chore: attempt to fix fern docs comment failures - #977
Conversation
Signed-off-by: Matt Kornfield <mkornfield@nvidia.com>
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe workflow supports manual Fern previews, validates trusted metadata, computes deterministic preview identifiers, and handles generation failures and URL extraction explicitly. Release entries now omit ChangesFern documentation updates
Sequence Diagram(s)sequenceDiagram
participant Workflow as GitHub Actions workflow
participant Artifact as Preview metadata artifact
participant Fern as fern-api generate
Workflow->>Artifact: Read preview-metadata/pr_number
Workflow->>Workflow: Validate metadata and compute preview_id
Workflow->>Fern: Generate preview with preview_id
Fern-->>Workflow: Return status and published docs URL
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/fern-docs-preview-comment.yaml:
- Line 95: Update the fern-api invocation in the workflow’s preview generation
command to use an approved exact package version instead of the floating latest
tag. Preserve the existing generate arguments, preview ID, output capture, and
token handling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 7871d73c-e766-47f0-a9b5-18a8c44caa08
📒 Files selected for processing (1)
.github/workflows/fern-docs-preview-comment.yaml
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/fern-docs-preview-comment.yaml:
- Around line 20-38: Update the metadata resolution step to branch on the event
type: for workflow_dispatch runs, use the pr_number and head_ref inputs, while
retaining the existing github.event.workflow_run metadata and trusted-run
validation for workflow_run executions. Ensure manual runs no longer pass empty
PR metadata to validation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: d5a1d248-0baa-4e71-95df-8ac40530c964
📒 Files selected for processing (2)
.github/workflows/fern-docs-preview-comment.yamldocs/fern/scripts/materialize-release-versions.mjs
💤 Files with no reviewable changes (1)
- docs/fern/scripts/materialize-release-versions.mjs
6bcca1a to
a985420
Compare
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/fern-docs-preview-comment.yaml (1)
100-109: 🔒 Security & Privacy | 🔴 Critical | 🏗️ Heavy liftDo not execute PR-controlled artifact code with
FERN_TOKEN.
docs/ferncomes from the untrusted PR artifact, butnode scripts/filter-public-openapi.mjsruns withFERN_TOKENin its environment. A malicious PR can replace this script and exfiltrate the token. Run this filtering in the unprivileged build job or execute only code from a trusted checkout, with secrets withheld from artifact-executing steps.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/fern-docs-preview-comment.yaml around lines 100 - 109, Update the “Generate preview URL” step so the PR-controlled `node scripts/filter-public-openapi.mjs` never runs with `FERN_TOKEN` available. Move filtering to the unprivileged build job or run it from a trusted checkout, and keep `FERN_TOKEN` restricted to the trusted Fern generation command.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In @.github/workflows/fern-docs-preview-comment.yaml:
- Around line 100-109: Update the “Generate preview URL” step so the
PR-controlled `node scripts/filter-public-openapi.mjs` never runs with
`FERN_TOKEN` available. Move filtering to the unprivileged build job or run it
from a trusted checkout, and keep `FERN_TOKEN` restricted to the trusted Fern
generation command.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: a0ffcbda-cbd7-43c7-b6b5-3c7ac7dbfe91
📒 Files selected for processing (2)
.github/workflows/fern-docs-preview-comment.yamldocs/fern/scripts/materialize-release-versions.mjs
💤 Files with no reviewable changes (1)
- docs/fern/scripts/materialize-release-versions.mjs
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/fern-docs-preview-comment.yaml:
- Around line 20-25: Harden the workflow around source_run_id and the
artifact-processing step: validate that the referenced run is the successful
Preview Fern Docs build for the expected PR, head branch, and commit SHA, and
require matching artifact metadata rather than treating it as optional. Ensure
downloaded docs/ content cannot execute with FERN_TOKEN by moving processing to
an unprivileged job or running only scripts checked out from a trusted revision,
including the commands around lines 107-109.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 86180b9e-ce28-4c7c-bfb8-dfb63790e638
📒 Files selected for processing (2)
.github/workflows/fern-docs-preview-comment.yamldocs/fern/scripts/materialize-release-versions.mjs
💤 Files with no reviewable changes (1)
- docs/fern/scripts/materialize-release-versions.mjs
Signed-off-by: Matt Kornfield <mkornfield@nvidia.com>
a985420 to
c91c2dd
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/fern-docs-preview-comment.yaml (1)
22-33: 🔒 Security & Privacy | 🔴 CriticalRequire provenance before downloading and executing the artifact.
The manual inputs feed directly into the artifact
run-id; only PR-number syntax is checked, and artifact metadata remains optional. Line 107 then runs an npm package script from that downloaded tree whileFERN_TOKENis available. A caller-selected malicious run can therefore exfiltrate the token. (docs.github.com)Validate the source run’s workflow, success state, PR/head/SHA, and require matching metadata. Process downloaded content without secrets or use scripts from a trusted checkout.
Also applies to: 48-48, 55-56, 65-75, 107-107
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/fern-docs-preview-comment.yaml around lines 22 - 33, Harden the fern-docs preview workflow before using the artifact and running its npm script: validate that the supplied source_run_id belongs to the expected workflow, completed successfully, and matches the PR number, head_ref, and commit SHA, while requiring and verifying matching artifact metadata. Ensure downloaded artifact content is processed without FERN_TOKEN, or execute scripts only from a trusted checkout rather than the downloaded tree.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/fern-docs-preview-comment.yaml:
- Line 107: Update the prepare step in the workflow to run npm from its existing
./docs/fern working directory without the redundant --prefix argument. Replace
the prefixed command with the local npm run prepare invocation.
---
Duplicate comments:
In @.github/workflows/fern-docs-preview-comment.yaml:
- Around line 22-33: Harden the fern-docs preview workflow before using the
artifact and running its npm script: validate that the supplied source_run_id
belongs to the expected workflow, completed successfully, and matches the PR
number, head_ref, and commit SHA, while requiring and verifying matching
artifact metadata. Ensure downloaded artifact content is processed without
FERN_TOKEN, or execute scripts only from a trusted checkout rather than the
downloaded tree.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: eda6d50d-443e-42cb-94d3-10dde80fa752
📒 Files selected for processing (2)
.github/workflows/fern-docs-preview-comment.yamldocs/fern/scripts/materialize-release-versions.mjs
💤 Files with no reviewable changes (1)
- docs/fern/scripts/materialize-release-versions.mjs
Signed-off-by: Matt Kornfield <mkornfield@nvidia.com>
2 participants
Summary by CodeRabbit
docs.ymlrelease entries to omit theavailability: "stable"field, keeping onlydisplay-name,path, andslug.