Copilot commented on code in PR #966:
URL: https://github.com/apache/fesod/pull/966#discussion_r3649606240
##########
website/package.json:
##########
@@ -27,7 +27,7 @@
"@mdx-js/react": "^3.0.0",
"clsx": "^2.0.0",
"docusaurus-plugin-matomo": "^0.0.8",
- "markdownlint-cli2": "^0.20.0",
+ "markdownlint-cli2": "^0.23.1",
Review Comment:
`markdownlint-cli2` is bumped to `^0.23.1`, but the lockfile shows
`[email protected]` has `engines: {node: '>=22'}` while this package
declares `engines.node: >=18` and existing website workflows run Node 20. This
can break contributors/CI running Node 18–21. Either bump the website Node
requirement (and workflows) to >=22, or choose a `markdownlint-cli2` version
compatible with the currently supported Node range.
##########
.github/workflows/ci-docs.yml:
##########
@@ -50,14 +50,14 @@ jobs:
- name: Install dependencies
working-directory: website
- run: pnpm install --frozen-lockfile
+ run: pnpm install
Review Comment:
`[email protected]` (as locked in `website/pnpm-lock.yaml`) requires
Node >=22, but this workflow sets `node-version: '20'`. Also, dropping
`--frozen-lockfile` makes the docs CI non-reproducible and can mask lockfile
drift (other docs workflows still use `--frozen-lockfile`). Consider bumping
Node here and restoring frozen lockfile installs so CI matches the new
dependency constraints.
##########
.github/workflows/asf_allowlist_check.yml:
##########
@@ -0,0 +1,50 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: ASF Allowlist Check
+
+on:
+ workflow_dispatch:
+ pull_request:
+ branches:
+ - main
+ paths:
+ - ".github/**"
+ push:
+ branches:
+ - main
+ paths:
+ - ".github/**"
+
+permissions:
+ contents: read
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
+ cancel-in-progress: true
+
+jobs:
+ asf-allowlist-check:
+ runs-on: ubuntu-latest
+ timeout-minutes: 10
+ steps:
+ - uses: actions/checkout@v7
+ with:
+ persist-credentials: false
+ - uses: apache/infrastructure-actions/allowlist-check@main
Review Comment:
Using a mutable branch ref (`@main`) for a GitHub Action makes this
allowlist check non-reproducible and can introduce supply-chain risk. Since
this workflow’s goal is to catch ASF allowlist/policy violations early, pinning
the action to a specific release tag or commit SHA will keep results stable and
avoid policy issues with branch refs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
