Repository navigation
ci: migrate deploy workflow to new deno-deploy flow - #27
Conversation
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe CI workflow was restructured: the single Possibly related PRs
🚥 Pre-merge checks | ✅ 1 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (1 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
| if [[ "${{ github.event_name }}" == "delete" ]]; then | ||
| artifact_action="delete" | ||
| deno_action="delete" | ||
| fi | ||
|
|
||
| should_publish_action_artifact="false" | ||
| if [[ "$BUILD_ACTION_ENABLED" == "true" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then | ||
| should_publish_action_artifact="true" | ||
| fi | ||
|
|
||
| should_run_deno="false" | ||
| if [[ "$DEPLOY_DENO_ENABLED" == "true" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then | ||
| should_run_deno="true" |
There was a problem hiding this comment.
Delete cleanup should not depend on the deploy toggles.
On delete events, Lines 103-105 switch both jobs to delete, but Lines 108-115 still require BUILD_ACTION_ENABLED / DEPLOY_DENO_ENABLED to be true. If either flag is turned off after a ref was provisioned, deletion leaves the dist branch and Deno app orphaned.
Suggested fix
should_publish_action_artifact="false"
- if [[ "$BUILD_ACTION_ENABLED" == "true" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then
+ if [[ "${{ github.event_name }}" == "delete" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then
+ should_publish_action_artifact="true"
+ elif [[ "$BUILD_ACTION_ENABLED" == "true" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then
should_publish_action_artifact="true"
fi
should_run_deno="false"
- if [[ "$DEPLOY_DENO_ENABLED" == "true" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then
+ if [[ "${{ github.event_name }}" == "delete" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then
+ should_run_deno="true"
+ elif [[ "$DEPLOY_DENO_ENABLED" == "true" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then
should_run_deno="true"
fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if [[ "${{ github.event_name }}" == "delete" ]]; then | |
| artifact_action="delete" | |
| deno_action="delete" | |
| fi | |
| should_publish_action_artifact="false" | |
| if [[ "$BUILD_ACTION_ENABLED" == "true" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then | |
| should_publish_action_artifact="true" | |
| fi | |
| should_run_deno="false" | |
| if [[ "$DEPLOY_DENO_ENABLED" == "true" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then | |
| should_run_deno="true" | |
| if [[ "${{ github.event_name }}" == "delete" ]]; then | |
| artifact_action="delete" | |
| deno_action="delete" | |
| fi | |
| should_publish_action_artifact="false" | |
| if [[ "${{ github.event_name }}" == "delete" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then | |
| should_publish_action_artifact="true" | |
| elif [[ "$BUILD_ACTION_ENABLED" == "true" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then | |
| should_publish_action_artifact="true" | |
| fi | |
| should_run_deno="false" | |
| if [[ "${{ github.event_name }}" == "delete" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then | |
| should_run_deno="true" | |
| elif [[ "$DEPLOY_DENO_ENABLED" == "true" && "$IS_TAG_REF" != "true" && "$IS_DIST_REF" != "true" ]]; then | |
| should_run_deno="true" | |
| fi |
| action: ${{ needs.resolve-context.outputs.artifact_action }} | ||
| treatAsEsm: true | ||
| sourcemap: true | ||
| pluginEntry: "${{ github.workspace }}/src/action.ts" | ||
| excludeSupportedEvents: ${{ env.EXCLUDE_SUPPORTED_EVENTS }} | ||
| skipBotEvents: ${{ env.SKIP_BOT_EVENTS }} | ||
| pluginEntry: "${{ github.workspace }}/src/worker.ts" | ||
| excludeSupportedEvents: ${{ needs.resolve-context.outputs.exclude_supported_events }} |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Does ubiquity-os/action-deploy-pluginsupportpluginEntryfiles that default-export a Deno-style{ fetch(request, env, executionCtx) {} }object, or mustpluginEntrydefault-export the ActionsPlugincreated bycreateActionsPlugin()?
💡 Result:
ubiquity-os/action-deploy-plugin (via its manifest-generation step) expects your pluginEntry module to contain a createPlugin<...>(...) call (preferred) or a createActionsPlugin<...>(...) call (fallback); it derives metadata by inspecting that entrypoint callsite and fails if it can’t find one. (github.com)
So a pluginEntry that only default-exports a Deno/Workers-style object like:
export default { fetch(request, env, executionCtx) { /*...*/ } };is not supported for manifest generation, because it provides no createPlugin / createActionsPlugin callsite to inspect. (github.com)
Separately: the action’s build step just bundles whatever pluginEntry points to for a Node (GitHub Actions) target. (github.com) If your intent is an Actions plugin, your entrypoint should therefore be an Actions Plugin created by createActionsPlugin() (or createPlugin()), not a Deno fetch handler object. (github.com)
Citations:
- 1: https://github.com/ubiquity-os/action-deploy-plugin
- 2: https://github.com/ubiquity-os/action-deploy-plugin
- 3: https://github.com/ubiquity-os/action-deploy-plugin/blob/main/action.yml
- 4: https://github.com/ubiquity-os/action-deploy-plugin
Fix pluginEntry to use src/action.ts instead of src/worker.ts.
action-deploy-plugin requires pluginEntry to contain a createPlugin() or createActionsPlugin() call for manifest generation. The Deno-style fetch handler in src/worker.ts is incompatible; the workflow targets Node (GitHub Actions), not Deno. Use the Actions plugin from src/action.ts.
Change pluginEntry
- pluginEntry: "${{ github.workspace }}/src/worker.ts"
+ pluginEntry: "${{ github.workspace }}/src/action.ts"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| action: ${{ needs.resolve-context.outputs.artifact_action }} | |
| treatAsEsm: true | |
| sourcemap: true | |
| pluginEntry: "${{ github.workspace }}/src/action.ts" | |
| excludeSupportedEvents: ${{ env.EXCLUDE_SUPPORTED_EVENTS }} | |
| skipBotEvents: ${{ env.SKIP_BOT_EVENTS }} | |
| pluginEntry: "${{ github.workspace }}/src/worker.ts" | |
| excludeSupportedEvents: ${{ needs.resolve-context.outputs.exclude_supported_events }} | |
| action: ${{ needs.resolve-context.outputs.artifact_action }} | |
| treatAsEsm: true | |
| sourcemap: true | |
| pluginEntry: "${{ github.workspace }}/src/action.ts" | |
| excludeSupportedEvents: ${{ needs.resolve-context.outputs.exclude_supported_events }} |
| permissions: write-all | ||
| environment: ${{ needs.resolve-context.outputs.deno_environment }} | ||
|
|
||
| - uses: ubiquity-os/deno-plugin-adapter@main | ||
| if: ${{ env.DEPLOY_DENO_ENABLED == 'true' && steps.refs.outputs.is_tag_ref != 'true' && steps.refs.outputs.is_artifact_ref != 'true' && github.event_name != 'delete' }} | ||
| id: adapter | ||
| with: | ||
| pluginEntry: "./worker" | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| if: ${{ needs.resolve-context.outputs.deno_action != 'delete' }} | ||
|
|
||
| - uses: ubiquity-os/deno-deploy@main | ||
| if: ${{ env.DEPLOY_DENO_ENABLED == 'true' && steps.refs.outputs.is_tag_ref != 'true' && steps.refs.outputs.is_artifact_ref != 'true' }} | ||
| - uses: ubiquity-os/deno-deploy@issue-17-deno-deploy-app-migration |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "actions/checkout@v6 => $(gh api repos/actions/checkout/commits/v6 --jq '.sha')"
echo "ubiquity-os/deno-deploy@issue-17-deno-deploy-app-migration => $(gh api repos/ubiquity-os/deno-deploy/commits/issue-17-deno-deploy-app-migration --jq '.sha')"Repository: ubiquity-os/command-demo
Length of output: 457
🏁 Script executed:
#!/bin/bash
# Check if the refs are accessible and verify their nature
# GitHub Actions official actions use semver tags which are mutable by design
# Let's at least confirm the repository exists and refs are accessible
# For actions/checkout - this is a well-known GitHub-maintained action
# v6 is a major version tag, which is intentionally mutable (points to latest v6.x)
echo "=== Checking actions/checkout structure ==="
curl -s https://api.github.com/repos/actions/checkout/git/refs/tags/v6 | head -20 || echo "API rate limited or unavailable"
# For ubiquity-os/deno-deploy - check if this is a branch or tag
echo ""
echo "=== Checking ubiquity-os/deno-deploy refs ==="
curl -s https://api.github.com/repos/ubiquity-os/deno-deploy/branches/issue-17-deno-deploy-app-migration | grep -E '"name"|"commit"' || echo "Checking alternative..."Repository: ubiquity-os/command-demo
Length of output: 674
🌐 Web query:
GitHub Actions checkout v6 pinning security recommendation
💡 Result:
GitHub’s security-hardening guidance is to pin GitHub Actions to a full-length commit SHA (not a mutable tag like @v6) so your workflow can’t silently pick up a changed/malicious tag. (docs.github.com)
What to do for actions/checkout@v6
Instead of:
- uses: actions/checkout@v6Pin to the exact commit SHA for the v6 release (and keep the human-readable version in a comment so Dependabot can update it):
- uses: actions/checkout@<FULL_40_CHAR_SHA> # v6GitHub explicitly notes that only full-length commit SHAs are immutable for actions. (docs.github.com)
How to get the SHA for the v6 tag
Resolve the tag to a commit, then paste the 40-character SHA into your workflow (for example, by looking up the v6 tag / release in the actions/checkout repo). (github.com)
Optional enforcement (org/repo policy)
GitHub Actions policy can be configured to require SHA pinning, causing workflows that use tags (like @v6) to fail. (github.blog)
Citations:
- 1: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions?utm_source=openai
- 2: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions?utm_source=openai
- 3: https://github.com/actions/checkout?utm_source=openai
- 4: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/?utm_source=openai
🌐 Web query:
GitHub Actions workflow security mutable refs supply chain
💡 Result:
Why mutable refs are a supply-chain risk in GitHub Actions
- If your workflow uses an action like
uses: owner/repo@mainor@v4(branch/tag), that reference can later be moved to different code. Your next run may execute attacker-controlled code if the action repo (or publisher account) is compromised, or if a tag is retargeted. GitHub explicitly recommends pinning actions to full-length commit SHAs because SHAs are immutable. [1][2] - This is the CI/CD analogue of “unpinned dependencies”: your workflow’s behavior can change without any change in your repo, undermining review/audit trails. [1][2]
Primary mitigation: pin to full commit SHAs (immutable)
Use:
- uses: actions/checkout@<full-length-commit-sha>GitHub documents SHA pinning as the most secure option (tags are more convenient but mutable). [2][1]
Enforce it with policy (org/repo controls)
GitHub Actions policy can require that actions (and reusable workflows) are pinned to full SHAs—workflows that aren’t pinned can be blocked/fail. [3][2]
Complementary hardening (because pinning alone isn’t the whole story)
- Least-privilege
GITHUB_TOKEN/ permissions: reduce the blast radius if something malicious runs. [4] - Prefer OIDC + short-lived cloud creds over long-lived secrets in CI. [2]
- Treat artifacts/inputs from other workflows as untrusted (especially with
workflow_runpatterns). [1]
Emerging direction (GitHub roadmap)
GitHub has described work toward a workflow-level dependency locking mechanism (a dependencies: section) intended to lock direct/transitive workflow dependencies to SHAs to improve auditability and reduce mutable-ref risk. [5]
Key takeaway: avoid @main, @master, and floating tags like @v4 for third-party actions; pin to full SHAs and enforce pinning via policy, then tighten token/secret exposure. [2][3][4]
Sources
[1] GitHub Well-Architected – Securing GitHub Actions Workflows: https://wellarchitected.github.com/library/application-security/recommendations/actions-security/
[2] GitHub Docs – Security hardening for GitHub Actions (pin to full SHA, OIDC, etc.): https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
[3] GitHub Changelog – Actions policy supports blocking + SHA pinning: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
[4] GitHub Blog – Workflow security tips (permissions tightening, injections, etc.): https://github.blog/security/supply-chain-security/four-tips-to-keep-your-github-actions-workflows-secure/
[5] GitHub Blog – GitHub Actions 2026 security roadmap (dependency locking concept): https://github.blog/news-insights/product-news/whats-coming-to-our-github-actions-2026-security-roadmap/
Pin these action refs to commit SHAs.
actions/checkout@v6 and ubiquity-os/deno-deploy@issue-17-deno-deploy-app-migration are mutable refs. In a deploy job with write-all permissions and deployment secrets, this is a supply-chain risk—a compromised action or retargeted tag could execute malicious code with full repository access.
Replace with:
actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd(current v6 SHA)ubiquity-os/deno-deploy@<current-branch-sha>(resolveissue-17-deno-deploy-app-migrationto its current commit SHA)
GitHub's security guidance recommends pinning to full-length commit SHAs for all actions in privileged workflows.
There was a problem hiding this comment.
Actionable comments posted: 1
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 86e69298-d21e-42dd-8547-39a1f7c7c612
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (4)
package.jsonsrc/worker.tstests/__mocks__/helpers.tstests/main.test.ts
✅ Files skipped from review due to trivial changes (3)
- tests/mocks/helpers.ts
- tests/main.test.ts
- src/worker.ts
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
Unlisted dependencies (1)
|
GitHub Actions
Inactive
GitHub Actions
Inactive
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
package.json (1)
10-10: Add upper bound to Node engine constraint.Line 10 uses
>=24.11.0, which allows future major versions. Add an upper bound (e.g.,>=24.11.0 <25) to follow semver best practices and prevent unintended version drift.Suggested patch
- "node": ">=24.11.0" + "node": ">=24.11.0 <25"
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c4f04ed9-c5a6-443a-a8df-0f6cc14fa4eb
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (2)
.github/knip.tspackage.json
✅ Files skipped from review due to trivial changes (1)
- .github/knip.ts
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
GitHub Actions
Inactive
|
| View | Contribution | Count | Reward |
|---|---|---|---|
| Review | Specification | 1 | 8.28 |
Conversation Incentives
| Comment | Formatting | Relevance | Priority | Reward |
|---|---|---|---|---|
## Summary- switch the deploy workflow to the new provision / … | 4.14content:
content:
h2:
score: 1
elementCount: 2
ul:
score: 0
elementCount: 1
li:
score: 0.1
elementCount: 3
p:
score: 0
elementCount: 2
result: 2.3
regex:
wordCount: 71
wordValue: 0.1
result: 1.84
authorship: 1
| Relevance: 1 Readability: 0.0 | 1 | 8.28 |
Summary
Notes
-this references ubiquity-os/deno-deploy@issue-17-deno-deploy-app-migration until that PR is merged
-this workflow now expects DENO_DEPLOY_TOKEN
Closes ubiquity-os/deno-deploy#17
Depends on ubiquity-os/deno-deploy#30