devops: Add ci warning for swizzled docusaurus components #9467

jNullj · 2023-08-11T14:46:52Z

Add new action and workflow that runs on new dependabot PR.
The action checks changes in components of docusaurus-theme-openapi that are swizzled and warns maintainers to review those changes.
For more info see #9287

Solves #9287

Add new action and workflow that runs on new dependabot PR. The action checks changes in components of docusaurus-theme-openapi that are swizzled and warns maintainers to review those changes. For more info see badges#9287 Solves badges#9287

…ng-ci

socket-security · 2023-08-11T14:48:37Z

New dependencies detected. Learn more about Socket for GitHub ↗︎

Packages	Version	New capabilities	Transitives	Size	Publisher
@actions/github	5.1.1	environment	`+3`	316 kB	thboop
@actions/core	1.10.0	filesystem, environment	`+2`	211 kB	thboop

github-actions · 2023-08-11T14:49:12Z

	Messages
📖	✨ Thanks for your contribution to Shields, @jNullj!

Generated by 🚫 dangerJS against 6f867f7

chris48s

Thanks for working on this. This looks like it will be really useful.

I've had a read over the code and left you a first pass of comments. I've not actually run the code yet though. JS actions are very powerful, but one of the big issues is that it is quite hard to just check code like this out and run it locally to make sure it works.

How have you been testing this? Did you do it all in a test repo, or were you able to run bits of the code locally?

.github/actions/docusaurus-swizzled-warning/action.yml

.github/actions/docusaurus-swizzled-warning/index.js

chris48s · 2023-08-12T18:10:58Z

.github/actions/docusaurus-swizzled-warning/index.js

+        const pkgLockNewJson = await (await fetch(file.raw_url)).json()
+        const pkgLockOldJson = await (
+          await fetch(
+            `https://raw.githubusercontent.com/${github.context.repo.owner}/${github.context.repo.repo}/master/${file.filename}`,
+          )
+        ).json()


I don't think we need to pull in node-fetch as a dependency and request these URLs. We've got an OctoKit instance in scope, so I think we should be able to use:

octokit.rest.repos.getContent({ owner, repo, path, ref?, });

to replace both these calls.

I am new to octokit, I will look into this and add this if applicable

solved with db2e03c
notice that files are > 1MB therefor an getContent won't return content (tried even with raw)
I had to use the sha and make a new blob request.

chris48s · 2023-08-12T18:17:49Z

.github/actions/docusaurus-swizzled-warning/index.js

+    if (
+      ['dependabot[bot]', 'dependabot-preview[bot]'].includes(pr.user.login)
+    ) {
+      const files = await getAllFilesForPullRequest(
+        client,
+        github.context.repo.owner,
+        github.context.repo.repo,
+        pr.number,
+      )
+
+      for (const file of files) {
+        if (file.filename !== 'package-lock.json') {
+          continue
+        }


In general, it is harder to read large blocks of code that are deeply nested.

We can often work round nesting by taking some code like

if (condition) { // do stuff }

and re-writing it as

if (!condition) { return } // do stuff

I think we could make this whole run function easier to read by getting rid of a couple of layers of nesting here. For example:

if (!['dependabot[bot]', 'dependabot-preview[bot]'].includes(pr.user.login)) { return } const file = files.filter(f => f.filename === 'package-lock.json')[0] if (file === undefined) { return } // do something with file

This would also make it clearer that we are not expecting to process more than one package-lock.json.

I improved code readability with 81f020f
then fixed a type with 9e1c2e4

chris48s · 2023-08-12T18:28:29Z

.github/actions/docusaurus-swizzled-warning/index.js

+    const packageName = 'docusaurus-theme-openapi'
+    const packageParentName = 'docusaurus-preset-openapi'
+    const overideComponents = ['Curl', 'Response']
+    const messageTemplate = `<table><thead><tr><th>


Minor points, but:

If we have a look at your screenshot, we can see the table looks wierd because not all of the table rows have the same number of columns. Making these headers will fix that.

We're using <th> for every cell in this table, but <th> is only for headers. The "normal" cells should be <td>s.

Updating this, not sure what you mean at 1, but i used colspan="2" to fix the visual issue.

After testing

chris48s · 2023-08-12T18:29:51Z

.github/actions/docusaurus-swizzled-warning/package.json

+    "dependencies": {
+        "@actions/core": "^1.10.0",
+        "@actions/github": "^5.1.1",


If we are adding a package.json with dependencies here, we should register it with dependabot, like this:

shields/.github/dependabot.yml

Lines 33 to 41 in e9b3b50

# close-bot package dependencies

- package-ecosystem: npm

directory: '/.github/actions/close-bot'

schedule:

interval: weekly

day: friday

time: '12:00'

open-pull-requests-limit: 99

rebase-strategy: disabled

Solved with c77af69

Co-authored-by: chris48s <chris48s@users.noreply.github.com>

jNullj · 2023-08-13T12:40:13Z

Thanks for working on this. This looks like it will be really useful.

I've had a read over the code and left you a first pass of comments. I've not actually run the code yet though. JS actions are very powerful, but one of the big issues is that it is quite hard to just check code like this out and run it locally to make sure it works.

How have you been testing this? Did you do it all in a test repo, or were you able to run bits of the code locally?

Thank you for the code review and the useful insights.

Regarding testing - I used a forked repo on github for testing, I think I might be able to run it locally if i look for some testing tools or try to simulate github with a crafted payload.

chris48s

OK. Latest changes look great - thanks. I've done a bit of testing on this in another repo. I found it a bit tricky to test this, but my experience is that when it comes to these GitHub actions, there is a large extent to which we can "set it and forget it". We don't tend to be constantly changing them. So I'm not too worried about this being a bit of a pain to test.

I've left a few final comments inline, but this is 99% done.

chris48s · 2023-08-18T17:53:58Z

.github/actions/docusaurus-swizzled-warning/index.js

+      core.debug('Found changes and posted comment, done.')
+      return
+    }
+
+    core.debug('No changes found, done.')


Can we make these log statements use core.info() instead of core.debug() so they always get logged.

Sure. This would be easier to understand.
Added with 78551ff

chris48s · 2023-08-18T17:55:03Z

.github/actions/docusaurus-swizzled-warning/index.js

+    if (newVersionParent > newVersion) {
+      newVersion = newVersionParent
+    }
+


It would be useful here if we could write a log message here (again, core.info()) with oldVersion and newVersion.

Added with 5311d03

chris48s · 2023-08-18T17:55:44Z

.github/workflows/docusaurus-swizzled-warning.yml

@@ -0,0 +1,22 @@
+name: Docusaurus swizzled component changes warning
+on:
+  pull_request_target:


This workflow doesn't actually need to run on pull_request_target. It can just run on pull_request. I'm aware this is a copy & paste from close-bot, which probably could have also just used pull_request.

Oh yea, my bad, didn't notice this when I started with close-bot as a ref for the file.
Fixed with 640567d

Change core.debug to core.info so it always shows and not only when in debug.

Log old and new versions for the Docusaurus swizzled component changes warning workflow.

chris48s

Sweeeet. Thanks for working on this one

calebcartwright · 2023-08-19T03:39:13Z

Nicely done @jNullj!

jNullj added 11 commits August 10, 2023 18:55

Fix table formating

afd5505

Fix order

4e158d2

handle missing patch cases

82f66ec

fix missing fetch in node16

438a1e6

fix typo

8677c52

fix typo

6354ba2

changed from diff parse to json usage

d16d987

fix keys issues

7f9f94e

fix parent dependency version check

2a0573a

Merge branch 'badges:master' into feat/9287/docusaurus-swizzled-warni…

a1c24dd

…ng-ci

Merge branch 'master' into feat/9287/docusaurus-swizzled-warning-ci

5ccbb69

jNullj marked this pull request as ready for review August 11, 2023 14:59

chris48s reviewed Aug 12, 2023

View reviewed changes

chris48s added the developer-experience Dev tooling, test framework, and CI label Aug 12, 2023

Apply suggestions from code review - Improve description and text format

372d18f

Co-authored-by: chris48s <chris48s@users.noreply.github.com>

jNullj added 7 commits August 13, 2023 15:51

Fix comment table format

c4a41f6

Merge branch 'master' into feat/9287/docusaurus-swizzled-warning-ci

11fbd0b

fix type

da3cf2e

Add docusaurus-swizzled-warning to dependabot

c77af69

refactor: remove node-fetch and use octokit insted

db2e03c

improve code readability

81f020f

fix type

9e1c2e4

jNullj requested a review from chris48s August 13, 2023 17:22

Merge branch 'master' into feat/9287/docusaurus-swizzled-warning-ci

637d122

chris48s reviewed Aug 18, 2023

View reviewed changes

change pull_request_target to pull_request

640567d

jNullj added 3 commits August 18, 2023 23:32

Improve action log

78551ff

Change core.debug to core.info so it always shows and not only when in debug.

Log old and new version

5311d03

Log old and new versions for the Docusaurus swizzled component changes warning workflow.

Merge branch 'master' into feat/9287/docusaurus-swizzled-warning-ci

6f867f7

jNullj requested a review from chris48s August 18, 2023 20:51

chris48s approved these changes Aug 18, 2023

View reviewed changes

chris48s added this pull request to the merge queue Aug 18, 2023

Merged via the queue into badges:master with commit 7d44ebf Aug 18, 2023
20 checks passed

chris48s mentioned this pull request Aug 18, 2023

CI automation to help upgrading docusaurus-theme-openapi #9287

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

devops: Add ci warning for swizzled docusaurus components #9467

devops: Add ci warning for swizzled docusaurus components #9467

jNullj commented Aug 11, 2023

socket-security bot commented Aug 11, 2023 •

edited

Loading

github-actions bot commented Aug 11, 2023 •

edited

Loading

chris48s left a comment

chris48s Aug 12, 2023

jNullj Aug 13, 2023

jNullj Aug 13, 2023

chris48s Aug 12, 2023

jNullj Aug 13, 2023

chris48s Aug 12, 2023

jNullj Aug 13, 2023

jNullj Aug 13, 2023

chris48s Aug 12, 2023 •

edited

Loading

jNullj Aug 13, 2023

jNullj commented Aug 13, 2023

chris48s left a comment

chris48s Aug 18, 2023

jNullj Aug 18, 2023

chris48s Aug 18, 2023

jNullj Aug 18, 2023

chris48s Aug 18, 2023

jNullj Aug 18, 2023

chris48s left a comment

calebcartwright commented Aug 19, 2023

	# close-bot package dependencies
	- package-ecosystem: npm
	directory: '/.github/actions/close-bot'
	schedule:
	interval: weekly
	day: friday
	time: '12:00'
	open-pull-requests-limit: 99
	rebase-strategy: disabled

devops: Add ci warning for swizzled docusaurus components #9467

devops: Add ci warning for swizzled docusaurus components #9467

Conversation

jNullj commented Aug 11, 2023

socket-security bot commented Aug 11, 2023 • edited Loading

github-actions bot commented Aug 11, 2023 • edited Loading

chris48s left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chris48s Aug 12, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jNullj commented Aug 13, 2023

chris48s left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

chris48s left a comment

Choose a reason for hiding this comment

calebcartwright commented Aug 19, 2023

socket-security bot commented Aug 11, 2023 •

edited

Loading

github-actions bot commented Aug 11, 2023 •

edited

Loading

chris48s Aug 12, 2023 •

edited

Loading