ci: build dist on merge to main, publish to dedicated dist branch - #66
Merged
Conversation
Adds .github/workflows/publish-dist.yml: triggered on push to main, runs `npm run build`, then force-pushes the dist/ tree (plus a SOURCE.txt stamp recording the source commit) to a dedicated orphan `dist` branch. The dist branch contains only built artifacts at its root, so jsDelivr URLs become: https://cdn.jsdelivr.net/gh/codeslash-dev/SLASHED@dist/slashed.essential.min.css This keeps main free of generated files (the original goal of #63) without sacrificing the @main-style CDN distribution path. Build runs once per merge instead of on every commit, and concurrency is set to cancel-in-progress on the publish-dist group so racing merges don't race force-pushes. docs/demo.html migrated to @dist for the built bundle (line 8). The optional/tokens.palette.css link stays on @main because it references a source file that lives only on main. Existing @main/dist/ URLs continue to work for now (dist/ is on main courtesy of #65). After the dist branch is verified populated, a follow-up PR can re-add dist/ to .gitignore and remove it from main, completing the original cleanup safely.
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow that builds ChangesAutomated CSS publication to dist branch
Sequence Diagram(s)sequenceDiagram
participant ComponentA
participant ComponentB
ComponentA->>ComponentB: observable interaction
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/publish-dist.yml (1)
17-17: ⚡ Quick winRestrict manual dispatch publishes to
mainonly.Line 17 allows dispatch from any selected ref; that can publish non-
mainartifacts todistby mistake.Suggested fix
jobs: publish-dist: + if: github.ref == 'refs/heads/main' name: Build and force-push dist branch🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish-dist.yml at line 17, The workflow currently allows manual dispatch from any ref via the workflow_dispatch trigger; modify the workflow_dispatch configuration so manual runs are restricted to the main branch only by adding a branches filter (e.g., set workflow_dispatch to include branches: [main]) so only refs on main can trigger a manual publish; update the workflow_dispatch entry in the publish-dist.yml accordingly.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish-dist.yml:
- Line 34: Replace the mutable action tags with immutable commit SHAs: locate
the two occurrences "uses: actions/checkout@v4" and "uses:
actions/setup-node@v4" and change them to the corresponding pinned SHAs (e.g.,
"uses: actions/checkout@<commit-sha>" and "uses:
actions/setup-node@<commit-sha>") by copying the latest stable commit SHA from
each action's GitHub repository (or marketplace) and updating the workflow;
commit the change and verify the workflow runs successfully.
- Around line 33-36: The workflow's "Checkout main" step uses
actions/checkout@v4 which by default persists credentials to the repo git
config; change that checkout step to set persist-credentials: false to avoid
leaving GITHUB_TOKEN in the workspace, and instead add explicit authentication
only where you perform the push (e.g., pass the token to the push action or
configure git remote/auth in the specific push step). Update the "Checkout main"
step (actions/checkout@v4) to include persist-credentials: false and ensure the
subsequent push step uses an explicit token input for authentication.
---
Nitpick comments:
In @.github/workflows/publish-dist.yml:
- Line 17: The workflow currently allows manual dispatch from any ref via the
workflow_dispatch trigger; modify the workflow_dispatch configuration so manual
runs are restricted to the main branch only by adding a branches filter (e.g.,
set workflow_dispatch to include branches: [main]) so only refs on main can
trigger a manual publish; update the workflow_dispatch entry in the
publish-dist.yml accordingly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 77dffdb4-cb0f-4f42-967d-cbc3d8ee1ab2
📒 Files selected for processing (2)
.github/workflows/publish-dist.ymldocs/demo.html
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout main | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/publish-dist.yml"
echo "== File: $FILE =="
if [ -f "$FILE" ]; then
nl -ba "$FILE" | sed -n '1,160p'
else
echo "Missing $FILE"
fi
echo
echo "== Extract uses: lines =="
rg -n '^\s*uses:\s*actions/(checkout|setup-node)@' .github/workflows/publish-dist.yml || trueRepository: codeslash-dev/SLASHED
Length of output: 173
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/publish-dist.yml"
echo "== File: $FILE =="
if [ -f "$FILE" ]; then
# Print with line numbers without relying on `nl`
awk '{printf "%5d\t%s\n", NR, $0}' "$FILE" | sed -n '1,220p'
else
echo "Missing $FILE"
fi
echo
echo "== Extract uses: lines =="
rg -n '^\s*uses:\s*actions/(checkout|setup-node)@' "$FILE" || trueRepository: codeslash-dev/SLASHED
Length of output: 3307
Pin GitHub Actions to immutable SHAs.
.github/workflows/publish-dist.yml uses mutable tags:
uses: actions/checkout@v4(line 34)uses: actions/setup-node@v4(line 39)
Suggested fix
- - name: Checkout main
- uses: actions/checkout@v4
+ - name: Checkout main
+ uses: actions/checkout@<full-length-commit-sha> # actions/checkout v4.x
- - name: Setup Node
- uses: actions/setup-node@v4
+ - name: Setup Node
+ uses: actions/setup-node@<full-length-commit-sha> # actions/setup-node v4.x🧰 Tools
🪛 zizmor (1.25.2)
[error] 34-34: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish-dist.yml at line 34, Replace the mutable action
tags with immutable commit SHAs: locate the two occurrences "uses:
actions/checkout@v4" and "uses: actions/setup-node@v4" and change them to the
corresponding pinned SHAs (e.g., "uses: actions/checkout@<commit-sha>" and
"uses: actions/setup-node@<commit-sha>") by copying the latest stable commit SHA
from each action's GitHub repository (or marketplace) and updating the workflow;
commit the change and verify the workflow runs successfully.
Per the review on PR #66: actions/checkout@v4 defaults to persist-credentials: true, which writes GITHUB_TOKEN into .git/config and leaves it readable by every subsequent step (npm install, npm run build, the build script itself). Combined with `contents: write` on this job, that's a wider blast radius than the workflow needs — only the final force-push step legitimately needs push credentials. Flip persist-credentials to false on checkout, and authenticate explicitly at push time via GITHUB_TOKEN scoped to that one step.
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/publish-dist.yml (1)
68-90:⚠️ Potential issue | 🟠 Major | ⚡ Quick winGuard
publish-distsoworkflow_dispatchcan’t publish non-mainbuilds.
workflow_dispatchcan be started for any selected branch, and the run will use that branch’s ref asgithub.ref—so the force-push would overwritedistwith non-merged artifacts. Gate the job torefs/heads/main.🔧 Suggested fix
jobs: publish-dist: + if: github.ref == 'refs/heads/main' name: Build and force-push dist branch🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/publish-dist.yml around lines 68 - 90, The publish step currently force-pushes whatever branch triggered the run; restrict it so only runs on the main branch can publish by adding a guard like if: github.ref == 'refs/heads/main' (placed on the publish-dist job or at least on the "Force-push dist branch" step) so workflow_dispatch runs from other branches cannot overwrite dist; update the workflow to check github.ref == 'refs/heads/main' before executing the git checkout/orphan + git push sequence.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/publish-dist.yml:
- Around line 68-90: The publish step currently force-pushes whatever branch
triggered the run; restrict it so only runs on the main branch can publish by
adding a guard like if: github.ref == 'refs/heads/main' (placed on the
publish-dist job or at least on the "Force-push dist branch" step) so
workflow_dispatch runs from other branches cannot overwrite dist; update the
workflow to check github.ref == 'refs/heads/main' before executing the git
checkout/orphan + git push sequence.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 8802cf36-69ea-4bba-8a0f-3f9689d17c70
📒 Files selected for processing (1)
.github/workflows/publish-dist.yml
7 tasks
This was referenced Jun 8, 2026
This was referenced Jun 25, 2026
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request was created by @kiro-agent on behalf of @jackgranatowski 👻
Comment with /kiro fix to address specific feedback or /kiro all to address everything.
Learn about Kiro autonomous agent
Summary
Replaces the per-commit dist regeneration (via the
.githooks/pre-commithook) with a once-per-merge GitHub Action that publishes built CSS bundles to a dedicated orphandistbranch.After this lands, the build runs exactly once per merge to main, not on every commit.
Architecture
The
distbranch:mainSOURCE.txtstamp recording the source commit/build timestampdist/prefix), so jsDelivr URLs are cleanWhy this shape
cdn.jsdelivr.net/gh/...URL family as before — no migration path needed for the 99% of users who use/gh/. Just s/@main/@dist/.cdn.jsdelivr.net/npm/slashed/...404 entirely (the npm name is taken by an unrelated package).publish-distwithcancel-in-progress: true— if multiple PRs merge in quick succession, only the latest source commit's build wins. No racing force-pushes.Changes
.github/workflows/publish-dist.ymlpush: main, builds, force-pushes orphandistbranch withSOURCE.txtprovenance stamp.docs/demo.html@main/dist/...→@dist/.... Theoptional/tokens.palette.csslink stays on@mainbecause it references a source file.Sequencing relative to #65
dist/to main so existing@main/dist/...URLs in the wild stop being broken (they're currently surviving on jsDelivr edge cache that will expire within ~12h).@main/dist/...(legacy) and@dist/...(new) work simultaneously while users migrate.dist/to.gitignoreand remove it from main, fully completing chore: clean up repo structure and gitignore #63's original cleanup. Safe to do once@distis verified populated and consumers have moved.Tested
js-yamlparse on the workflow), 6 well-named steps in expected order.cancel-in-progress: trueis the safer default for force-push publishers — never lets an older build clobber a newer one.Note
I did not configure the workflow to delete the existing
.githooks/pre-commitrebuild block. Removing the pre-commit rebuild would be the natural next step (developers no longer need to rebuild locally for CDN consumers — only for their own testing) but I left it as a separate decision so anyone running with the hook installed isn't surprised by behaviour changes inside this PR.Summary by CodeRabbit