Conversation
📝 WalkthroughWalkthroughModified the GitHub Actions workflow to trigger on pull requests instead of push events on the main branch, and added a new step to upload the merged documentation file as a workflow artifact with a 30-day retention period. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
🚀 Deployed on https://deploy-preview-581--glific-docs.netlify.app |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/export_and_update.yml:
- Around line 4-5: The workflow currently triggers on pull_request for main
which allows unmerged PRs to run destructive Step 5 (vector-store
delete/replace); change the trigger or add a guard so only pushes to main can
perform mutations: keep pull_request for building/artifact steps but wrap the
destructive job/step (referenced as Step 5 / the vector-store update step) with
a condition such as if: github.event_name == 'push' && github.ref ==
'refs/heads/main' or move the vector-store update into a separate workflow
triggered only on push to main so PRs (and forked PRs without secrets) cannot
mutate production data.
| pull_request: | ||
| branches: [main] |
There was a problem hiding this comment.
Restrict production vector-store mutations to post-merge events
Line 4 now runs this workflow on every PR update, but Step 5 performs destructive external operations (delete + replace in the vector store). That allows unmerged PR code to mutate production data and can also fail on fork PRs due to missing secrets.
🔧 Suggested fix (keep artifact on PR, run vector-store update only on push to main)
on:
pull_request:
branches: [main]
+ push:
+ branches: [main]
@@
# Step 5: Upload to Vector Store
- name: Upload to Vector Store
+ if: github.event_name == 'push'
env:
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
VECTOR_STORE_ID: ${{ secrets.VECTOR_STORE_ID }}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/export_and_update.yml around lines 4 - 5, The workflow
currently triggers on pull_request for main which allows unmerged PRs to run
destructive Step 5 (vector-store delete/replace); change the trigger or add a
guard so only pushes to main can perform mutations: keep pull_request for
building/artifact steps but wrap the destructive job/step (referenced as Step 5
/ the vector-store update step) with a condition such as if: github.event_name
== 'push' && github.ref == 'refs/heads/main' or move the vector-store update
into a separate workflow triggered only on push to main so PRs (and forked PRs
without secrets) cannot mutate production data.
Summary by CodeRabbit