Remove Cloudflare Worker, use client-side GitHub API#6
Closed
jonathanpopham wants to merge 1 commit intomainfrom
Closed
Remove Cloudflare Worker, use client-side GitHub API#6jonathanpopham wants to merge 1 commit intomainfrom
jonathanpopham wants to merge 1 commit intomainfrom
Conversation
Replace the Cloudflare Worker proxy with direct GitHub API calls from the browser using a fine-grained PAT (issues:write scope). The token is injected at build time via ISSUES_TOKEN env var. - Delete worker/ directory (index.js, wrangler.toml) - Generate static skeleton page at /generating/?repo=name - Frontend JS calls GitHub API directly to create issues - build-index.yml passes ISSUES_TOKEN secret to generator - Add .gitignore to exclude site/ build artifacts
WalkthroughThis PR migrates the repository request submission architecture from a Cloudflare Worker proxy to a direct Go backend approach. The ISSUES_TOKEN is now injected into templates and the skeleton loading page is generated server-side via a new Changes
Sequence DiagramsequenceDiagram
actor User
participant Client as Browser (Client JS)
participant Backend as Go Backend
participant GitHubAPI as GitHub API
User->>Client: Load index page
Client->>Backend: GET /
Backend->>Client: Render index template<br/>(inject GH_TOKEN, GH_REPO)
User->>Client: Submit repo URL form
Client->>GitHubAPI: POST /repos/[GH_REPO]/issues<br/>(Bearer GH_TOKEN)
GitHubAPI->>Client: Issue created (success)
Client->>Backend: Navigate to /generating/?repo=name
Backend->>Client: Serve skeleton page<br/>(via generateSkeleton)
Client->>Client: Display loading UI<br/>(poll for docs page)
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@generate-index.go`:
- Around line 114-117: The PageData struct currently includes a Token field and
the code injects ISSUES_TOKEN into rendered HTML (exposing the secret); remove
Token from PageData and stop passing ISSUES_TOKEN into any client-side
templates/JS (references: PageData, ISSUES_TOKEN, and the template rendering in
generate-index.go), then implement a server-side relay endpoint that performs
authenticated GitHub issue creation (or switch to a GitHub App/OAuth flow) so
client JS calls your backend route instead of using the token directly; update
client-side calls (those currently sending the token) to call the new relay
endpoint and remove any code that reads/forwards ISSUES_TOKEN to the browser.
ℹ️ Review info
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
.github/workflows/build-index.yml.gitignoregenerate-index.goworker/index.jsworker/wrangler.toml
💤 Files with no reviewable changes (2)
- worker/wrangler.toml
- worker/index.js
Comment on lines
+114
to
+117
| type PageData struct { | ||
| Config | ||
| Token string | ||
| } |
There was a problem hiding this comment.
Critical: ISSUES_TOKEN is being published to every browser.
Line 153 injects the secret into the HTML, and Lines 539/611 send it from client-side JS. On a static site this is fully exposed (view-source/devtools), so anyone can spam or abuse issue creation on your repo.
Use a server-side relay (or GitHub App flow) so the credential never leaves trusted infrastructure.
🔒 Minimal safe mitigation (disable public token exposure)
type PageData struct {
Config
- Token string
}
@@
- return tmpl.Execute(f, PageData{Config: cfg, Token: os.Getenv("ISSUES_TOKEN")})
+ return tmpl.Execute(f, PageData{Config: cfg})
@@
- var GH_TOKEN = '{{.Token}}';
+ var GH_TOKEN = '';Also applies to: 153-153, 539-541, 608-613
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@generate-index.go` around lines 114 - 117, The PageData struct currently
includes a Token field and the code injects ISSUES_TOKEN into rendered HTML
(exposing the secret); remove Token from PageData and stop passing ISSUES_TOKEN
into any client-side templates/JS (references: PageData, ISSUES_TOKEN, and the
template rendering in generate-index.go), then implement a server-side relay
endpoint that performs authenticated GitHub issue creation (or switch to a
GitHub App/OAuth flow) so client JS calls your backend route instead of using
the token directly; update client-side calls (those currently sending the token)
to call the new relay endpoint and remove any code that reads/forwards
ISSUES_TOKEN to the browser.
Contributor
Author
|
Closing — rethinking the approach from scratch. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/generating/?repo=name.gitignoreadded to excludesite/build artifactsSetup required
issues:writeon this repoISSUES_TOKENrepo secretTest plan
go run generate-index.gogeneratessite/generating/index.htmlSummary by CodeRabbit
Release Notes
New Features
Refactor
Chores