feat: release workflow, footer license link, security hardening (v1.5.0) - #11
Merged
Conversation
- .github/workflows/release.yml: on v* tag push or manual dispatch, creates the GitHub Release using the matching CHANGELOG.md section as notes. SHA-pinned checkout, contents:read default with contents:write on the release job only, tag input validated - scripts/release.sh reworked for the PR-based flow: validates main is clean and in sync, requires a CHANGELOG section for the current package.json version, then tags and pushes; the workflow creates the Release (old script pushed to main directly, double-wrote the changelog, and linked a stale repo URL) - Footer: GitHub logo icon linking to the repository and a bilingual Apache License 2.0 notice
…mp to 1.5.0 - Column-detection histogram built from a difference array (O(items + size) instead of O(rows x size)); fragment merging skips rows with more than 400 fragments, so crafted PDFs degrade gracefully instead of freezing - Excel exports mark formula-leading cells with the Text number format so in-place edits in Excel cannot convert them into live formulas - check-cdn-versions.sh also fails on missing, invalid, or mismatched SRI integrity attributes in index.html, not just version drift - Renovate: cdnjs manager regex now matches the single-quoted URLs in app.js and sw.js; GitHub Actions digest updates no longer auto-merge and require dashboard approval - CI guard scripts run under the Egret security action (audit mode, zero-egress policy, SARIF upload)
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
📝 WalkthroughWalkthroughVersion 1.5.0 updates add Egret-enforced CI security checks, stronger CDN/SRI validation, PDF and Excel processing changes, tag-driven release automation, footer attribution and localization, cache versioning, and release metadata updates. ChangesRelease, security, and application updates
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Maintainer
participant ReleaseScript as scripts/release.sh
participant GitHubActions as release.yml
participant Changelog as CHANGELOG.md
participant GitHubRelease as GitHub Release
Maintainer->>ReleaseScript: Confirm annotated v<version> tag
ReleaseScript->>GitHubActions: Push release tag
GitHubActions->>Changelog: Extract matching version section
GitHubActions->>GitHubRelease: Create release with extracted notes
Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -0,0 +1,23 @@ | |||
| # Egret runtime security policy for CI (https://github.com/NX1X/Egret) | |||
| @@ -0,0 +1,23 @@ | |||
| # Egret runtime security policy for CI (https://github.com/NX1X/Egret) | |||
| @@ -0,0 +1,23 @@ | |||
| # Egret runtime security policy for CI (https://github.com/NX1X/Egret) | |||
| @@ -0,0 +1,23 @@ | |||
| # Egret runtime security policy for CI (https://github.com/NX1X/Egret) | |||
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 37-40: Update the “Checkout tag” actions/checkout step to set
persist-credentials to false, while preserving its existing tag ref and other
configuration; the later gh release create authentication must continue using
GH_TOKEN.
In `@scripts/check-cdn-versions.sh`:
- Around line 40-51: Update the CDN validation loop in
scripts/check-cdn-versions.sh to extract each complete cdnjs <script> or <link>
element, including multiline elements, instead of validating source lines. Apply
the integrity and crossorigin checks independently to every extracted element so
attributes from one tag cannot satisfy another, while preserving the existing
failure messages and status handling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 0c59de41-34c1-4949-adc1-56c803d00d6c
📒 Files selected for processing (13)
.github/egret-policy.yaml.github/renovate.json.github/workflows/ci.yml.github/workflows/release.ymlCHANGELOG.mdREADME.mdpackage.jsonpublic/app.jspublic/index.htmlpublic/style.csspublic/sw.jsscripts/check-cdn-versions.shscripts/release.sh
Comment on lines
+37
to
+40
| - name: Checkout tag | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| ref: ${{ steps.tag.outputs.tag }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Set persist-credentials: false on the checkout step.
This step only reads CHANGELOG.md; the later gh release create call authenticates via its own GH_TOKEN env var, not the git-persisted credential. Per zizmor's artipacked audit, checkout should default to persist-credentials: false unless git operations are needed.
🔒 Proposed fix
- name: Checkout tag
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
ref: ${{ steps.tag.outputs.tag }}
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| - name: Checkout tag | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ steps.tag.outputs.tag }} | |
| - name: Checkout tag | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ steps.tag.outputs.tag }} | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 37-40: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 37 - 40, Update the “Checkout
tag” actions/checkout step to set persist-credentials to false, while preserving
its existing tag ref and other configuration; the later gh release create
authentication must continue using GH_TOKEN.
Source: Linters/SAST tools
Comment on lines
+40
to
+51
| while IFS= read -r line; do | ||
| n="${line%%:*}" | ||
| tag="${line#*:}" | ||
| if ! printf '%s' "$tag" | grep -qE 'integrity="sha(384|512)-[A-Za-z0-9+/=]+"'; then | ||
| echo "MISSING SRI: ${html}:${n} cdnjs reference has no valid integrity attribute" | ||
| fail=1 | ||
| fi | ||
| if ! printf '%s' "$tag" | grep -q 'crossorigin="anonymous"'; then | ||
| echo "MISSING crossorigin: ${html}:${n} cdnjs reference lacks crossorigin=\"anonymous\"" | ||
| fail=1 | ||
| fi | ||
| done < <(grep -n 'cdnjs\.cloudflare\.com' "$html") |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Validate individual HTML elements, not source lines.
A line with multiple CDN tags can pass when only one has SRI/crossorigin; multiline tags can fail despite valid attributes. Extract and validate each complete <script>/<link> element before checking attributes and digests.
Also applies to: 60-61
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/check-cdn-versions.sh` around lines 40 - 51, Update the CDN
validation loop in scripts/check-cdn-versions.sh to extract each complete cdnjs
<script> or <link> element, including multiline elements, instead of validating
source lines. Apply the integrity and crossorigin checks independently to every
extracted element so attributes from one tag cannot satisfy another, while
preserving the existing failure messages and status handling.
Deploying easyconvert-website with
|
| Latest commit: |
bf2654f
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://dc2823cd.easyconvert-website.pages.dev |
| Branch Preview URL: | https://feat-release-workflow-footer.easyconvert-website.pages.dev |
NX1X
enabled auto-merge (squash)
July 25, 2026 10:38
The Azure wireserver false positive (168.63.129.16 raw-ip egress from the runner's waagent) needs a fix in Egret itself (NX1X/Egret#10); re-add the action once that lands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two changes bundled for the 1.5.0 release:
Release workflow + footer (39149c9)
.github/workflows/release.yml: pushing av*tag (or manual dispatch) creates the GitHub Release with the matching CHANGELOG section as notesSecurity hardening, bump to 1.5.0 (154bfa8)
Follow-ups from a full security review of the v1.4.0 extraction rework:
check-cdn-versions.shnow fails on missing, invalid, or mismatchedintegrityattributes inindex.html, not just version drift (previously a stripped SRI hash passed CI)app.js/sw.js(previously invisible to Renovate, so automated updates would have left the worker and SW cache list stale); GitHub Actions digest updates no longer auto-merge and require dashboard approvalVersion bumped to 1.5.0 in
package.json, README badge, and the service-worker cache name; CHANGELOG has the full 1.5.0 entry.Test plan
bash scripts/check-cdn-versions.shpasses; fails correctly on stripped-SRI and tampered-digest fixturesbash scripts/check-action-pins.shpassesnode --check public/app.js; histogram fuzz-tested for equivalence with the old algorithmSummary by CodeRabbit
New Features
Bug Fixes
Documentation
Update
The Egret CI integration was removed from this PR: GitHub-hosted runners trip a false positive on the Azure wireserver IP 168.63.129.16 (raw-ip egress from the runner's waagent). Bug filed upstream as NX1X/Egret#10; the integration returns once that lands.