chore(release): v3.0.0-beta.13 #2993
Conversation
|
Warning Rate limit exceeded@oasis-cloud has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 13 minutes and 46 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (1)
Walkthrough此次 PR 修改了 Changes
Possibly related PRs
Suggested reviewers
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
github-actions
bot
added
action:review
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## feat_v3.x #2993 +/- ##
==========================================
Coverage 85.79% 85.79%
==========================================
Files 281 281
Lines 18527 18527
Branches 2810 2810
==========================================
Hits 15896 15896
Misses 2626 2626
Partials 5 5 ☔ View full report in Codecov by Sentry. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/release-beta.yml (1)
86-86: 添加文件结尾的换行符根据 YAML 规范，文件末尾应该有一个换行符。
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} NPM_CONFIG_PROVENANCE: true +🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 86-86: no new line character at the end of file
(new-line-at-end-of-file)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/release-beta.yml(3 hunks)
🧰 Additional context used
🪛 YAMLlint (1.35.1)
.github/workflows/release-beta.yml
[error] 86-86: no new line character at the end of file
(new-line-at-end-of-file)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: build
- GitHub Check: test
- GitHub Check: release-3x-beta
🔇 Additional comments (3)
.github/workflows/release-beta.yml (3)
17-20: 检出配置的改进使用
github.event.pull_request.head.sha确保了工作流在正确的提交上运行，这是一个很好的改进。
72-75: 环境变量范围优化将
NODE_AUTH_TOKEN和NPM_CONFIG_PROVENANCE从全局移动到局部是一个很好的安全实践，可以限制敏感信息的暴露范围。Also applies to: 84-86
3-8:Details
❓ Verification inconclusive
工作流触发器变更需要验证
将触发器从
push改为pull_request可能会影响发布流程。请确认：
- PR 合并后是否会自动触发发布
- 是否需要额外的工作流来处理合并后的发布
🌐 Web query:
GitHub Actions 中 pull_request 触发器在 PR 合并后是否会触发工作流？💡 Result:
GitHub Actions 中的
pull_request触发器默认不会在 PR 合并后触发工作流。以下是关键细节：默认行为
pull_request事件默认仅响应以下活动类型：
opened（新开 PR）synchronize（PR 分支更新）reopened（重新打开 PR）[1][9]- PR 关闭时的处理：
- 若 PR 未合并关闭：
GITHUB_REF保持为refs/pull/PULL_REQUEST_NUMBER/merge- 若 PR 已合并关闭：
GITHUB_REF变为目标分支引用（如/refs/heads/main），但不会自动触发工作流 [1][7]如何在 PR 合并时触发
需改用
pull_request_target触发器并添加条件判断：on: pull_request_target: types: [closed] jobs: check_merged: if: github.event.pull_request.merged == true runs-on: ubuntu-latest steps: - run: echo "PR was merged!"此配置会在 PR 关闭时触发工作流，并通过条件判断过滤出实际完成合并的情况 [1][7][9]。
关键区别对比
触发器类型 响应场景 安全特性 SHA/REF 指向 pull_requestPR未合并且无冲突时 自动隔离 fork PR 临时合并提交 pull_request_targetPR关闭（含合并） 需手动处理安全检查 基分支最新提交 若需要更精细控制合并队列场景，可结合
merge_group事件使用 [8]。Citations:
- 1: https://docs.github.com/zh/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows
- 2: https://blog.csdn.net/Ber_Bai/article/details/120303880
- 3: https://icpc.cloud/2024/01/23/GitHub-Actions-%E6%89%8B%E5%8A%A8%E8%A7%A6%E5%8F%91%E6%96%B9%E5%BC%8F/
- 4: https://blog.csdn.net/ljbmxsm/article/details/140249178
- 5: https://blog.csdn.net/m0_57236802/article/details/133466974
- 6: https://docs.github.com/zh/actions/writing-workflows/choosing-what-your-workflow-does/accessing-contextual-information-about-workflow-runs
- 7: https://alampy.com/2024/04/20/gha-workflow-for-pull-request/
- 8: https://docs.github.com/zh/enterprise-server@3.12/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-a-merge-queue
- 9: https://docs.github.com/zh/actions/writing-workflows/choosing-when-your-workflow-runs/triggering-a-workflow
- 10: https://docs.github.com/zh/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning?learn=code_security_actions&learnProduct=code-security
工作流触发器问题：请确认触发条件是否满足预期发布流程
经过验证，GitHub Actions 中的
pull_request触发器默认不会在 PR 合并后触发工作流。请确认：
- 是否预期在 PR 合并后不自动执行发布流程？
- 如果期望在合并后触发发布操作，建议改用
pull_request_target触发器并配合条件判断来确保仅在 PR 合并的情况下执行发布任务。- 请检查其他相关配置（如 PR head SHA 引用和环境变量的局部设置），确保与工作流触发逻辑一致。
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/release-beta.yml (2)
47-51: npm 注册表配置增强了安全性明确指定 npm 注册表 URL 是一个很好的安全实践。建议考虑添加 provenance 支持以进一步增强包的安全性。
- uses: actions/setup-node@v4 with: registry-url: 'https://registry.npmjs.org' node-version: '20' cache: 'pnpm' + provenance: true
69-77: 发布命令优化建议发布命令已添加
--access public标志，这很好。建议添加错误处理和重试机制，以提高发布的可靠性。- run: npm publish --tag ${{ env.RELEASE_TAG }} --access public + run: | + MAX_RETRIES=3 + RETRY_COUNT=0 + until npm publish --tag ${{ env.RELEASE_TAG }} --access public || [ $RETRY_COUNT -eq $MAX_RETRIES ]; do + RETRY_COUNT=$((RETRY_COUNT+1)) + echo "发布失败，第 $RETRY_COUNT 次重试..." + sleep 5 + done + if [ $RETRY_COUNT -eq $MAX_RETRIES ]; then + echo "发布失败，已达到最大重试次数" + exit 1 + fi
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/release-beta.yml(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: build
- GitHub Check: test
- GitHub Check: release-3x-beta
🔇 Additional comments (2)
.github/workflows/release-beta.yml (2)
17-19: 权限配置符合最小权限原则新增的权限配置遵循了最小权限原则，仅授予必要的权限：
contents: read- 用于检出代码id-token: write- 用于 npm 发布时的身份验证
21-24: 检出配置确保了正确的代码版本使用
github.event.pull_request.head.sha确保工作流在正确的提交上运行，这是一个很好的做法。
| on: | ||
| push: | ||
| pull_request: | ||
| # push: | ||
| branches: | ||
| - feat_v3.x | ||
| workflow_dispatch: |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
工作流触发器变更需要验证
将触发器从 push 改为 pull_request 可能会影响现有的发布流程。请确认：
- 团队成员了解新的发布流程
- CI/CD 管道仍能按预期工作
🏁 Script executed:
#!/bin/bash
# 检查是否有其他工作流依赖于此工作流
gh workflow list --all | grep -B 2 -A 2 "Release 3x Beta"
# 检查最近的工作流运行状态
gh run list --workflow=release-beta.yml --limit 5Length of output: 979
工作流触发器配置需要修复
经过验证，通过 gh run list 查看最近 5 次运行均显示失败（失败原因涉及 chore_publish_beta 任务），这表明将触发器从 push 更改为 pull_request 后，CI/CD 管道目前并未按预期工作。请检查以下几点：
- 检查工作流日志，确认失败原因是否与触发器变更或其它配置问题相关；
- 验证所有依赖此工作流的配置和权限是否同步更新；
- 确保团队成员充分了解新的触发器设置和发布流程，并准备好对应的调整措施。
请尽快修正这些问题，确保 beta 版本的发布流程能够顺利进行。
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/release-beta.yml (2)
66-69: 构建步骤注释确认
说明：关于pnpm build:taro的构建步骤已被注释。如果该步骤暂时不需要，请在注释中添加说明；如果不再需要，建议移除相关代码以保持配置整洁。
77-79: 确认是否需要保留关于 nutui-react-taro 发布步骤的注释
说明：目前关于@nutui/nutui-react-taro的发布步骤已经被完整注释。建议确认这部分内容是暂时取消还是计划移除，如无后续使用建议可考虑直接删除以减少混淆。
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.github/workflows/release-beta.yml(3 hunks)scripts/build-taro.mjs(1 hunks)scripts/build.mjs(1 hunks)
🚧 Files skipped from review as they are similar to previous changes (2)
- scripts/build-taro.mjs
- scripts/build.mjs
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/release-beta.yml
24-24: input "registry-url" is not defined in action "actions/checkout@v4". available inputs are "clean", "fetch-depth", "fetch-tags", "filter", "github-server-url", "lfs", "path", "persist-credentials", "ref", "repository", "set-safe-directory", "show-progress", "sparse-checkout", "sparse-checkout-cone-mode", "ssh-key", "ssh-known-hosts", "ssh-strict", "ssh-user", "submodules", "token"
(action)
⏰ Context from checks skipped due to timeout of 90000ms (1)
- GitHub Check: test
🔇 Additional comments (5)
.github/workflows/release-beta.yml (5)
3-5: 触发器配置修改：从 push 到 pull_request
说明：已将工作流触发器从push修改为pull_request，请确认该变动已与团队沟通，确保发布流程调整后能正常触发和执行。
12-15: 新增运行环境和权限配置
说明：为release-3x-beta任务新增了runs-on: ubuntu-latest以及contents: write和id-token: write权限，这有助于确保工作流在正确的环境下运行并具有所需的权限，请核实这些配置符合发布流程的要求。
25-26: 检查 checkout 步骤中环境变量设置
说明：在actions/checkout@v4的env块中再次设置了NODE_AUTH_TOKEN，请确认此设置与全局环境变量配置一致，避免可能的覆盖或冗余。
51-51: 适用于 setup-node 的 registry-url 配置
说明：在actions/setup-node@v4步骤中正确配置了registry-url为'https://registry.npmjs.org'，确保节点依赖可以正确解析，此配置看起来没有问题。
73-75: 发布步骤更新为 pnpm 命令
说明：更新后的发布步骤使用pnpm --dir ./release/h5 publish:beta命令，并在该步骤中通过env传入NODE_AUTH_TOKEN。请确认目录路径和命令参数符合预期的发布需求。
.github/workflows/release-beta.yml
Outdated
| ref: ${{ github.event.pull_request.head.sha }} | ||
| registry-url: https://registry.npmjs.org |
There was a problem hiding this comment.
错误：actions/checkout 不支持 registry-url 参数
说明：目前 actions/checkout@v4 的输入参数不包含 registry-url（参见 actionlint 提示），建议移除此参数以避免无效配置，或检查是否选用支持该参数的其他 Action。
🧰 Tools
🪛 actionlint (1.7.4)
24-24: input "registry-url" is not defined in action "actions/checkout@v4". available inputs are "clean", "fetch-depth", "fetch-tags", "filter", "github-server-url", "lfs", "path", "persist-credentials", "ref", "repository", "set-safe-directory", "show-progress", "sparse-checkout", "sparse-checkout-cone-mode", "ssh-key", "ssh-known-hosts", "ssh-strict", "ssh-user", "submodules", "token"
(action)
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/release-beta.yml (1)
72-75: 注释 React-Taro 发布步骤
目前Run Releases @nutui/nutui-react-taro部分已被注释。建议在注释中说明停用此步骤的原因，以便团队后续理解和维护。
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/release-beta.yml(3 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (2)
- GitHub Check: build
- GitHub Check: test
🔇 Additional comments (6)
.github/workflows/release-beta.yml (6)
3-6: 触发器变动验证
将原有的push触发器注释掉，并启用pull_request触发器。请验证此变更是否会影响现有 CI/CD 流程，并确保团队已知晓更新后的触发器逻辑。
13-16: 新增权限设置
为release-3x-beta作业添加了contents: write和id-token: write的权限。请确认这些权限不会引入安全风险，并符合项目的发布要求。
21-21: 检出特定提交
指定ref: ${{ github.event.pull_request.head.sha }}可确保工作流检出 PR 的实际提交版本。请确保在所有触发场景下该变量均能正确传递，否则可能导致检出失败。
46-48: 指定注册表 URL
在actions/setup-node步骤中添加了registry-url: 'https://registry.npmjs.org'参数，以确保使用指定的 npm 源。请确认这一设置符合项目对依赖缓存和发布的要求。
61-64: 注释掉 Taro 构建步骤
将pnpm build:taro相关命令注释掉，请确认这是预期行为。如果未来需要处理 Taro 构建，请补充相应说明或后续调整计划。
68-70: 更新发布命令及环境变量
发布步骤更新为使用pnpm --dir ./release/h5 publish:beta，同时配置了NODE_AUTH_TOKEN环境变量。请确认发布目录和令牌配置正确，以避免发布失败。
1 participant
Summary by CodeRabbit
"publish:beta"和"publish:latest"，增强了发布过程的灵活性。'nutuiPickerListHeight'，确保变量集的准确性。