ci: 新增对dependabot的阿里云依赖检查 #2126
Conversation
Close #2125 Signed-off-by: unknowIfGuestInDream <liang.tang.cx@gmail.com>
|
Thank you for following naming conventions! 😻 |
Reviewer's GuideThis pull request introduces a new GitHub Actions workflow designed to automatically check if dependencies added or updated by Dependabot are available in the Aliyun public Maven repository. The workflow triggers on Dependabot pull requests, extracts dependency changes from the diff of Sequence diagram for Aliyun dependency check workflowsequenceDiagram
participant GA as GitHub Actions
participant Script as Check Script
participant Git as Git Repository
participant Aliyun as Aliyun Maven Repo
participant GitHubAPI as GitHub API
Note over GA: Triggered by Dependabot PR
GA->>Git: Checkout PR code
GA->>Script: Run dependency check script
Script->>Git: Get diff (build.gradle/pom.xml)
Script->>Script: Parse added dependencies
loop For each added dependency
Script->>Aliyun: Check if dependency POM exists (curl)
Aliyun-->>Script: HTTP Status Code (e.g., 200)
end
Script->>Script: Format results
Script->>GitHubAPI: Create PR comment with results
GitHubAPI-->>Script: Comment created
Script-->>GA: Output results/status
File-Level Changes
Assessment against linked issues
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
Their most recently public accepted PR is: #2123 |
|
Warning Rate limit exceeded@unknowIfGuestInDream has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 11 minutes and 29 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
""" Walkthrough本次变更新增了一个 GitHub Actions 工作流文件 Changes
Sequence Diagram(s)sequenceDiagram
participant GitHub PR
participant GitHub Actions
participant Dependabot
participant Aliyun Maven
Dependabot->>GitHub PR: 创建/同步依赖更新 PR
GitHub PR->>GitHub Actions: 触发 check-aliyun-maven.yml
GitHub Actions->>GitHub Actions: 检查 actor 是否为 Dependabot
GitHub Actions->>GitHub Actions: 检出 PR 代码
GitHub Actions->>GitHub Actions: 设置 Java 17 环境
GitHub Actions->>GitHub Actions: 解析依赖变更
loop 对每个新增依赖
GitHub Actions->>Aliyun Maven: 发送 HEAD 请求检测依赖
Aliyun Maven-->>GitHub Actions: 返回 HTTP 状态
end
GitHub Actions->>GitHub PR: 评论检测结果
Assessment against linked issues
Suggested labels
Poem
""" Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey @unknowIfGuestInDream - I've reviewed your changes - here's some feedback:
- Using
pull_request_targetcombined with checking out the PR's head ref requires careful security review; consider if thepull_requesttrigger could be used instead. - Relying on regex to parse dependency changes from a git diff might be fragile; consider using build tool introspection or dedicated dependency analysis tools.
- Consider replacing the
curlexecution with native Node.js HTTP requests for potentially better error handling and avoiding shell dependencies.
Here's what I looked at during the review
- 🟡 General issues: 2 issues found
- 🟢 Security: all looks good
- 🟢 Testing: all looks good
- 🟢 Documentation: all looks good
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Qodana Community for JVMIt seems all right 👌 No new problems were found according to the checks applied 💡 Qodana analysis was run in the pull request mode: only the changed files were checked Contact Qodana teamContact us at qodana-support@jetbrains.com
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (6)
.github/workflows/check-aliyun-maven.yml (6)
3-6: 审查触发器配置
使用pull_request_target事件有权限提升风险，虽然通过 job-levelif限制了 actor 必须为 Dependabot，但仍建议显式声明最小权限集，例如：permissions: pull-requests: write contents: read
10-12: 确保仅在 Dependabot PR 上运行
if: github.actor == 'dependabot[bot]'能防止其它用户触发此作业。建议在作业注释中说明跳过原因，或在运行日志中加入提示，便于维护排查。
37-41: 优化依赖变更检测范围
当前仅针对build.gradle和pom.xml逐一 diff，且不支持 Kotlin DSL (build.gradle.kts)。建议一次性匹配多文件或新增 Kotlin 支持：- git diff origin/${{ github.event.pull_request.base.ref }} -- build.gradle || git diff origin/${{ github.event.pull_request.base.ref }} -- pom.xml + git diff origin/${{ github.event.pull_request.base.ref }} -- '*.gradle*' 'pom.xml'
70-75: 减少子进程开销
每个依赖调用curl会启动大量子进程，建议使用 JavaScript 原生 HTTP 库（如axios）发送 HEAD 请求并检查响应状态，以降低 I/O 负载并提高可维护性。
81-88: 增强评论创建的鲁棒性
- 未显式声明 workflow 的
permissions，可导致部分仓库默认权限不足。- 建议为
octokit.rest.issues.createComment添加try/catch，捕获并记录评论创建失败的场景，避免整个脚本异常中止。
95-96: 优化结果输出方式
当前仅echo输出，若需后续自动化采集或聚合，可考虑上传为 Artifact 或在 GitHub Checks 界面展示。
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/check-aliyun-maven.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (9)
- GitHub Check: build (17, windows-latest, false)
- GitHub Check: build (21, windows-latest, false)
- GitHub Check: build (21, macos-latest, false)
- GitHub Check: build (17, ubuntu-latest, false)
- GitHub Check: build (21, ubuntu-latest, false)
- GitHub Check: build (17, macos-latest, false)
- GitHub Check: qodana
- GitHub Check: StepSecurity Harden-Runner
- GitHub Check: Summary
Close #2125 Signed-off-by: unknowIfGuestInDream <liang.tang.cx@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (3)
.github/workflows/check-aliyun-maven.yml (3)
76-80: 使用 HTTP 客户端替代 Shell 调用以增强健壮性
当前通过curl | grep判断状态码，易受命令行环境影响且难以捕获网络错误。先前已有相同建议：推荐使用内置
fetch（或安装node-fetch、@actions/http-client）：const response = await fetch(pomUrl, { method: 'HEAD' }); if (response.ok) { results.push(`✅ ${dep.group}:${dep.artifact}:${dep.version} - 可用`); } else { results.push(`❌ ${dep.group}:${dep.artifact}:${dep.version} - 不可用`); }这样能够更精确地捕获 HTTP 状态及网络异常。
21-25: 🛠️ Refactor suggestion增加 fetch-depth 以确保 base 分支代码可对比
正如先前评论中提到的，默认actions/checkout@v4仅拉取单个提交，git diff origin/${{ github.event.pull_request.base.ref }}将找不到 base 分支。- uses: actions/checkout@v4 + uses: actions/checkout@v4 with: + fetch-depth: 0这样可以完整拉取历史，并保证后续 diff 能正确运行。
45-52: 🛠️ Refactor suggestion扩展依赖解析以支持 Maven
pom.xml
当前正则仅匹配 Gradle Groovy DSL，无法解析<dependency>标签。先前已有类似建议：可在检测到
pom.xml时引入 XML 解析库（如xml2js或fast-xml-parser），例如：+ const xml2js = require('xml2js'); … + if (diffOutput.includes('<dependency>')) { + const parsed = await xml2js.parseStringPromise(diffOutput); + // 从 parsed.project.dependencies[0].dependency 中提取 groupId/artifactId/version + } else { // 现有 Gradle 正则逻辑 + }这样能保证对 Gradle 与 Maven 两种构建文件都能正确提取新增依赖。
🧹 Nitpick comments (2)
.github/workflows/check-aliyun-maven.yml (2)
17-18: 验证 Dependabot 账号匹配精准度
当前写法仅匹配dependabot[bot]，若将来 Dependabot 账号名称变更或使用了dependabot-preview[bot]，可能导致工作流未运行。建议使用更宽松的匹配方式，或者在脚本开头打印${{ github.actor }}并手动验证，确保所有 Dependabot 触发场景都被覆盖。
43-44: 合并或分步获取多个文件的 diff 输出
当前使用||只会返回第一个命令的结果，若 build.gradle 和 pom.xml 同时更新，只有 build.gradle 的变更会被检查。建议改为一次性对两个文件做 diff 并合并结果，例如：- const diffOutput = execSync('git diff origin/${{ github.event.pull_request.base.ref }} -- build.gradle || git diff origin/${{ github.event.pull_request.base.ref }} -- pom.xml').toString(); + const diffGradle = execSync('git diff origin/${{ github.event.pull_request.base.ref }} -- build.gradle').toString(); + const diffPom = execSync('git diff origin/${{ github.event.pull_request.base.ref }} -- pom.xml').toString(); + const diffOutput = diffGradle + diffPom;或使用路径通配符：
git diff origin/${{ github.event.pull_request.base.ref }} -- '*.gradle' 'pom.xml'
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/check-aliyun-maven.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (8)
- GitHub Check: build (21, macos-latest, false)
- GitHub Check: build (21, windows-latest, false)
- GitHub Check: build (21, ubuntu-latest, false)
- GitHub Check: build (17, windows-latest, false)
- GitHub Check: build (17, ubuntu-latest, false)
- GitHub Check: build (17, macos-latest, false)
- GitHub Check: StepSecurity Harden-Runner
- GitHub Check: Summary
Close #2125 Signed-off-by: unknowIfGuestInDream <liang.tang.cx@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
.github/workflows/check-aliyun-maven.yml (3)
19-23: 添加 fetch-depth 以获取完整历史
默认actions/checkout@v4只拉取单个提交，后续git diff origin/${{ github.event.pull_request.base.ref }}可能因未拉取 base 分支而失败。建议：- uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.ref }} + fetch-depth: 0
120-120: 升级 actions/github-script 版本
当前使用actions/github-script@v6，建议升级到至少@v7，以获得更好的功能支持和最新安全修复：- uses: actions/github-script@v6 + uses: actions/github-script@v7🧰 Tools
🪛 actionlint (1.7.4)
120-120: the runner of "actions/github-script@v6" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
136-142: 优化 HTTP 可用性检测实现
使用curl | grep的方式较为脆弱，可考虑直接使用内置或轻量级 HTTP 客户端（如node-fetch）发起HEAD请求，便于获取状态码并统一处理异常：try { const response = await fetch(pomUrl, { method: 'HEAD' }); results.push(response.ok ? `✅ ${dep.group}:${dep.artifact}:${dep.version} - 可用` : `❌ ${dep.group}:${dep.artifact}:${dep.version} - 不可用`); } catch { results.push(`❌ ${dep.group}:${dep.artifact}:${dep.version} - 不可用`); }
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/check-aliyun-maven.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/check-aliyun-maven.yml
53-53: property "detect-build" is not defined in object type {get-changes: {conclusion: string; outcome: string; outputs: {string => string}}}
(expression)
120-120: the runner of "actions/github-script@v6" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
⏰ Context from checks skipped due to timeout of 90000ms (8)
- GitHub Check: build (21, macos-latest, false)
- GitHub Check: build (21, ubuntu-latest, false)
- GitHub Check: build (17, windows-latest, false)
- GitHub Check: build (17, ubuntu-latest, false)
- GitHub Check: build (21, windows-latest, false)
- GitHub Check: build (17, macos-latest, false)
- GitHub Check: StepSecurity Harden-Runner
- GitHub Check: Summary
Close #2125 Signed-off-by: unknowIfGuestInDream <liang.tang.cx@gmail.com>
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (2)
.github/workflows/check-aliyun-maven.yml (2)
19-23: 补充 fetch-depth 以获取完整历史
默认actions/checkout@v4只拉取单提交，后续git diff origin/...可能找不到基准分支。建议增加：- uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.ref }} + fetch-depth: 0
136-141: 替换curl | grep，使用内置 HTTP 客户端
Shell 调用curl+grep较脆弱，建议在脚本中使用fetch（或node-fetch）发起HEAD请求并检查response.ok，提高稳定性与可读性。
🧹 Nitpick comments (3)
.github/workflows/check-aliyun-maven.yml (3)
61-67: 支持 Gradle Kotlin DSL 和更灵活的依赖声明解析
当前正则仅覆盖 Groovy DSL (implementation '...'等)，无法匹配implementation("group:artifact:version")或build.gradle.kts文件。可考虑：
- 拓展正则支持双引号和括号写法
- 单独检测
.kts文件或使用 AST 工具解析
85-108: 增强 Maven 依赖块解析的健壮性
手工按行匹配<dependency>标签较为脆弱，建议：
- 使用 XML 解析库（如
xml2js或fast-xml-parser）处理pom.xml- 或者在匹配前
trim()并用正则更灵活地捕获<dependency>、<groupId>等行
147-153: 使用context.issue.number替换硬编码 PR 编号
issue_number: ${{ github.event.pull_request.number }}可替换为issue_number: context.issue.number，增强通用性和可读性。
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/check-aliyun-maven.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/check-aliyun-maven.yml
120-120: the runner of "actions/github-script@v6" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
⏰ Context from checks skipped due to timeout of 90000ms (8)
- GitHub Check: build (21, macos-latest, false)
- GitHub Check: build (21, windows-latest, false)
- GitHub Check: build (21, ubuntu-latest, false)
- GitHub Check: build (17, windows-latest, false)
- GitHub Check: build (17, ubuntu-latest, false)
- GitHub Check: build (17, macos-latest, false)
- GitHub Check: StepSecurity Harden-Runner
- GitHub Check: Summary
🔇 Additional comments (2)
.github/workflows/check-aliyun-maven.yml (2)
1-11: 工作流触发器与权限设置正确
当前配置通过pull_request_target仅对 Dependabot PR 运行，并限制了contents: read与pull-requests: write权限，符合预期。
163-166: 输出结果步骤结构合理
当存在新增依赖时，echo "${{ steps.check-aliyun.outputs.result }}"可将检查结果打印到日志，流程清晰。
Close #2125 Signed-off-by: unknowIfGuestInDream <liang.tang.cx@gmail.com>
|
Close #2125
Fixes #
Proposed Changes
Readiness Checklist
Author/Contributor
Reviewing Maintainer
enhancement,bug,documentationordependenciesSummary by Sourcery
Add a GitHub Actions workflow to check Dependabot dependency availability on Aliyun Maven repository
New Features:
CI:
Summary by CodeRabbit