chore: standardize repository config#361
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
❌ Deploy failed
📋 Build log (last lines)🤖 Powered by surge-preview |
|||||||||
|
Warning Review limit reached
More reviews will be available in 11 minutes and 11 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
WalkthroughPR 更新了 Virtual List 的站点与发布配置：调整路径别名和文档输出目录，重写 README 与示例文档，并同步更新 GitHub 资助、依赖检查和多项工作流配置。 ChangesVirtual List 文档与自动化刷新
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the repository configuration, documentation, and build scripts to align with modern rc-component standards. It introduces a revamped README, configures Dumi for documentation, updates TypeScript paths, and adds Vercel deployment settings. The review feedback highlights a few critical issues: the gh-pages script in package.json incorrectly scopes the GH_PAGES environment variable, a redundant alias is defined in .dumirc.ts, and the tsconfig.json file includes an incorrect path for the examples directory.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| "docs:build": "dumi build", | ||
| "docs:deploy": "gh-pages -d docs-dist", | ||
| "deploy": "npm run gh-pages", | ||
| "gh-pages": "cross-env GH_PAGES=1 npm run compile && npm run docs:build && npm run docs:deploy", |
There was a problem hiding this comment.
In shell execution, chaining commands with && (e.g., cross-env VAR=val cmd1 && cmd2) only applies the environment variable to the first command (cmd1). Since GH_PAGES=1 is required by dumi build (run via npm run docs:build) to set the correct basePath and publicPath, the cross-env prefix should be placed directly before npm run docs:build.
| "gh-pages": "cross-env GH_PAGES=1 npm run compile && npm run docs:build && npm run docs:deploy", | |
| "gh-pages": "npm run compile && cross-env GH_PAGES=1 npm run docs:build && npm run docs:deploy", |
| alias: { | ||
| '@rc-component/virtual-list$': path.resolve('src'), | ||
| '@rc-component/virtual-list/es': path.resolve('src'), | ||
| '@rc-component/virtual-list/es/*': path.resolve('src'), | ||
| }, |
There was a problem hiding this comment.
The wildcard alias '@rc-component/virtual-list/es/*' is redundant and potentially problematic. In Webpack/Dumi, prefix matching for '@rc-component/virtual-list/es' is already sufficient to resolve all subpaths (e.g., '@rc-component/virtual-list/es/foo' to 'src/foo').
alias: {
'@rc-component/virtual-list$': path.resolve('src'),
'@rc-component/virtual-list/es': path.resolve('src'),
},| } | ||
| } No newline at end of file | ||
| }, | ||
| "include": [".dumirc.ts", "src", "tests", "docs/examples"], |
There was a problem hiding this comment.
The examples directory is located at the root of the repository (examples/), not inside the docs folder (as seen in docs/demo/horizontal-scroll.md which references ../../examples/horizontal-scroll.tsx). Update the include path to examples so that TypeScript correctly type-checks the example files.
| "include": [".dumirc.ts", "src", "tests", "docs/examples"], | |
| "include": [".dumirc.ts", "src", "tests", "examples"], |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #361 +/- ##
=======================================
Coverage 97.50% 97.50%
=======================================
Files 19 19
Lines 800 800
Branches 193 191 -2
=======================================
Hits 780 780
Misses 20 20 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/react-component-ci.yml:
- Around line 14-15: The reusable workflow call in react-component/rc-test
should not inherit all repository secrets while pointing at a mutable branch.
Update the workflow reference in
react-component/rc-test/.github/workflows/test-utoo.yml from main to a fixed
commit SHA, and replace secrets: inherit with an explicit secrets mapping that
passes only CODECOV_TOKEN. Keep the change in the workflow job that uses the
reusable workflow so the remote workflow gets only the minimum secret it
actually needs.
In `@README.md`:
- Around line 88-98: Update the Release section in README so it matches the
actual prepublishOnly workflow: describe that publishing first runs npm run
compile and then rc-np, and clarify that rc-np comes from the `@rc-component/np`
package. Keep the wording aligned with the existing Release heading and the
prepublishOnly script reference so readers understand the full release flow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c05c0246-b4da-4cb4-a1d6-38bdda4f3ed7
📒 Files selected for processing (15)
.dumirc.ts.github/FUNDING.yml.github/dependabot.yml.github/workflows/codeql.yml.github/workflows/main.yml.github/workflows/react-component-ci.yml.github/workflows/react-doctor.yml.github/workflows/surge-preview.yml.gitignoreREADME.mddocs/demo/horizontal-scroll.mddocs/index.mdpackage.jsontsconfig.jsonvercel.json
💤 Files with no reviewable changes (1)
- .github/workflows/main.yml
| uses: react-component/rc-test/.github/workflows/test-utoo.yml@main | ||
| secrets: inherit |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 查看上游可复用工作流当前内容，确认是否真的消费了 secrets / 额外权限
curl -fsSL https://raw.githubusercontent.com/react-component/rc-test/main/.github/workflows/test-utoo.yml | sed -n '1,240p'
# 解析 main 当前指向的不可变提交，便于把 `@main` 改成固定 SHA
curl -fsSL https://api.github.com/repos/react-component/rc-test/commits/main | jq -r '.sha'Repository: react-component/virtual-list
Length of output: 749
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# 尝试通过 GitHub API v3 获取 react-component/rc-test 的 main commit SHA
curl -fsSL \
-H "Accept: application/vnd.github.v3+json" \
"https://api.github.com/repos/react-component/rc-test/commits/main" \
| jq -r '.sha' || echo "failed"Repository: react-component/virtual-list
Length of output: 222
不要把全部 secrets 继承给外部且可变的工作流。
当前工作流引用了外部仓库 react-component/rc-test 的 main 分支（可变引用），并通过 secrets: inherit 将本仓库的完整 secrets 透传给上游。上游工作流 test-utoo.yml 确实使用了 CODECOV_TOKEN，但这并不意味着它需要访问本仓库的所有 secrets。
若上游分支被意外修改或被劫持，本仓库的敏感信息（如部署凭证、API 密钥等）可能泄露。建议按以下两步修复：
- 固定引用：将
.github/workflows/test-utoo.yml@main替换为具体的 commit SHA。请在 GitHub 上查看react-component/rc-test仓库main分支的最新提交 SHA（例如通过 UI 或gh api），并填入。 - 显式传递 secrets：移除
secrets: inherit，改为仅传递工作流实际需要的CODECOV_TOKEN：
secrets:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} uses: react-component/rc-test/.github/workflows/test-utoo.yml@<请替换为具体 SHA>
secrets:
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}🧰 Tools
🪛 zizmor (1.26.1)
[error] 14-14: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[warning] 14-14: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/react-component-ci.yml around lines 14 - 15, The reusable
workflow call in react-component/rc-test should not inherit all repository
secrets while pointing at a mutable branch. Update the workflow reference in
react-component/rc-test/.github/workflows/test-utoo.yml from main to a fixed
commit SHA, and replace secrets: inherit with an explicit secrets mapping that
passes only CODECOV_TOKEN. Keep the change in the workflow job that uses the
reusable workflow so the remote workflow gets only the minimum secret it
actually needs.
Source: Linters/SAST tools
|
Deployment failed with the following error: Learn More: https://vercel.com/afc163s-projects?upgradeToPro=build-rate-limit |
|
Deployment failed with the following error: Learn More: https://vercel.com/react-component?upgradeToPro=build-rate-limit |
1 participant
Summary
now-buildpath and align preview output ondocs-dist.Test plan
npm run tscnpm test -- --runInBandnpm run lintnpm run buildnpx vercel build --yesRefs ant-design/ant-design#58514
Summary by CodeRabbit