Add React Doctor to GitHub Actions - #19
Conversation
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
More reviews will be available in 12 minutes and 11 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (47)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
No React Doctor issues found in this scan.
Generated by React Doctor. Questions? Contact founders@million.dev. |
Greptile SummaryThis PR introduces a new GitHub Actions workflow that runs a React Doctor scan on every pull request and every push to
Confidence Score: 3/5The workflow is straightforward and well-documented, but both action references use mutable version tags while holding write permissions, leaving a supply-chain substitution window open. The only changed file is a new CI workflow that grants pull-requests: write and issues: write to a third-party action pinned by a movable tag. If the upstream tag is tampered with, every subsequent run executes untrusted code with those write tokens. Pinning both references to full commit SHAs would close that window entirely before merging. .github/workflows/react-doctor.yml — the two uses: lines referencing mutable version tags need SHA pinning before the workflow is safe to land.
|
| Filename | Overview |
|---|---|
| .github/workflows/react-doctor.yml | New workflow adding React Doctor scan on PRs and pushes to main; both action references use mutable version tags instead of pinned commit SHAs, posing a supply-chain risk given the write permissions granted. |
Sequence Diagram
sequenceDiagram
participant GH as GitHub Event
participant Runner as Actions Runner
participant Checkout as actions/checkout@v5
participant RD as millionco/react-doctor@v1
participant API as GitHub API
GH->>Runner: pull_request or push to main
Runner->>Checkout: Fetch repo source (contents: read)
Checkout-->>Runner: Source code checked out
Runner->>RD: Run React Doctor scan
RD->>API: Read changed files list (pull-requests: write)
RD->>API: Post/update sticky summary comment (issues: write)
API-->>RD: Comment created/updated
RD-->>Runner: Scan result (pass / fail)
Prompt To Fix All With AI
Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.
---
### Issue 1 of 1
.github/workflows/react-doctor.yml:44-46
**Third-party actions not pinned to full commit SHA**
Both `actions/checkout@v5` and `millionco/react-doctor@v1` reference mutable version tags. If either upstream repo is compromised and the tag is force-pushed, the next workflow run silently executes attacker-controlled code — here with `pull-requests: write` and `issues: write` in scope, enabling malicious PR comments, repository content reads, or issue tampering. GitHub's security guidance recommends pinning every action to a full 40-character commit SHA and keeping the version tag as a comment for readability, e.g., `uses: actions/checkout@<sha> # v5`.
Reviews (1): Last reviewed commit: "ci: add React Doctor GitHub Actions work..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| - uses: actions/checkout@v5 | ||
|
|
||
| - uses: millionco/react-doctor@v1 |
There was a problem hiding this comment.
Both actions/checkout@v5 and millionco/react-doctor@v1 reference mutable version tags. If either upstream repo is compromised and the tag is force-pushed, the next workflow run silently executes attacker-controlled code — here with pull-requests: write and issues: write in scope, enabling malicious PR comments, repository content reads, or issue tampering. GitHub's security guidance recommends pinning every action to a full 40-character commit SHA and keeping the version tag as a comment for readability, e.g., uses: actions/checkout@<sha> # v5.
Prompt To Fix With AI
This is a comment left during a code review.
Path: .github/workflows/react-doctor.yml
Line: 44-46
Comment:
**Third-party actions not pinned to full commit SHA**
Both `actions/checkout@v5` and `millionco/react-doctor@v1` reference mutable version tags. If either upstream repo is compromised and the tag is force-pushed, the next workflow run silently executes attacker-controlled code — here with `pull-requests: write` and `issues: write` in scope, enabling malicious PR comments, repository content reads, or issue tampering. GitHub's security guidance recommends pinning every action to a full 40-character commit SHA and keeping the version tag as a comment for readability, e.g., `uses: actions/checkout@<sha> # v5`.
How can I resolve this? If you propose a fix, please make it concise.…tionErrorBanner, merge file icon utilities
…tationErrorBanner, and useCrudDialogs hook
…ationErrorBanner, standard UI fields, and useCrudDialogs hook
…lide-up-fade in settings.tsx
…e-pass loops instead of map().filter() chains
…arnings, hoist default arrays, and improve accessibility
…olation and fix LoadingSankey definition
…ngs in routes and forms
1 participant
Adds a React Doctor scan to every pull request and every push to the default branch. The workflow file is documented inline.
Docs: https://www.react.doctor/ci