feat: ship @gitpulse/cli + reusable Pages workflow#26
Merged
Conversation
Replaces the internal @gitpulse/action workspace with a publishable @gitpulse/cli package exposing `analyze` and `build` subcommands via env-only configuration. Drops the JS-action approach (ncc bundling fragility) for a single npm artifact that works in GH Actions, Vercel/Netlify build hooks, and local dev. - Rename action/ → cli/ workspace (package @gitpulse/action → @gitpulse/cli) - cli/src/cli.ts: subcommand dispatcher (analyze | build | --version | --help) - cli/src/build.ts: clones matching gitpulse tag, runs Next static export - cli/tsconfig.build.json: emit-mode tsc with rewriteRelativeImportExtensions - .github/workflows/publish-pages.yaml: reusable workflow consuming npx @gitpulse/cli@0 (replaces broken-for-externals publish.yaml) - self-deploy.yml: rewritten inline using local CLI workspace - release-please.yml: publish-cli job via Trusted Publishing (OIDC, no token) - release-please config: add cli package for linked versioning - site/next.config.js: GITPULSE_BASE_PATH override for non-Pages deploys - ci.yml: verify CLI tsc build on every PR Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThis PR introduces a new ChangesCLI Tooling & Release Pipeline
Sequence Diagram(s)sequenceDiagram
participant GHWF as GitHub Workflow
participant CLI as `@gitpulse/cli`
participant Repo as Site Repo (clone/build)
participant Pages as GitHub Pages
participant NPM as npm Registry
GHWF->>CLI: npx `@gitpulse/cli` analyze (env: AI_*, GITPULSE_*, OPENAI_API_KEY)
CLI-->>GHWF: AnalyzerResult (dataDir, counts)
GHWF->>CLI: npx `@gitpulse/cli` build (GITPULSE_BASE_PATH, GITPULSE_SITE_URL)
CLI->>Repo: git clone repo@ref
CLI->>Repo: copy analyzed data -> site/public/data
CLI->>Repo: yarn install && yarn workspace `@gitpulse/site` build
Repo-->>GHWF: built site output (./.gitpulse/out)
GHWF->>Pages: deploy artifact
alt CLI release created
GHWF->>NPM: build CLI, npm publish (OIDC/provenance)
NPM-->>GHWF: publish result
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~50 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
| Filename | Overview |
|---|---|
| cli/src/build.ts | New file implementing gitpulse build: clones the matching gitpulse site tag, copies analyzer output, and runs the static export. Previously-flagged secret-forwarding issue is now properly addressed via sanitizeEnvForClonedBuild. Minor: yarn is required in PATH, which may not hold for npm/pnpm consumers. |
| cli/src/cli.ts | New entry-point dispatcher for gitpulse analyze / gitpulse build commands; uses top-level await (valid with NodeNext ESM module). Clean and straightforward. |
| cli/src/config.ts | Default dataDir updated from site/public/data to .gitpulse/data, aligning with build.ts default so zero-config analyze → build works without GITPULSE_DATA_DIR. |
| .github/workflows/publish-pages.yaml | New reusable workflow: runs npx @gitpulse/cli@0 analyze + build then deploys to GitHub Pages. Required permissions are documented in comments. upload-pages-artifact and deploy-pages lack SHA pinning unlike other actions in the file. |
| .github/workflows/release-please.yml | Added publish-cli job using OIDC Trusted Publishing; correctly uses cli--release_created and cli--tag_name namespaced outputs. linked-versions plugin keeps root and cli versions in lockstep, ensuring siteRef = v${cliVersion} resolves to a real tag. |
| .github/workflows/self-deploy.yml | Rewritten to use local workspace CLI for analysis and direct site build. Correctly overrides GITPULSE_DATA_DIR to site/public/data for in-place builds. |
| site/next.config.js | Added GITPULSE_BASE_PATH override logic with three sentinels: auto/empty → /<repo>, none → empty string, literal otherwise. Also exposes NEXT_PUBLIC_BASE_PATH for client-side use. |
| site/src/lib/seo.ts | New file centralizing URL helpers and metadata builders. getBaseUrl() mirrors next.config.js base-path resolution and correctly warns when a non-auto base-path is used without an explicit GITPULSE_SITE_URL. |
| release-please-config.json | Added cli package; uses linked-versions plugin to keep root and cli at the same version, include-component-in-tag: false so tags stay as v0.1.0, matching build.ts's default siteRef. |
Sequence Diagram
sequenceDiagram
participant Consumer as Consumer Workflow
participant PY as publish-pages.yaml
participant CLI as @gitpulse/cli (npx)
participant GH as GitHub API
participant Site as znat/gitpulse (cloned)
participant Pages as GitHub Pages
Consumer->>PY: workflow_call (secrets: inherit)
PY->>CLI: npx @gitpulse/cli@0 analyze
CLI->>GH: fetch commits, PRs, releases
GH-->>CLI: data
CLI->>CLI: LLM summarization
CLI-->>PY: writes .gitpulse/data/
PY->>CLI: npx @gitpulse/cli@0 build
CLI->>Site: git clone v{cliVersion} (sanitized env)
CLI->>Site: cp .gitpulse/data to site/public/data
CLI->>Site: yarn install + next build (export)
Site-->>CLI: site/out/
CLI-->>PY: writes .gitpulse/out/
PY->>Pages: upload-pages-artifact + deploy-pages
Pages-->>Consumer: deployed URL
Reviews (8): Last reviewed commit: "fix: document required permissions on th..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/publish-pages.yaml:
- Around line 18-50: Add two new reusable workflow inputs named "base-path" and
"site-url" so callers can override GITPULSE_BASE_PATH and GITPULSE_SITE_URL;
update the inputs block (near existing ai-model, ai-protocol, ai-base-url, etc.)
to declare these as string inputs with empty defaults, and then ensure the
job/step that sets environment variables passes them through (use the input
identifiers base-path and site-url where env GITPULSE_BASE_PATH and
GITPULSE_SITE_URL are populated). This mirrors the existing pattern for
ai-base-url and keeps behavior consistent when callers supply custom values.
In @.github/workflows/release-please.yml:
- Line 92: Replace the non-deterministic "run: npm install -g npm@latest" step
with a pinned npm version to ensure reproducible releases (e.g., change to
"npm@11.9.0"); update the workflow step that runs the install command so it
references a specific version (or an env variable like NPM_VERSION set to a
known-good release) instead of "npm@latest" so CI always uses the pinned npm CLI
version.
- Around line 76-77: The publish-cli job is gated by
needs.release-please.outputs.release_created which is true for any release;
update the release-please job to expose the paths_released output (add
outputs.paths_released to the release-please job) and change the publish
condition to inspect needs.release-please.outputs.paths_released for the CLI
package path (use needs.release-please.outputs.paths_released and check it
contains the CLI release path/component, e.g., the CLI package directory or
identifier) so the job only runs when the CLI component was actually released.
In `@release-please-config.json`:
- Around line 13-15: The release tags are colliding because the package scope
isn't included in tag names; update the release-please configuration to enable
component-scoped tags by adding "include-component-in-tag": true to the package
config for "cli" (and any other package entries like the root component) so
release-please will produce component-specific tags instead of shared tags
(e.g., include "include-component-in-tag": true alongside the "package-name":
"@gitpulse/cli" entry).
In `@site/next.config.js`:
- Around line 3-6: The canonical URL builder in the SEO helper must honor the
same basePath override used in next.config.js; update the code that constructs
the canonical/site URL (e.g., the function that builds the canonical URL, such
as getCanonicalUrl or getSiteMeta) to compute basePath the same way: derive
fallbackBasePath from GITHUB_REPOSITORY (repo ? `/${repo}` : ''), then set
basePath = process.env.GITPULSE_BASE_PATH ?? fallbackBasePath and include
basePath when forming the canonical URL (or prepend basePath to the path and
ensure trailing slash rules match assetPrefix); alternatively, if you prefer to
prevent mismatches, require that GITPULSE_SITE_URL is set whenever
GITPULSE_BASE_PATH is explicitly provided and throw or log a clear error in that
helper when basePath is overridden without a site URL.
🪄 Autofix (Beta)
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 94531c9d-a6c9-4550-98cd-6a3969de13d6
📒 Files selected for processing (38)
.github/workflows/ci.yml.github/workflows/publish-pages.yaml.github/workflows/release-please.yml.github/workflows/self-deploy.yml.release-please-manifest.jsonaction/package.jsoncli/package.jsoncli/src/build.tscli/src/categories.tscli/src/category-helpers.tscli/src/cli.tscli/src/commit-context.tscli/src/config.tscli/src/git.tscli/src/github.tscli/src/index.tscli/src/llm.tscli/src/pmap.test.tscli/src/pmap.tscli/src/release-builder.test.tscli/src/release-builder.tscli/src/release-llm.tscli/src/release-render.tscli/src/render.tscli/src/schemas.test.tscli/src/schemas.tscli/src/site-fetcher.tscli/src/size.tscli/src/slugify.tscli/src/state.tscli/src/strip-schema.test.tscli/src/strip-schema.tscli/src/types.tscli/tsconfig.build.jsoncli/tsconfig.jsonpackage.jsonrelease-please-config.jsonsite/next.config.js
💤 Files with no reviewable changes (1)
- action/package.json
Contributor
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. ⛔ CodeRabbit does not have permission to push changes to this repository. Please ensure CodeRabbit has Contents: Read and write permission. |
… hygiene, basePath sentinel) Addresses review comments from greptile + coderabbitai on PR #26. P1 — Default dataDir mismatch broke zero-config consumer flow cli/src/config.ts default now matches build.ts (${repoDir}/.gitpulse/data). self-deploy.yml already overrides explicitly to site/public/data. P1 — release-please publish-cli used root-package outputs Switched publish-cli + move-major-tag to read cli-namespaced outputs (`cli--release_created`, `cli--tag_name`, `cli--major`) so CLI-only releases actually publish, and the v0/v1 floating tag tracks the cli. P2 — Caller env (incl. secrets) leaked into cloned-repo build cli/src/build.ts now sanitizes process.env before invoking yarn install + next build inside the temp clone. Strips OPENAI_API_KEY, GITHUB_TOKEN, AWS keys, NPM_TOKEN, plus a *_TOKEN/_SECRET/_PASSWORD/_API_KEY heuristic. publish-pages.yaml — added base-path + site-url inputs base-path defaults to "auto" (sentinel = derive /<repo> from GITHUB_REPOSITORY). Set "none" for root deployments (user/org Pages, custom domain) or a literal prefix like "/blog". Resolved consistently in next.config.js. site/src/lib/seo.ts — aligned canonical URL with basePath override When GITPULSE_BASE_PATH is overridden away from the GH-Pages-default, the auto-derived owner.github.io/repo URL is wrong. Suppresses the fallback in that case (returns empty so canonicals are path-only) and logs a warning, forcing the consumer to set GITPULSE_SITE_URL. cli/src/config.ts — siteUrl uses `||` instead of `??` Empty-string env (common when CI workflows always set the var) now falls back to autoSiteUrl rather than producing an empty siteUrl. release-please.yml — pinned npm to 11.9.0 Reproducibility — bump deliberately when adopting new features. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/release-please.yml (1)
64-64:⚠️ Potential issue | 🟠 Major | ⚡ Quick winPin
actions/checkoutandactions/setup-nodeto immutable SHAs in this release workflow.Lines 64, 93, and 96 use mutable
@v6tags in the publish path. For release security, pin these to full commit SHAs.Suggested hardening diff
- - uses: actions/checkout@v6 + - uses: actions/checkout@<full-commit-sha> # v6.x.y - - uses: actions/checkout@v6 + - uses: actions/checkout@<full-commit-sha> # v6.x.y - - uses: actions/setup-node@v6 + - uses: actions/setup-node@<full-commit-sha> # v6.x.y🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/release-please.yml at line 64, The workflow uses mutable tags for GitHub Actions (e.g., actions/checkout@v6 and actions/setup-node@v* in the release workflow) which should be pinned to immutable commit SHAs; find the usages of actions/checkout@v6 and actions/setup-node@... in the release-please workflow and replace each mutable tag with the corresponding full commit SHA from the action's repository (use the action repo’s tags page to copy the commit SHA), ensuring all occurrences in the publish/release steps are updated consistently.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/publish-pages.yaml:
- Around line 101-103: The build-step comment incorrectly states that an empty
string ("") maps to root deployments; update the comment near the
GITPULSE_BASE_PATH environment setting (GITPULSE_BASE_PATH: ${{ inputs.base-path
}}) to say that the resolver uses "none" to denote root deployments and that an
empty value means auto/fallback instead of root, so callers are not misled about
base-path semantics.
---
Outside diff comments:
In @.github/workflows/release-please.yml:
- Line 64: The workflow uses mutable tags for GitHub Actions (e.g.,
actions/checkout@v6 and actions/setup-node@v* in the release workflow) which
should be pinned to immutable commit SHAs; find the usages of
actions/checkout@v6 and actions/setup-node@... in the release-please workflow
and replace each mutable tag with the corresponding full commit SHA from the
action's repository (use the action repo’s tags page to copy the commit SHA),
ensuring all occurrences in the publish/release steps are updated consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 4795f515-0f9e-40b2-9503-a68a361bcdff
📒 Files selected for processing (6)
.github/workflows/publish-pages.yaml.github/workflows/release-please.ymlcli/src/build.tscli/src/config.tssite/next.config.jssite/src/lib/seo.ts
… fix stale comment Second round of PR #26 review fixes from coderabbitai. release-please.yml — pin actions/checkout + actions/setup-node to SHAs Release path was using mutable @v6 tags. Now pinned alongside the existing release-please-action SHA pin. Dependabot rotates these via .github/dependabot.yml. actions/checkout → de0fac2 # v6.0.2 actions/setup-node → 48b55a0 # v6.4.0 release-please-config.json — add linked-versions plugin With "include-component-in-tag": false and two packages (gitpulse + @gitpulse/cli), release-please could in principle desync versions and produce ambiguous tags. linked-versions forces both packages to bump together to the same version, eliminating the collision concern without uglifying tag names (which would break consumers who pin uses: znat/gitpulse/.github/workflows/publish-pages.yaml@v0). publish-pages.yaml — fix outdated base-path comment Comment still referenced "" for root deployments; the resolver now uses the "none" sentinel (empty falls back to auto/derive). Updated to document all three sentinels next to the env wiring. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/publish-pages.yaml:
- Around line 59-63: The reusable workflow currently declares the OPENAI_API_KEY
secret as optional (required: false) which allows callers to omit it and leads
to runtime failures when tools like gitpulse analyze expect it; update the
OPENAI_API_KEY secret definition in the workflow to be required (set required:
true) so the workflow contract enforces presence, and ensure any callers provide
that secret when invoking the reusable workflow (search for the OPENAI_API_KEY
secret block in the publish-pages.yaml workflow to make this change).
- Around line 55-58: Add a runtime validation step to fail fast when the
workflow input site-url is empty but base-path is not "auto"; specifically,
after inputs are read (referencing the workflow inputs "site-url" and
"base-path" in publish-pages.yaml) add a step that checks if base-path != "auto"
and site-url == "" and then exits non‑zero with a clear error message. This
ensures the action fails early instead of silently falling back to the Pages URL
and prevents incorrect canonical/restore links.
- Around line 75-82: Replace the mutable action tags in the reusable workflow
with SHA-pinned refs: update the uses entries that currently read
"actions/checkout@v6" and "actions/setup-node@v6" to the corresponding commit
SHAs (matching how release-please.yml pins these actions). Locate the uses lines
for actions/checkout and actions/setup-node in publish-pages.yaml and replace
the `@v6` tags with the exact commit SHAs for those actions, keeping the existing
with: blocks (fetch-depth and node-version) unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: bded6e6e-190c-48ef-8355-d60fbef4ee03
📒 Files selected for processing (3)
.github/workflows/publish-pages.yaml.github/workflows/release-please.ymlrelease-please-config.json
…ecture The previous README documented the old @gitpulse/action workspace pattern that only worked for self-deploy. Replaces it with concrete deploy recipes for the new distribution surfaces: - GitHub Pages — uses: znat/gitpulse/.github/workflows/publish-pages.yaml@v0 - Vercel — gitpulse analyze && gitpulse build && next build in package.json - Netlify — equivalent in netlify.toml - Cloudflare Pages — build command in dashboard - Generic (S3, GitLab CI, custom) — CLI invocation via npx Also documents: - Env-only configuration (no flags) with full var table - LLM provider examples (OpenAI / MiniMax / Groq / OpenRouter / Anthropic) - gitpulse build internals (clone matching tag, sanitize env, next export) - Local dev commands (yarn workspace @gitpulse/cli analyze) - Updated release flow: linked-versions, OIDC publish, Trusted Publishing setup Pre-1.0 versioning is called out at the top — consumers pin @0 / @v0 until the API stabilises. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@README.md`:
- Around line 164-205: The fenced code blocks under the provider examples
("OpenAI", "MiniMax", "Groq", "OpenRouter", "Anthropic Claude") lack surrounding
blank lines and trigger markdownlint MD031; fix by adding one empty line
immediately before and one empty line immediately after each triple-backtick
block so each provider header and the following paragraph are separated from the
```yaml``` block and the README passes CI.
- Around line 212-220: The fenced CLI help block containing "gitpulse <command>"
is missing a language tag; update the Markdown fence to specify a language such
as `text` or `bash` (e.g., change ``` to ```text) so the block renders
consistently and satisfies lint rule MD040; locate the fenced block that lists
the analyze/build/--version/--help commands in README.md and add the language
immediately after the opening triple backticks.
- Line 28: The README's major-tag guidance incorrectly suggests keeping the
reusable workflow pinned to `@v0` after graduating to a stable major; update the
sentence that currently reads the workflow as
`znat/gitpulse/.github/workflows/publish-pages.yaml@v0` and the trailing “When
the API stabilises, both move to `@1` / `@v0`” to instruct moving both to the
same stable major tags (e.g., `@1` for npm and `@v1` for the workflow) so the
sentence shows `@1 / `@v1`` instead of `@1 / `@v0``.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
Trimming README provider examples to the most representative set (OpenAI, MiniMax, OpenRouter, Anthropic). Groq still works via the generic OpenAI-compatible pattern — anyone wanting it can derive from OpenRouter or MiniMax examples. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@README.md`:
- Around line 70-78: The Vercel/Netlify/Cloudflare environment variable examples
are missing the required GITHUB_REPOSITORY var referenced elsewhere (e.g., where
GITHUB_REPOSITORY is declared required), causing non-GitHub Actions deploys to
fail; update the examples to include GITHUB_REPOSITORY with guidance on its
value (owner/repo) or document a fallback behavior and mark it optional where
applicable (references: the README env table entries and the GITHUB_REPOSITORY
requirement declaration).
- Line 213: Update the README command description so it matches the actual
implementation in cli/src/build.ts: change the reference from "yarn install /
next build" to the actual invoked command "yarn install / yarn run next export"
(or simply "yarn run next export"), and ensure the sentence still states that
secrets (OPENAI_API_KEY, GITHUB_TOKEN, etc.) are stripped from the env passed to
the cloned tree before running the export; reference the gitpulse build command
and build.ts to locate the logic to mirror.
- Around line 48-49: The README currently documents using "secrets: inherit"
alongside the reusable workflow reference "uses:
znat/gitpulse/.github/workflows/publish-pages.yaml@v0"; change the example to
remove "secrets: inherit" and instead show explicit secret mappings for only the
required secrets (e.g., map GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} or any
specific DEPLOY_KEY) so callers explicitly pass least-privilege secrets when
invoking the reusable workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| 3. **Summarize** each commit with one LLM call: headline, standfirst, category, size assessment. | ||
| 4. **Restore** prior content by fetching `data/state.json`, `data/manifest.json`, and `data/stories/<id>.json` from the live deployed site — no database, no separate branch, no artifact chain. | ||
| 5. **Build** the Next.js site (`output: 'export'`) and **deploy** to GitHub Pages. | ||
| `gitpulse build` clones `znat/gitpulse@v<cli-version>` to a temp dir, copies your `GITPULSE_DATA_DIR` into the site's `public/data/`, runs the Next.js export, and copies the result to `GITPULSE_OUT_DIR`. It strips secrets (`OPENAI_API_KEY`, `GITHUB_TOKEN`, etc.) from the env it passes to the cloned tree's `yarn install` / `next build`. |
Contributor
There was a problem hiding this comment.
Command description drifts from implementation (next build vs next export).
Line 213 says env is passed to yarn install / next build, but the build flow shown in cli/src/build.ts invokes yarn run next export. Update wording so docs match behavior.
Suggested doc change
-It strips secrets (`OPENAI_API_KEY`, `GITHUB_TOKEN`, etc.) from the env it passes to the cloned tree's `yarn install` / `next build`.
+It strips secrets (`OPENAI_API_KEY`, `GITHUB_TOKEN`, etc.) from the env it passes to the cloned tree's `yarn install` / `next export`.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| `gitpulse build` clones `znat/gitpulse@v<cli-version>` to a temp dir, copies your `GITPULSE_DATA_DIR` into the site's `public/data/`, runs the Next.js export, and copies the result to `GITPULSE_OUT_DIR`. It strips secrets (`OPENAI_API_KEY`, `GITHUB_TOKEN`, etc.) from the env it passes to the cloned tree's `yarn install` / `next build`. | |
| `gitpulse build` clones `znat/gitpulse@v<cli-version>` to a temp dir, copies your `GITPULSE_DATA_DIR` into the site's `public/data/`, runs the Next.js export, and copies the result to `GITPULSE_OUT_DIR`. It strips secrets (`OPENAI_API_KEY`, `GITHUB_TOKEN`, etc.) from the env it passes to the cloned tree's `yarn install` / `next export`. |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@README.md` at line 213, Update the README command description so it matches
the actual implementation in cli/src/build.ts: change the reference from "yarn
install / next build" to the actual invoked command "yarn install / yarn run
next export" (or simply "yarn run next export"), and ensure the sentence still
states that secrets (OPENAI_API_KEY, GITHUB_TOKEN, etc.) are stripped from the
env passed to the cloned tree before running the export; reference the gitpulse
build command and build.ts to locate the logic to mirror.
Owner
Author
There was a problem hiding this comment.
Reviewer claim is incorrect. The site is on Next.js 16.1.6 with output: 'export' in next.config.js — the standalone next export subcommand was removed in Next 14 (the export pathway has been driven by config + next build for several majors now). Site package.json literally has "build": "next build --webpack", and build.ts invokes that via yarn workspace @gitpulse/site build. next build in the README is correct as written.
Contributor
There was a problem hiding this comment.
@znat, you're absolutely right — I apologize for the incorrect suggestion. The official Next.js documentation confirms this: "The next export command has been removed in favor of output: 'export' config." This removal happened in Next.js 14, with next export softly deprecated in Next.js 13.3 and removed entirely in Next.js 14. Since the site uses output: 'export' in next.config.js and the build script invokes next build, the README wording is correct as-is. My suggestion to change it to next export would have documented a command that no longer exists.
✏️ Learnings added
Learnt from: znat
Repo: znat/gitpulse PR: 26
File: README.md:282-282
Timestamp: 2026-05-04T07:29:09.491Z
Learning: In the gitpulse repository (`znat/gitpulse`), the site workspace (`site/`) uses modern Next.js (14+) with `output: 'export'` in `next.config.js`. The `next export` standalone subcommand was removed in Next.js 14; static exports are now produced by running `next build` (which respects the `output: 'export'` config). The site's build script is `"build": "next build --webpack"`, and `cli/src/build.ts` invokes it via `yarn workspace gitpulse/site build`. Do not suggest replacing `next build` with `next export` in this codebase.
Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.
…; drop releasing Three README adjustments based on review feedback: - Wrapped each Quickstart deploy option in <details> (Pages open by default, others collapsed) so the page scans cleanly. - Restructured LLM providers section: header now shows env-var wiring for each deploy target (Pages workflow `with:`, Vercel/Netlify dashboard, generic GH Actions `env:`, local `.env`), and each provider just lists the values to fill in. No more ambiguity about "which job do these go in". - Dropped the Releasing section — that's maintainer-only material; lives in CONTRIBUTING/internal docs rather than user-facing README. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- publish-pages.yaml: mark OPENAI_API_KEY required: true (was false; the analyzer can't run without it, so workflow-contract failure beats runtime). - publish-pages.yaml: add fail-fast validation step that errors when base-path is overridden away from 'auto' but site-url is empty — otherwise canonical URLs silently fall back to the wrong host. - publish-pages.yaml: pin actions/checkout + actions/setup-node to SHAs (matches release-please.yml; reusable workflow runs in caller's context so SHA pinning matters even more here). - README: add `text` language to the gitpulse --help fenced block (MD040). Linked-versions plugin choice over `include-component-in-tag: true` is intentional and stands; will note on the thread. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…ges.yaml Reusable workflows can't elevate beyond the caller's GITHUB_TOKEN scope. Without explicit pages:write + id-token:write on the calling workflow, the inner deploy job (actions/deploy-pages@v5) fails with permission-denied. Updates the consumer-usage example in both: - README.md (GitHub Pages Quickstart) - publish-pages.yaml header comment The next-export README comment from coderabbitai was incorrect (the site uses modern Next.js with output: 'export' in config; the standalone next export subcommand was removed in 13.5+). Replied on-thread; no README change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Why
The earlier plan (a JS GitHub Action with ncc-bundled `dist/`) hit ncc/tsconfig friction (`allowImportingTsExtensions` + emit incompatibility). A CLI on npm:
Distribution surface (final)
Key changes
Pre-1.0 versioning note
Currently `0.1.0`. Bootstrap publish landed `@gitpulse/cli@0.0.1` to seed the package on npm and configure Trusted Publishing; first release-please-driven publish will ship `0.1.0` via OIDC. Consumers pin `@v0` / `@gitpulse/cli@0` until `1.0.0` cuts.
Test plan
```yaml
jobs:
publish:
uses: znat/gitpulse/.github/workflows/publish-pages.yaml@v0
secrets: inherit
```
Manual setup steps (one-time, post-merge)
Out of scope (separate PRs)
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Chores
Documentation