ci: add GitHub Pages deployment workflow#9
Conversation
Deploy index.html to GitHub Pages on push to main or manual trigger. Uses actions/deploy-pages@v4 with path-filtered triggers.
rrabenda
requested review from
MuncleUscles,
dohernandez and
jmlago
as code owners
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a new GitHub Actions workflow to automate deploying a static site to GitHub Pages, triggered on pushes to main (index.html or the workflow file), workflow_dispatch, and PRs; includes checkout, pages setup, artifact upload, and deploy steps with required permissions and environment. Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant Repo as Repository
participant Runner as Actions Runner
participant Pages as GitHub Pages
Dev->>Repo: push to main / trigger workflow_dispatch
Repo->>Runner: start "deploy" job
Runner->>Repo: checkout code
Runner->>Runner: configure-pages
Runner->>Runner: upload-pages-artifact (path: .)
Runner->>Pages: deploy artifact
Pages-->>Runner: deployment result (page_url)
Runner-->>Repo: workflow outputs page_url
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/deploy-website.yml (1)
29-41: Pin GitHub Actions to commit SHAs instead of floating major version tags.The current workflow uses floating tags like
@v4and@v5, which are mutable and can be moved or deleted, creating a supply-chain risk. GitHub's security best practice is to pin actions to full-length commit SHAs (the only immutable way to reference an action release). Include a human-readable SemVer comment alongside the SHA for clarity, and use Dependabot to automate updates.Example:
- uses: actions/checkout@8f4b7f0c6a0d3d7c6f8b1c2d3e4f5a6b7c8d9e0f # v4.1.0 - uses: actions/configure-pages@abf4e2e1f7d5c2b9a8e3f4d6c7b8a9e0f1c2d3e4 # v5.0.0🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/deploy-website.yml around lines 29 - 41, Replace mutable action references (actions/checkout@v4, actions/configure-pages@v5, actions/upload-pages-artifact@v3, actions/deploy-pages@v4) with their corresponding full commit SHAs and add a trailing human-readable SemVer comment for each (e.g., "# v4.1.0"); update the four "uses:" entries in the workflow to use those SHAs and leave the SemVer as a comment for clarity, and enable Dependabot to bump these SHAs automatically in future updates.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/deploy-website.yml:
- Around line 34-37: The Upload artifact step named "Upload artifact" currently
sets path: . which uploads the entire repo; change it to upload only the
generated site output (e.g., the built site directory or index.html) so GitHub
Pages receives only the site files. Update the actions/upload-pages-artifact@v3
step's with.path value from "." to the specific build output path used by your
workflow (for example "public", "docs", or "index.html") to match the push
trigger's scope and avoid including README.md, LICENSE, .github/, Taskfile.yaml,
etc.
- Around line 10-11: The workflow currently triggers on pull_request (the
"pull_request" event with branches: [main]) which causes deployments on PRs;
change the "on" triggers to only include "push" for the default branch (e.g.,
push: branches: [main]) and optionally "workflow_dispatch" so deployments run
only on direct pushes or manual dispatch; update any job-level assumptions if
you used the pull_request context so the deploy job (actions/deploy-pages@v4)
only runs for push/workflow_dispatch triggers.
---
Nitpick comments:
In @.github/workflows/deploy-website.yml:
- Around line 29-41: Replace mutable action references (actions/checkout@v4,
actions/configure-pages@v5, actions/upload-pages-artifact@v3,
actions/deploy-pages@v4) with their corresponding full commit SHAs and add a
trailing human-readable SemVer comment for each (e.g., "# v4.1.0"); update the
four "uses:" entries in the workflow to use those SHAs and leave the SemVer as a
comment for clarity, and enable Dependabot to bump these SHAs automatically in
future updates.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 643e1df9-f38e-4151-9aa9-e1ac126916bb
📒 Files selected for processing (1)
.github/workflows/deploy-website.yml
Pages deployment should only run on push to main, not on PRs.
Copy only index.html into _site/ for upload instead of deploying the entire repository root which included unrelated files.
The configure-pages action sets up Pages environment metadata needed by deploy-pages.
2 participants
Summary
index.htmlto GitHub Pagesmain(whenindex.htmlor the workflow changes), on PRs tomain, and manual dispatchactions/deploy-pages@v4with concurrency protectionTest plan
Summary by CodeRabbit