Skip to content

chore: remove redundant version input from manual workflow triggers#42

Merged
ThePlenkov merged 3 commits intomainfrom
copilot/react-to-pull-request-comments
Mar 2, 2026
Merged

chore: remove redundant version input from manual workflow triggers#42
ThePlenkov merged 3 commits intomainfrom
copilot/react-to-pull-request-comments

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Mar 2, 2026

The publish, publish-gpr, and docker workflows had a version input on workflow_dispatch that duplicated GitHub's built-in branch/tag selector. The fallback logic also embedded ${{ github.ref_name }} directly in a bash script (injection risk) and kept an unused GH_TOKEN env var after gh release view was removed.

Changes

  • workflow_dispatch: Removed version input from all three workflows — the UI branch/tag picker is sufficient
  • workflow_call: Retained version input — still required by release.yml to pass the newly created tag downstream
  • Resolve ref step: Removed entirely; replaced with an inline expression on the checkout ref:
    ref: ${{ inputs.version || github.ref_name }}
    This eliminates the bash step, the injection risk, and the stale GH_TOKEN env var in one go
  • Input descriptions: Updated to reflect actual fallback behavior (github.ref_name) instead of the now-removed "latest release" default

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Copilot AI and others added 2 commits March 2, 2026 12:18
Co-authored-by: ThePlenkov <6381507+ThePlenkov@users.noreply.github.com>
…h/tag selector

Co-authored-by: ThePlenkov <6381507+ThePlenkov@users.noreply.github.com>
Copilot AI changed the title [WIP] React to comments on pull request 41 chore: remove redundant version input from manual workflow triggers Mar 2, 2026
@ThePlenkov ThePlenkov marked this pull request as ready for review March 2, 2026 12:23
@ThePlenkov ThePlenkov merged commit a3a711e into main Mar 2, 2026
@ThePlenkov ThePlenkov deleted the copilot/react-to-pull-request-comments branch March 2, 2026 12:23
@qodo-code-review
Copy link
Copy Markdown

Review Summary by Qodo

Simplify workflow ref resolution and remove redundant version inputs

✨ Enhancement

Grey Divider

Walkthroughs

Description
• Remove redundant version input from workflow_dispatch triggers
• Replace bash ref resolution step with inline expression
• Eliminate injection risk and unused GH_TOKEN variable
• Update input descriptions to reflect actual fallback behavior
Diagram
flowchart LR
  A["workflow_dispatch<br/>with version input"] -->|removed| B["Built-in branch/tag selector"]
  C["Bash resolve-ref step<br/>with GH_TOKEN"] -->|replaced| D["Inline expression<br/>inputs.version || github.ref_name"]
  E["Misleading descriptions<br/>defaults to latest release"] -->|updated| F["Accurate descriptions<br/>defaults to triggered ref"]
  B --> G["Simplified workflows"]
  D --> G
  F --> G
Loading

Grey Divider

File Changes

1. .github/workflows/docker.yml ✨ Enhancement +2/-22

Simplify Docker workflow ref resolution

• Removed version input from workflow_dispatch section
• Deleted "Resolve ref" bash step with GH_TOKEN env var
• Replaced multi-line ref resolution with inline expression `${{ inputs.version || github.ref_name
 }}`
• Updated workflow_call input description to reflect actual fallback behavior

.github/workflows/docker.yml


2. .github/workflows/publish-gpr.yml ✨ Enhancement +2/-22

Simplify GitHub Packages publish workflow ref resolution

• Removed version input from workflow_dispatch section
• Deleted "Resolve ref" bash step with GH_TOKEN env var
• Replaced multi-line ref resolution with inline expression `${{ inputs.version || github.ref_name
 }}`
• Updated workflow_call input description to reflect actual fallback behavior

.github/workflows/publish-gpr.yml


3. .github/workflows/publish.yml ✨ Enhancement +2/-22

Simplify npm publish workflow ref resolution

• Removed version input from workflow_dispatch section
• Deleted "Resolve ref" bash step with GH_TOKEN env var
• Replaced multi-line ref resolution with inline expression `${{ inputs.version || github.ref_name
 }}`
• Updated workflow_call input description to reflect actual fallback behavior

.github/workflows/publish.yml


Grey Divider

Qodo Logo

@qodo-code-review
Copy link
Copy Markdown

qodo-code-review Bot commented Mar 2, 2026

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Grey Divider

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Grey Divider

ⓘ The new review experience is currently in Beta. Learn more

Grey Divider

Qodo Logo

ThePlenkov added a commit that referenced this pull request Apr 21, 2026
fix(main): resolve CodeQL alerts #38 and #42 in nx-npm-trust
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants