Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 10 additions & 8 deletions .dumirc.ts
Original file line number Diff line number Diff line change
@@ -1,17 +1,19 @@
// more config: https://d.umijs.org/config
import { defineConfig } from 'dumi';

const basePath = process.env.GH_PAGES ? '/menu/' : '/';
const publicPath = process.env.GH_PAGES ? '/menu/' : '/';

export default defineConfig({
themeConfig: {
name: 'rc-menu',
name: 'Menu',
logo: 'https://avatars0.githubusercontent.com/u/9441414?s=200&v=4',
nav: [
{ title: 'Demo', link: '/demo/antd'}
],
nav: [{ title: 'Demo', link: '/demo/antd' }],
},
favicons:
['https://avatars0.githubusercontent.com/u/9441414?s=200&v=4'],
outputPath: '.doc',
favicons: ['https://avatars0.githubusercontent.com/u/9441414?s=200&v=4'],
outputPath: 'docs-dist',
base: basePath,
publicPath,
exportStatic: {},
mfsu: {},
styles: [
Expand All @@ -20,5 +22,5 @@ export default defineConfig({
width: auto !important;
}
`,
]
],
});
17 changes: 2 additions & 15 deletions .github/FUNDING.yml
Original file line number Diff line number Diff line change
@@ -1,15 +1,2 @@
# These are supported funding model platforms

github: ant-design # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
patreon: # Replace with a single Patreon username
open_collective: ant-design # Replace with a single Open Collective username
ko_fi: # Replace with a single Ko-fi username
tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
liberapay: # Replace with a single Liberapay username
issuehunt: # Replace with a single IssueHunt username
lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
polar: # Replace with a single Polar username
buy_me_a_coffee: # Replace with a single Buy Me a Coffee username
thanks_dev: # Replace with a single thanks.dev username
custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
github: ant-design
open_collective: ant-design
22 changes: 12 additions & 10 deletions .github/workflows/codeql.yml
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
name: "CodeQL"
name: 'CodeQL'

on:
push:
branches: [ "master" ]
branches: ['master']
pull_request:
branches: [ "master" ]
branches: ['master']
schedule:
- cron: "12 22 * * 6"
- cron: '12 22 * * 6'

jobs:
analyze:
Expand All @@ -20,22 +20,24 @@ jobs:
strategy:
fail-fast: false
matrix:
language: [ javascript ]
language: [javascript]

steps:
- name: Checkout
uses: actions/checkout@v3
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
with:
persist-credentials: false

- name: Initialize CodeQL
uses: github/codeql-action/init@v2
uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e
with:
languages: ${{ matrix.language }}
queries: +security-and-quality

- name: Autobuild
uses: github/codeql-action/autobuild@v2
uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e

- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e
with:
category: "/language:${{ matrix.language }}"
category: '/language:${{ matrix.language }}'
6 changes: 0 additions & 6 deletions .github/workflows/main.yml

This file was deleted.

8 changes: 8 additions & 0 deletions .github/workflows/react-component-ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
name: ✅ test
on: [push, pull_request]
permissions:
contents: read
jobs:
test:
uses: react-component/rc-test/.github/workflows/test-utoo.yml@main
secrets: inherit
Comment on lines +6 to +8

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Resolved SHA for react-component/rc-test@main:"
gh api repos/react-component/rc-test/commits/main --jq '.sha'

echo
echo "Reusable workflow definition:"
gh api repos/react-component/rc-test/contents/.github/workflows/test-utoo.yml?ref=main --jq '.content' \
  | base64 -d \
  | sed -n '1,220p'

Repository: react-component/menu

Length of output: 809


请固定复用工作流版本并收窄 secrets 暴露面。

当前配置引用 @main 分支且使用 secrets: inherit,存在上游代码漂移风险和敏感信息过度暴露风险。经核实,上游工作流实际需要 CODECOV_TOKEN,建议锁定提交版本并仅传递该必要密钥。

具体建议:

  1. uses 版本锁定为 SHA:b8ebddc81ef706b50faff0242ab34ad8ecdd9a59
  2. 移除 secrets: inherit,改为显式配置 CODECOV_TOKEN
建议修改
  test:
    uses: react-component/rc-test/.github/workflows/test-utoo.yml@b8ebddc81ef706b50faff0242ab34ad8ecdd9a59
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
🧰 Tools
🪛 zizmor (1.26.1)

[error] 7-7: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)


[warning] 7-7: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow

(secrets-inherit)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/react-component-ci.yml around lines 6 - 8, Update the
reusable workflow call in the test job to avoid drift and overexposure of
secrets: replace the current react-component/rc-test workflow reference in the
test job from the moving branch target to the pinned SHA
b8ebddc81ef706b50faff0242ab34ad8ecdd9a59, and remove secrets: inherit so only
the required CODECOV_TOKEN is passed explicitly via the test job’s secrets
block.

Source: Linters/SAST tools

27 changes: 27 additions & 0 deletions .github/workflows/react-doctor.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
name: React Doctor

on:
pull_request:
types: [opened, synchronize, reopened, ready_for_review]
push:
branches: [master]

permissions:
contents: read
pull-requests: write
issues: write
statuses: write

concurrency:
group: react-doctor-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

jobs:
react-doctor:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
with:
fetch-depth: 0
persist-credentials: false
- uses: millionco/react-doctor@0b4f4f4bd248a154e64eb508a48347f71154b3f3
39 changes: 39 additions & 0 deletions .github/workflows/surge-preview.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
name: Surge Preview

on:
pull_request:

concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
cancel-in-progress: true

permissions:
contents: read
pull-requests: write
checks: write
statuses: write

jobs:
preview:
runs-on: ubuntu-latest
env:
SURGE_TOKEN: ${{ secrets.SURGE_TOKEN }}
PREVIEW: true
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
with:
persist-credentials: false
- uses: afc163/surge-preview@bf90a5a86111f6311ca42f0a5a0f80fb0fb03cec
if: ${{ env.SURGE_TOKEN != '' }}
with:
surge_token: ${{ env.SURGE_TOKEN }}
github_token: ${{ secrets.GITHUB_TOKEN }}
dist: docs-dist
failOnError: false
setCommitStatus: false
build: |
npm install
npm run build
- name: Skip Surge preview
if: ${{ env.SURGE_TOKEN == '' }}
run: echo "SURGE_TOKEN is not configured; skip Surge preview."
5 changes: 4 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ build
lib
es
coverage
.doc
docs-dist/
yarn.lock
package-lock.json
pnpm-lock.yaml
Expand All @@ -38,4 +40,5 @@ pnpm-lock.yaml
.dumi/tmp-production
.env.local

bun.lockb
bun.lockb
.vercel
Loading
Loading