chore: standardize repository tooling#640
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
More reviews will be available in 4 minutes and 26 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
Walkthrough新增多个 CI/预览工作流与 Vercel 配置；重写 README 的安装、用法、API、开发和发布内容；并调整 package.json 脚本、开发依赖与资金配置。 ChangesCI 与预览自动化
文档与工具配置
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the README.md with modern React usage examples, an updated API table, and updated development commands. It also fixes a typo in the lint script, adds a prettier script, and updates ESLint-related dependencies in package.json. The review feedback suggests simplifying the usage example in the README to avoid redundant state management that conflicts with the component's internal value handling.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| const App = () => { | ||
| const [label, setLabel] = React.useState(''); | ||
|
|
||
| return ( | ||
| <Cascader | ||
| options={options} | ||
| onChange={(_, selectedOptions) => { | ||
| setLabel(selectedOptions.map(option => option.label).join(' / ')); | ||
| }} | ||
| > | ||
| <input placeholder="Please select" value={label} readOnly /> | ||
| </Cascader> | ||
| ); | ||
| }; |
There was a problem hiding this comment.
In rc-cascader, the component automatically manages the display value of the child trigger element (like <input />) using the selected options. Manually managing a label state and passing it as value={label} to the <input> is redundant and will conflict with the internal input value management of BaseSelect (which handles rendering, searching, and selection).
Instead, you should showcase a clean uncontrolled usage, or a proper controlled usage where the value is passed to the Cascader component itself rather than the child <input>. Here is the simplified uncontrolled usage:
| const App = () => { | |
| const [label, setLabel] = React.useState(''); | |
| return ( | |
| <Cascader | |
| options={options} | |
| onChange={(_, selectedOptions) => { | |
| setLabel(selectedOptions.map(option => option.label).join(' / ')); | |
| }} | |
| > | |
| <input placeholder="Please select" value={label} readOnly /> | |
| </Cascader> | |
| ); | |
| }; | |
| const App = () => ( | |
| <Cascader options={options}> | |
| <input placeholder="Please select" /> | |
| </Cascader> | |
| ); |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #640 +/- ##
=======================================
Coverage 99.39% 99.39%
=======================================
Files 22 22
Lines 661 661
Branches 204 203 -1
=======================================
Hits 657 657
Misses 4 4 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
package.json (1)
41-41: 🧹 Nitpick | 🔵 Trivial补充
.prettierignore仓库已有
.prettierrc，但没有.prettierignore。prettier --write --ignore-unknown .会遍历整个仓库，建议补上忽略规则，避免误处理构建产物、依赖或产出目录。🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` at line 41, Add a .prettierignore to complement the existing Prettier setup so the prettier --write --ignore-unknown . script in package.json does not traverse and format generated or third-party files. Update the ignore rules to cover build outputs, dependency folders, and other generated artifacts, and verify the ignore file is picked up by the existing Prettier workflow.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/react-doctor.yml:
- Around line 22-25: Pin the mutable workflow actions in
.github/workflows/react-doctor.yml by replacing actions/checkout@v5 and
millionco/react-doctor@v2 with their full commit SHAs, and update the checkout
step to disable credential persistence by setting persist-credentials to false.
Use the existing checkout and react-doctor steps as the targets for the change.
---
Nitpick comments:
In `@package.json`:
- Line 41: Add a .prettierignore to complement the existing Prettier setup so
the prettier --write --ignore-unknown . script in package.json does not traverse
and format generated or third-party files. Update the ignore rules to cover
build outputs, dependency folders, and other generated artifacts, and verify the
ignore file is picked up by the existing Prettier workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7caa662b-7a8f-4ffb-937d-61a9d1d87af8
📒 Files selected for processing (3)
.github/workflows/react-doctor.ymlREADME.mdpackage.json
afc163
force-pushed
the
codex/standardize-rc-config
branch
from
4063c7a to
c232fba
Compare
❌ Deploy failed
📋 Build log (last lines)🤖 Powered by surge-preview |
|||||||||
afc163
force-pushed
the
codex/standardize-rc-config
branch
from
c232fba to
5c92677
Compare
afc163
force-pushed
the
codex/standardize-rc-config
branch
from
5c92677 to
e3ec61e
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/surge-preview.yml (1)
11-33: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win给预览任务加并发分组，避免旧提交覆盖新预览。
同一个 PR 连续 push 时，这个 workflow 会并行保留多个
preview运行；较早的 run 如果后完成，可能把较新的预览结果覆盖掉。♻️ 建议修改
jobs: preview: + concurrency: + group: surge-preview-${{ github.event.pull_request.number }} + cancel-in-progress: true runs-on: ubuntu-latest🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/surge-preview.yml around lines 11 - 33, The preview workflow can run multiple `preview` jobs in parallel for successive pushes on the same PR, allowing older runs to overwrite newer Surge previews. Add a workflow-level concurrency group to the `preview` job in `surge-preview.yml` so only the latest run for a given PR/branch stays active, and cancel any in-progress older run when a new commit arrives. Use the existing `preview` job as the target and key the group off the PR or ref context so the behavior remains isolated per PR.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/main.yml:
- Around line 5-6: Workflow reuse is currently pinned to an external branch ref,
which makes the dependency mutable and keeps inherited secrets exposed to future
upstream changes. Update the reusable workflow reference in the main workflow to
use a specific commit SHA for
react-component/rc-test/.github/workflows/test-utoo.yml, and then review the
secrets: inherit usage to narrow it if possible so only required secrets are
passed through.
---
Nitpick comments:
In @.github/workflows/surge-preview.yml:
- Around line 11-33: The preview workflow can run multiple `preview` jobs in
parallel for successive pushes on the same PR, allowing older runs to overwrite
newer Surge previews. Add a workflow-level concurrency group to the `preview`
job in `surge-preview.yml` so only the latest run for a given PR/branch stays
active, and cancel any in-progress older run when a new commit arrives. Use the
existing `preview` job as the target and key the group off the PR or ref context
so the behavior remains isolated per PR.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: a6dd78fb-7fac-4043-95c9-0d4ff8e4a409
📒 Files selected for processing (8)
.github/FUNDING.yml.github/workflows/codeql.yml.github/workflows/main.yml.github/workflows/react-doctor.yml.github/workflows/surge-preview.ymlREADME.mdpackage.jsonvercel.json
✅ Files skipped from review due to trivial changes (3)
- .github/FUNDING.yml
- vercel.json
- README.md
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/react-doctor.yml
| uses: react-component/rc-test/.github/workflows/test-utoo.yml@main | ||
| secrets: inherit |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
请把复用工作流固定到提交 SHA。
Line 5 现在引用的是外部仓库的 @main，而 Line 6 又无条件 secrets: inherit。这意味着上游分支后续任何变更都会直接拿到当前仓库继承过去的 secrets，属于明显的供应链放大面。至少应先把 react-component/rc-test/.github/workflows/test-utoo.yml 固定到 commit SHA，再评估是否还能把继承的 secrets 收窄到必需集合。
🧰 Tools
🪛 zizmor (1.26.1)
[error] 5-5: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 5-5: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/main.yml around lines 5 - 6, Workflow reuse is currently
pinned to an external branch ref, which makes the dependency mutable and keeps
inherited secrets exposed to future upstream changes. Update the reusable
workflow reference in the main workflow to use a specific commit SHA for
react-component/rc-test/.github/workflows/test-utoo.yml, and then review the
secrets: inherit usage to narrow it if possible so only required secrets are
passed through.
Source: Linters/SAST tools
|
Deployment failed with the following error: Learn More: https://vercel.com/react-component?upgradeToPro=build-rate-limit |
1 participant
Summary
@rc-component/cascaderheader, package-specific emoji description, focused highlights, install, usage, examples, API, development, and release sections.npm install @rc-component/cascadercommand, and add a subtle Ant Design ecosystem note.@umijs/fabricconfig so lint and compile remain runnable.test-utoo.yml.master..github/FUNDING.ymlto Ant Design sponsorship entries.Compatibility
No runtime code changes. This should not introduce breaking changes.
Verification
npm run lintnpm testnpm run tscnpm run lint:tscnpm run compilenpm run buildgit diff --checkSummary by CodeRabbit
prettier、修正lint扩展名；补充react-doctor/Surge 预览与 Vercel 构建配置。Refs ant-design/ant-design#58514