- Line 116: Remove the no-op string replacement call .replace(/: null/g, ':
null') from the string processing chain in generate-sitemap-manifest.mjs; locate
the expression that chains .replace calls (the occurrence of ".replace(/:
null/g, ': null')") and delete that specific replace invocation so the
surrounding replacements remain unchanged, then run the script or build to
verify no behavioral change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 5a797eaa-15dd-4b0c-9ec2-c1ecd1ccd96b
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml,!pnpm-lock.yaml
📒 Files selected for processing (13)
.github/dependabot.yml.github/workflows/cloudflare-deploy.yml.github/workflows/coveralls.yml.github/workflows/npm-publish.yml.github/workflows/run-tests.yml.trunk/setup-ci/action.yaml.trunk/trunk.yamldocs/package.jsondocs/scripts/generate-sitemap-manifest.mjsdocs/src/worker-configuration.d.tsdocs/wrangler.jsoncpackage.jsonpnpm-workspace.yaml
💤 Files with no reviewable changes (1)
- .github/dependabot.yml
| - go@1.21.0 | ||
| - node@22.16.0 | ||
| - python@3.10.8 | ||
| - python@3.14.4 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What Python versions does Checkov currently support, and does Trunk use the Python version pinned under runtimes.enabled for Python-based linters such as Checkov?
💡 Result:
As of June 2, 2026, Checkov officially supports Python versions 3.9 through 3.13, inclusive [1][2]. The project maintains this support by following the official Python release cycle and conducting automated tests across these supported versions [1][2]. Regarding Trunk, it does not rely on a user-provided or local Python installation for its managed linters [3]. Instead, Trunk manages the runtimes required for its tools—including Checkov—automatically [3]. When you configure runtimes in your repository's.trunk/trunk.yaml file, such as under runtimes.enabled, you are specifying the versions Trunk should use to run those tools [3][4]. Trunk caches these linters, formatters, and their respective runtime environments (e.g., specific Python versions) in ~/.cache/trunk, ensuring that the tool execution is isolated and consistent across different environments regardless of what is installed on the host machine [3].
Citations:
- 1: https://pypi.org/project/checkov/
- 2: https://github.com/bridgecrewio/checkov
- 3: https://marketplace.visualstudio.com/items?itemName=Trunk.io
- 4: https://blog.hungovercoders.com/datagriff/2024/08/15/protecting-code-quality-with-trunk.io.html
Pin Trunk’s Python runtime to a Checkov-supported version (≤3.13)
In .trunk/trunk.yaml, runtimes.enabled pins python@3.14.4 (line 17) while Checkov supports Python only up through 3.13. Trunk uses the configured runtimes.enabled Python version to run Python-based linters like Checkov (enabled on line 34), so this can break local/CI runs. Pin Python to python@3.13.x until Checkov adds 3.14 support.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.trunk/trunk.yaml at line 17, The runtimes.enabled entry currently pins
python@3.14.4 which is unsupported by Checkov; update the runtimes.enabled value
to pin a Checkov-supported interpreter (e.g., change python@3.14.4 to
python@3.13.x) so Python-based linters like Checkov run correctly; verify the
YAML value for runtimes.enabled and ensure any dependent config referencing that
runtime (e.g., Checkov enablement) continues to reference the updated
python@3.13.x string.
| .replace(/"([^"]+)":/g, (_, key) => | ||
| /^[a-zA-Z_$][a-zA-Z0-9_$]*$/.test(key) ? `${key}:` : `'${key}':` | ||
| ) | ||
| .replace(/: "([^"]*)"/g, (_, value) => `: '${value}'`) |
There was a problem hiding this comment.
Escape single quotes when converting values to single-quoted strings.
Converting : "value" → : 'value' doesn't escape apostrophes inside the value. JSON does not escape ', so a title/sourceUrl containing an apostrophe (e.g. metadata title User's Guide) emits 'User's Guide', producing invalid JS that breaks the generated +page.ts.
🐛 Proposed fix to escape inner single quotes
- .replace(/: "([^"]*)"/g, (_, value) => `: '${value}'`)
+ .replace(/: "([^"]*)"/g, (_, value) => `: '${value.replace(/'/g, "\\'")}'`)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| .replace(/: "([^"]*)"/g, (_, value) => `: '${value}'`) | |
| .replace(/: "([^"]*)"/g, (_, value) => `: '${value.replace(/'/g, "\\'")}'`) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/scripts/generate-sitemap-manifest.mjs` at line 115, The current
replacement .replace(/: "([^"]*)"/g, (_, value) => `: '${value}'`) (in
generate-sitemap-manifest.mjs) turns double-quoted values into single-quoted
ones but does not escape inner single quotes, producing invalid JS for strings
like "User's Guide"; update the arrow function to escape single quotes inside
value before wrapping (e.g., transform value with a replace that converts ' to
\\' or otherwise escape single quotes) so the resulting `: '...'` string is
valid JavaScript.
| onlyBuiltDependencies: | ||
| - '@humanspeak/docs-kit' | ||
| - esbuild | ||
| - sharp | ||
| - workerd |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show relevant part of pnpm-workspace.yaml (with line numbers)
if [ -f "pnpm-workspace.yaml" ]; then
nl -ba pnpm-workspace.yaml | sed -n '1,160p'
else
echo "Missing pnpm-workspace.yaml"
fi
# Search repo for both settings
rg -n "allowBuilds|onlyBuiltDependencies" -S .Repository: humanspeak/memory-cache
Length of output: 110
🌐 Web query:
pnpm settings onlyBuiltDependencies removed in v11 allowBuilds replacement
💡 Result:
In pnpm v11, the settings onlyBuiltDependencies (and related onlyBuiltDependenciesFile, neverBuiltDependencies, ignoredBuiltDependencies, and ignoreDepScripts) were removed and replaced by the single allowBuilds setting (a map of package name patterns to booleans). [1][2][3] Practical replacement: - Before (v10-era): onlyBuiltDependencies: [electron] neverBuiltDependencies: [core-js] ignoredBuiltDependencies: [esbuild] - After (v11+): allowBuilds: electron: true core-js: false esbuild: false [2][3] Related detail: pnpm provides a CLI workflow (pnpm approve-builds) that adds entries into allowBuilds (pnpm-workspace.yaml) with true for approved packages and false for unapproved ones; it also fills allowBuilds placeholders for ignored builds that aren’t yet in the file. [4] Note: The pnpm v11 migration guides explicitly instruct you to migrate onlyBuiltDependencies and friends to allowBuilds. [1][3]
Citations:
- 1: https://pnpm.io/migration
- 2: https://pnpm.io/blog/releases/11.0
- 3: https://pnpm.io/settings
- 4: https://pnpm.io/cli/approve-builds
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show pnpm-workspace.yaml with line numbers (no nl dependency)
if [ -f "pnpm-workspace.yaml" ]; then
awk '{printf "%5d\t%s\n", NR, $0}' pnpm-workspace.yaml | sed -n '1,200p'
else
echo "Missing pnpm-workspace.yaml"
exit 1
fi
# Search specifically within pnpm-workspace.yaml
rg -n "onlyBuiltDependencies|allowBuilds" pnpm-workspace.yaml || true
# Also search across repo for both keys (in case they appear elsewhere)
rg -n "onlyBuiltDependencies|allowBuilds" -S . || trueRepository: humanspeak/memory-cache
Length of output: 587
Drop the legacy onlyBuiltDependencies list.
pnpm v11 removed onlyBuiltDependencies in favor of allowBuilds; keeping both makes build approval behavior depend on the pnpm version reading the workspace config. (See https://pnpm.io/settings and https://pnpm.io/migration)
Suggested cleanup
allowBuilds:
'`@humanspeak/docs-kit`': true
esbuild: true
sharp: true
workerd: true
-onlyBuiltDependencies:
- - '`@humanspeak/docs-kit`'
- - esbuild
- - sharp
- - workerd
minimumReleaseAge: 2880
minimumReleaseAgeExclude:
- '`@humanspeak/`*'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pnpm-workspace.yaml` around lines 10 - 14, Remove the legacy
onlyBuiltDependencies block and its entries (the keys named
onlyBuiltDependencies and the list items '`@humanspeak/docs-kit`', esbuild, sharp,
workerd) from the workspace config; if you still need to restrict approved
builds, replace it with the modern allowBuilds setting using the same package
names (use allowBuilds: with appropriate entries) so pnpm v11+ uses the new
behavior instead of the deprecated field.
|
⏭️ NPM publishing was skipped due to the |
1 participant
Summary
This PR cleans up CI and docs deployment so the docs site deploys through Cloudflare Workers instead of Pages, while keeping publish workflows safer around skipped releases and dependency/tooling changes.
Changes
skip-publishlabel detection and make publish/coverage jobs tolerate skipped or failed Coveralls steps without blocking cleanup behavior..ncuskipfiles.Commits
a52cd7eci: update pnpm setup action13f665fchore: apply ci cleanup updatesb316904ci: migrate docs deploy to Workersd76e585build: allow pnpm dependency builds8f4c0f3Merge branch 'main' of https://github.com/humanspeak/memory-cache into fix/ci-seo-lint-cleanup5805b4bchore: add typescript to .ncuskip to prevent major version bumps99c4e4eRemove dependabot version updates