Fix CodeQL workflow secrets, permissions, and i18n interpolation#1612
Conversation
|
Warning Rate limit exceeded
⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📝 WalkthroughWalkthroughThis PR modernizes i18n message formatting across 13 language files by replacing generic positional placeholders (%) with named placeholders ({channel}, {channels}, {cmd}), adds permissions blocks to 7 GitHub Actions workflows, refactors TOML string escaping in backend configuration, and updates Vue components to use parameterized translation function calls. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/pages/app/[app].bundle.[bundle].vue (1)
614-617:⚠️ Potential issue | 🟡 MinorFix channel unlink dialog to pass i18n params.
channel-bundle-linkednow uses{channels};.replace('%s', ...)won’t substitute and will show the placeholder.🔧 Suggested fix
- description: t('channel-bundle-linked').replace('%s', channelFound.map((ch: any) => `${ch.name} (${ch.version.name})`).join(', ')), + description: t('channel-bundle-linked', { + channels: channelFound.map((ch: any) => `${ch.name} (${ch.version.name})`).join(', '), + }),
There was a problem hiding this comment.
Pull request overview
This PR hardens GitHub Actions workflow security, improves i18n message interpolation consistency in the Vue UI, and ensures TOML output is correctly escaped when generating local Cloudflare Wrangler config.
Changes:
- Replace ad-hoc
%/%sstring replacement with vue-i18n named interpolation for bundle/channel compatibility and linking messages. - Escape TOML keys/values when writing
[vars]intowrangler.tomlfrom.envinputs. - Add explicit
permissions:blocks to multiple GitHub Actions workflows and remove dynamic secret indexing in deploy.
Reviewed changes
Copilot reviewed 26 out of 26 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
src/pages/app/[app].channel.[channel].vue |
Switch compatibility toasts/dialog text to named i18n interpolation ({cmd}, {channel}). |
src/pages/app/[app].bundle.[bundle].vue |
Switch compatibility toasts/dialog text to named i18n interpolation ({cmd}, {channel}). |
src/components/tables/BundleTable.vue |
Switch bundle unlink prompt to named i18n interpolation ({channels}). |
scripts/local_cf_backend_env.mjs |
Escape TOML basic strings and quote unsafe TOML keys when writing [vars]. |
messages/en.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/de.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/es.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/fr.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/hi.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/id.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/it.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/ja.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/ko.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/pl.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/pt-br.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/ru.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/tr.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/vi.json |
Update placeholders to {channel}, {channels}, {cmd}. |
messages/zh-cn.json |
Update placeholders to {channel}, {channels}, {cmd}. |
.github/workflows/tests.yml |
Add explicit workflow permissions. |
.github/workflows/store_review.yml |
Add explicit workflow permissions. |
.github/workflows/github-releases-to-discord.yml |
Add explicit workflow permissions. |
.github/workflows/bump_version.yml |
Add explicit workflow permissions. |
.github/workflows/build_mobile_ios.yml |
Add explicit workflow permissions. |
.github/workflows/build_mobile_android.yml |
Add explicit workflow permissions. |
.github/workflows/build_and_deploy.yml |
Add explicit permissions and replace dynamic secret indexing with explicit secret usage. |
| toast.error(t('bundle-not-compatible-with-channel', { channel: chan.name })) | ||
| toast.info(t('channel-not-compatible-with-channel-description').replace('%', 'npx @capgo/cli@latest bundle compatibility')) | ||
| toast.info(t('channel-not-compatible-with-channel-description', { cmd: 'bunx @capgo/cli@latest bundle compatibility' })) | ||
|
|
||
| dialogStore.openDialog({ | ||
| title: t('confirm-action'), | ||
| description: t('set-even-not-compatible').replace('%', 'npx @capgo/cli@latest bundle compatibility'), | ||
| description: t('set-even-not-compatible', { cmd: 'bunx @capgo/cli@latest bundle compatibility' }), |
There was a problem hiding this comment.
In this file you switched to vue-i18n named interpolation for the compatibility messages, but there is still a t('channel-bundle-linked').replace('%s', ...) usage later in deleteBundle(). Since messages/* now use {channels} for channel-bundle-linked, that .replace('%s', ...) will no longer interpolate and users will see the raw {channels} placeholder. Update that call site to t('channel-bundle-linked', { channels: ... }) to match the new message format.
| const message = t('channel-bundle-linked').replace('%', linkedChannelsList.map(val => val.rawChannel?.map((ch: any) => `${ch.name} (${ch.version.name})`).join(', ')).join(', ') ?? '') | ||
| const channelsList = linkedChannelsList | ||
| .map(val => val.rawChannel?.map((ch: any) => `${ch.name} (${ch.version.name})`).join(', ')) | ||
| .join(', ') ?? '' |
There was a problem hiding this comment.
linkedChannelsList.map(...).join(', ') ?? '' is redundant because .join() always returns a string (never null/undefined). Dropping the ?? '' would simplify the logic and avoids implying a nullish case that can't happen.
| .join(', ') ?? '' | |
| .join(', ') |
|
No dependency changes detected. Learn more about Socket for GitHub. 👍 No dependency changes detected in pull request |
|
Summary (AI generated)
permissions:to workflows and remove dynamic secret indexing flagged by CodeQL.%string replacement with named vue-i18n interpolation for bundle/channel messages.wrangler.tomlvars.Test plan (AI generated)
bun lintnode -c scripts/local_cf_backend_env.mjsScreenshots (AI generated)
Checklist (AI generated)
bun run lint:backend && bun run lint.accordingly.
my tests
Generated with AI
Summary by CodeRabbit