ci: auto-fix schema on /fix-schema comment#481
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | ||
| with: | ||
| ref: ${{ steps.pr.outputs.branch }} | ||
|
|
||
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 |
There was a problem hiding this comment.
I'd take a look at the details on this one to make sure it not a real concern. Being able to trigger code execution by posting a comment on an issue or PR seems to be what it's flagging.
✅MegaLinter analysis: Success
Notices📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining See detailed reports in MegaLinter artifacts MegaLinter is graciously provided by OX Security |
| jobs: | ||
| fix: | ||
| name: Regenerate and commit schema | ||
| if: github.event.issue.pull_request != null && contains(github.event.comment.body, '/fix-schema') |
There was a problem hiding this comment.
will this contains rule get triggered when the ci.yml workflow posts Comment /fix-schema on this? Just making sure we avoid an infinite loop.
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | ||
| with: | ||
| ref: ${{ steps.pr.outputs.branch }} | ||
|
|
||
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 |
There was a problem hiding this comment.
I'd take a look at the details on this one to make sure it not a real concern. Being able to trigger code execution by posting a comment on an issue or PR seems to be what it's flagging.
3 participants
When
Check CLI schema is up to datefails on a PR, the job now posts a comment pointing to/fix-schema.A new
schema-auto-fixworkflow listens for/fix-schemacomments on PRs and automatically runsnpm run build:schema, commits the result, and pushes it to the PR branch.Closes nothing directly - companion to the existing schema check.