ci: auto-upload contributor images to Cloudflare#388
Conversation
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
is this duplication intentional?
There was a problem hiding this comment.
yes, bc we checkout both head and base branch
| if (buffer.slice(0, 8).toString("hex") === "89504e470d0a1a0a") { | ||
| const width = buffer.readUInt32BE(16); | ||
| const height = buffer.readUInt32BE(20); | ||
| return { width, height }; | ||
| } | ||
|
|
||
| // JPG: ff d8, scan for SOF marker (0xC0-0xC3) to extract dimensions | ||
| if (buffer.slice(0, 2).toString("hex") === "ffd8") { | ||
| let i = 2; | ||
| while (i < buffer.length) { | ||
| const segmentLength = buffer.readUInt16BE(i + 2); | ||
| if ( | ||
| buffer[i] === 0xff && | ||
| buffer[i + 1] >= 0xc0 && | ||
| buffer[i + 1] <= 0xc3 | ||
| ) { | ||
| const height = buffer.readUInt16BE(i + 5); | ||
| const width = buffer.readUInt16BE(i + 7); | ||
| return { width, height }; | ||
| } | ||
| i += segmentLength + 2; | ||
| } | ||
| } |
There was a problem hiding this comment.
pls add some comments here
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: eda30f0d0c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (!/^0x[0-9a-f]{40}$/i.test(basename)) { | ||
| return { | ||
| ok: false, | ||
| reason: "filename must be 0x + 40 hex chars (address)", |
There was a problem hiding this comment.
validatePath now hard-requires tokens/vaults filenames to be 0x... addresses, so a PR that updates src/assets/tokens/default.png (an existing asset) will fail in upload-assets before images can run. This is a regression from scripts/validateImages.ts, which explicitly exempts default-named images, and it blocks legitimate default-logo refreshes even though they were previously valid.
Useful? React with 👍 / 👎.
2 participants
Summary
src/assets/{tokens,vaults,validators}/to Cloudflare Images, sovalidate:imagesno longer fails for PRs from contributors who don't have Cloudflare credentials.cloudflare-uploadsGitHub Environment with required reviewers — every asset-changing PR pauses on "Waiting for review" before any secret is exposed.imagescheck turns green in the same workflow run.How it works
New jobs in
.github/workflows/validate.yml:detect-changes— usesdorny/paths-filter@v3to setassets-changedoutput. No secrets.upload-assets—needs: [schema, detect-changes],if: assets-changed == 'true',environment: cloudflare-uploads. Runspnpm upload:assets ./head. For JSON-only PRs this is skipped before the environment prompt is ever requested.images— reordered: nowneeds: [schema, upload-assets]withif: always() && schema == success && (upload-assets == success || skipped). This makes image validation re-run after upload, and still runs immediately for JSON-only PRs (skipped dep counts as satisfied).The new
scripts/uploadAssets.ts:src/assets/**files viagh api /repos/{repo}/pulls/{pr}/files --paginate(base-branch script against PR head bytes — untrusted PR code is never executed).scripts/utils/_imageChecks.ts.id = "{type}/{filename}"matchingaddVaultLogo.tsconvention.ALREADY_EXISTS: DELETE then retry POST once (overwrite mode).$GITHUB_STEP_SUMMARY, posts it as a PR comment, and exits non-zero on any failure.Security model (defense in depth)
cloudflare-uploadswith required reviewers — the sole secrets gate. Secrets live on the environment, not the repo, so no other job ever sees them.pnpm install+scripts/uploadAssets.ts; PR head is checked out to./headand only image bytes are read from there. PR head is pinned topull_request.head.sha(frozen at event time) to prevent a force-push race between approval and checkout.contents: read; onlyupload-assetsgetspull-requests: writefor its summary comment.One-time repo setup
Needs to happen in repo Settings before the workflow is useful:
cloudflare-uploadswith required reviewers = maintainers allowed to approve uploads. Optionally restrict tomainbranch.CLOUDFLARE_ACCOUNT_IDandCLOUDFLARE_IMAGES_API_TOKEN(token scoped to Cloudflare Images: Edit only).Test plan
src/assets/tokens/0x<checksum>.png(1024×1024, no transparency): confirmdetect-changesoutputsassets-changed=true,upload-assetspauses on "Waiting for review", approving unlocks the upload, andimagesthen runs green in the same run.5409 → DELETE → re-POSTpath runs and the summary shows the file underoverwritten../head/scripts/uploadAssets.ts: confirm the workflow still executes the base-branch script (no untrusted code runs).imagessubsequently fails with HEAD 404.upload-assetsis skipped (no environment prompt) andimagesruns immediately and passes.🤖 Generated with Claude Code