Use marketplace qtmesh action in CI - #278
Conversation
- Replace local .github/actions/qtmesh reference with fernandotonon/qtmesh@v1 (marketplace action) in the scan-assets-docker CI job - Add "GitHub Action (Marketplace)" section to CLAUDE.md with usage examples and guidelines for when to update the action repo Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 13 minutes and 26 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughReplaced a repo-local GitHub Action with the published marketplace action Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: abe3b84722
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Scan media/ via GitHub Action | ||
| uses: ./.github/actions/qtmesh | ||
| - name: Scan media/ via GitHub Action (marketplace) | ||
| uses: fernandotonon/qtmesh@v1 |
There was a problem hiding this comment.
Switching from the local action to fernandotonon/qtmesh@v1 makes this workflow depend on a mutable external tag, so CI behavior can change (or regress) without any change in this repository. Because scan-assets-docker runs on every push/PR, this introduces avoidable supply-chain and reproducibility risk compared to the previous in-repo action. Pinning to a full commit SHA (and updating intentionally) keeps runs deterministic.
Useful? React with 👍 / 👎.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
.github/workflows/deploy.yml (1)
1225-1225: Align step title with the actual scan target.Line 1225 says
Scan media/, but this step scans the repo root (input-file: .on Line 1229). Renaming avoids confusion in CI logs.Suggested patch
- - name: Scan media/ via GitHub Action (marketplace) + - name: Scan repository via GitHub Action (marketplace)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/deploy.yml at line 1225, The step title "Scan media/ via GitHub Action (marketplace)" is misleading because the action is configured with input-file: . (scanning repo root); update the step name to reflect the actual target (e.g., "Scan repository root via GitHub Action (marketplace)") or change the action's input-file to media/ if you intended to scan media/; edit the workflow step that contains the name string and the input-file key to keep them consistent.CLAUDE.md (2)
282-282: Tighten redundant wording in the maintenance note.Line 282 can be simplified from “CLI interface” to “CLI”.
Suggested patch
-- **No update needed** for: bug fixes, GUI changes, MCP tools, or new features that don't change the CLI interface +- **No update needed** for: bug fixes, GUI changes, MCP tools, or new features that don't change the CLI🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@CLAUDE.md` at line 282, Update the redundant phrase in the maintenance note: replace the string "CLI interface" with "CLI" in the sentence "**No update needed** for: bug fixes, GUI changes, MCP tools, or new features that don't change the CLI interface" so it reads "...don't change the CLI".
288-288: Clarify thatscan-assets-dockervalidates both Docker and Marketplace paths.Line 288 currently mentions only the action path; the workflow also runs a direct Docker scan in the same job (
.github/workflows/deploy.ymlLine 1213-Line 1223).Suggested patch
-GitHub Actions workflow in `.github/workflows/deploy.yml` builds for Windows (MinGW), macOS, and Linux. Tests run on Linux with SonarCloud coverage. Releases auto-update the Homebrew cask, WinGet package, Snap Store, and Docker image. A `scan-assets-docker` job runs the `fernandotonon/qtmesh` action on the repo's own test assets to validate the Docker image and scan pipeline on every push/PR. +GitHub Actions workflow in `.github/workflows/deploy.yml` builds for Windows (MinGW), macOS, and Linux. Tests run on Linux with SonarCloud coverage. Releases auto-update the Homebrew cask, WinGet package, Snap Store, and Docker image. A `scan-assets-docker` job validates the scan pipeline in two ways on every push/PR: direct Docker (`ghcr.io/fernandotonon/qtmesh:latest`) and the Marketplace action (`fernandotonon/qtmesh@v1`).🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@CLAUDE.md` at line 288, Update the CLAUDE.md description for the scan-assets-docker job (job name: scan-assets-docker) to clarify it validates both the Docker image scan (the direct Docker scan step) and the Marketplace/action path (the fernandotonon/qtmesh action run), so the documentation reflects that the job performs both Docker scanning and Marketplace validation rather than only running the action.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/deploy.yml:
- Line 1226: Replace the mutable marketplace action tag
"fernandotonon/qtmesh@v1" with an immutable commit SHA: locate the usage of
fernandotonon/qtmesh@v1 in the workflow and change it to
fernandotonon/qtmesh@<commit-sha> where <commit-sha> is the full 40-character
commit hash from the action repository (obtainable from the action's GitHub
commits page), and ensure any other occurrences are updated to use the same
pinned SHA for reproducibility.
---
Nitpick comments:
In @.github/workflows/deploy.yml:
- Line 1225: The step title "Scan media/ via GitHub Action (marketplace)" is
misleading because the action is configured with input-file: . (scanning repo
root); update the step name to reflect the actual target (e.g., "Scan repository
root via GitHub Action (marketplace)") or change the action's input-file to
media/ if you intended to scan media/; edit the workflow step that contains the
name string and the input-file key to keep them consistent.
In `@CLAUDE.md`:
- Line 282: Update the redundant phrase in the maintenance note: replace the
string "CLI interface" with "CLI" in the sentence "**No update needed** for: bug
fixes, GUI changes, MCP tools, or new features that don't change the CLI
interface" so it reads "...don't change the CLI".
- Line 288: Update the CLAUDE.md description for the scan-assets-docker job (job
name: scan-assets-docker) to clarify it validates both the Docker image scan
(the direct Docker scan step) and the Marketplace/action path (the
fernandotonon/qtmesh action run), so the documentation reflects that the job
performs both Docker scanning and Marketplace validation rather than only
running the action.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8f4bbdc2-bc38-42d9-b3f8-9ddd9b8448ae
📒 Files selected for processing (2)
.github/workflows/deploy.ymlCLAUDE.md
Website (content.js): - Update actions link to fernandotonon/qtmesh marketplace - GitHub Action example uses fernandotonon/qtmesh@v1 (not old hash ref) - Scan example uses --json instead of --sarif - "Run in CI/CD" use case renamed to "GitHub Actions (Marketplace)" Docs (DocsApp.jsx): - GitHub Actions section rewritten with marketplace action examples: scan on PR, convert/validate, get info as JSON, direct Docker - Removed SARIF-centric examples (SARIF still documented as an option but not the primary example workflow) - Scan command description links to marketplace action Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- action.yml at repo root (marketplace requirement) with branding, exit-code output, and stderr capture - CI uses ./ (self-test) instead of external action reference - Website and docs updated: fernandotonon/QtMeshEditor@v1 - CLAUDE.md: marketplace publishing instructions - fernandotonon/qtmesh repo redirects here Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
1 participant
Summary
.github/actions/qtmeshreference withfernandotonon/qtmesh@v1(marketplace action) in thescan-assets-dockerCI jobTest plan
scan-assets-dockerjob runs successfully using the marketplace action🤖 Generated with Claude Code
Summary by CodeRabbit