feat: GitHub Actions auto-commit #1062
Conversation
- Update configuration documentation to reference v1.8.15 - Update resolveNodeBreadthLimit default value from 100 to 10 - Update dependencies to latest versions
- Add permissions for GitHub Actions to commit documentation changes - Add auto-commit step to update OpenFGA configuration docs - Update pr-preview-action to latest version This needs further review as requested by maintainers.
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughThe updates include enhancements to GitHub Actions workflows for deployment and preview, documentation changes for OpenFGA configuration, and dependency upgrades in Changes
Sequence Diagram(s)sequenceDiagram
participant GitHub Actions
participant Build System
participant Docs Repo
GitHub Actions->>Build System: Build website
Build System-->>GitHub Actions: Build artifacts
GitHub Actions->>Docs Repo: Auto-commit updated *.mdx docs
GitHub Actions->>GitHub Pages: Deploy site
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (4)
.github/workflows/deploy.yml(2 hunks).github/workflows/preview.yml(1 hunks)docs/content/getting-started/setup-openfga/configuration.mdx(4 hunks)package.json(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Socket Security: Pull Request Alerts
- GitHub Check: deploy-preview
- GitHub Check: Test deployment
🔇 Additional comments (4)
.github/workflows/preview.yml (1)
37-40: Action remains pinned – 👍 but consider aliasing for easier upgradesThe workflow keeps the
rossjrw/pr-preview-actionpinned to a full-length SHA (good for supply-chain security).
If you want quicker upgrades without editing every commit hash, you can pin to a semver tag (e.g.v1) and combine it with@refverification (actions/verify-hash) so you still get tamper-proofing while lowering maintenance overhead.
No blocking issues here..github/workflows/deploy.yml (1)
18-22: Explicitpermissionsblock improves least-privilege complianceGranting only
contents,pagesandid-tokenis exactly what this job needs and nothing more. Nice hardening.package.json (2)
28-45: Large dependency bump – verify Node/React/Docusaurus compatibilityUpgrading Docusaurus to
3.8.1, React 18.3 and moving the CI runner to Node 22 is a triple-jump. Node 22 is not an LTS release yet and Docusaurus’ latest docs still recommend Node 18/20.Please double-check:
- Local dev machines on older LTS versions won’t break.
- The generated static site still works in PROD (no React 18.3 breaking changes).
engines.nodeinpackage.json(if present) is updated accordingly.If everything passes locally & in preview, all good ‑ just worth an explicit verification.
56-58: ESLint major upgrade to v9 may require config tweaks
eslint9.x is eslint-config-breaking (theflatconfig becomes default).
Make sure.eslintrc.*has been migrated or the lint job will error out.If you need a minimal patch:
{ - "root": true, - "extends": ["eslint:recommended", "plugin:react/recommended"], + "eslintConfig": { + "root": true, + "extends": ["eslint:recommended", "plugin:react/recommended"] + } }(or switch to the new
eslint.config.jsflat format).
.github/workflows/deploy.yml
Outdated
| - name: Commit updated config documentation | ||
| uses: stefanzweifel/git-auto-commit-action@778341af668090896ca464160c2def5d1d1a3eb0 #v6.0.1 | ||
| with: | ||
| commit_message: 'docs: auto-update OpenFGA configuration documentation' | ||
| file_pattern: '*.mdx' | ||
| commit_user_name: 'github-actions[bot]' | ||
| commit_user_email: '41898282+github-actions[bot]@users.noreply.github.com' | ||
| commit_author: 'github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>' | ||
|
|
There was a problem hiding this comment.
Auto-commit step can retrigger this workflow in a loop – add a CI-skip guard
git-auto-commit-action pushes back to main, which re-fires the same push trigger and causes an endless redeploy loop (even if the commit is empty, you still get a second run).
Add a safeguard such as:
- commit_message: 'docs: auto-update OpenFGA configuration documentation'
+ commit_message: 'docs: auto-update OpenFGA configuration documentation [skip ci]'or filter the trigger:
push:
branches: [ main ]
paths-ignore:
- 'docs/**' # commits produced by this stepEither approach prevents redundant runs and saves CI minutes.
🤖 Prompt for AI Agents
In .github/workflows/deploy.yml around lines 41 to 49, the auto-commit step
pushes changes back to the main branch, which retriggers the workflow and causes
an infinite loop. To fix this, add a CI-skip guard by including a commit message
tag like [skip ci] or [ci skip] in the commit_message field, or modify the
workflow trigger to ignore changes in the documentation files (e.g., add
paths-ignore for docs/** under the push trigger) to prevent the workflow from
running on commits made by this step.
| | `resolveNodeLimit` | <div id="OPENFGA_RESOLVE_NODE_LIMIT"><code>OPENFGA_RESOLVE_NODE_LIMIT</code></div> | `resolve-node-limit` | integer | Maximum resolution depth to attempt before throwing an error (defines how deeply nested an authorization model can be before a query errors out). | `25` | | ||
| | `resolveNodeBreadthLimit` | <div id="OPENFGA_RESOLVE_NODE_BREADTH_LIMIT"><code>OPENFGA_RESOLVE_NODE_BREADTH_LIMIT</code></div> | `resolve-node-breadth-limit` | integer | Defines how many nodes on a given level can be evaluated concurrently in a Check resolution tree. | `100` | | ||
| | `resolveNodeBreadthLimit` | <div id="OPENFGA_RESOLVE_NODE_BREADTH_LIMIT"><code>OPENFGA_RESOLVE_NODE_BREADTH_LIMIT</code></div> | `resolve-node-breadth-limit` | integer | Defines how many nodes on a given level can be evaluated concurrently in a Check resolution tree. | `10` | | ||
| | `listObjectsDeadline` | <div id="OPENFGA_LIST_OBJECTS_DEADLINE"><code>OPENFGA_LIST_OBJECTS_DEADLINE</code></div> | `list-objects-deadline` | string (duration) | The timeout deadline for serving ListObjects requests | `3s` | |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Default for resolveNodeBreadthLimit changed – highlight backwards-compat risk
Dropping the default from 100 → 10 is a behaviour change that may throttle existing workloads.
Consider adding a call-out note in the doc (or release notes) so users aren’t surprised by slower or error-prone deep graph traversals.
🤖 Prompt for AI Agents
In docs/content/getting-started/setup-openfga/configuration.mdx around lines 118
to 120, the default value for resolveNodeBreadthLimit has been changed from 100
to 10, which can cause backward compatibility issues by throttling existing
workloads. Add a clear call-out note or warning near this configuration entry to
inform users about this behavior change and its potential impact on performance
and error rates during deep graph traversals.
| | `listUsersDispatchThrottling.frequency` | <div id="OPENFGA_LIST_USERS_DISPATCH_THROTTLING_FREQUENCY"><code>OPENFGA_LIST_USERS_DISPATCH_THROTTLING_FREQUENCY</code></div> | `list-users-dispatch-throttling-frequency` | string (duration) | the frequency period that the deprioritized throttling queue is evaluated for a list users request. A higher value will result in more aggressive throttling | `10µs` | | ||
| | `listUsersDispatchThrottling.threshold` | <div id="OPENFGA_LIST_USERS_DISPATCH_THROTTLING_THRESHOLD"><code>OPENFGA_LIST_USERS_DISPATCH_THROTTLING_THRESHOLD</code></div> | `list-users-dispatch-throttling-threshold` | integer | define the number of recursive operations to occur before getting throttled for a list users request | `100` | | ||
| | `listUsersDispatchThrottling.maxThreshold` | <div id="OPENFGA_LIST_USERS_DISPATCH_THROTTLING_MAX_THRESHOLD"><code>OPENFGA_LIST_USERS_DISPATCH_THROTTLING_MAX_THRESHOLD</code></div> | `list-users-dispatch-throttling-max-threshold` | integer | define the maximum dispatch threshold beyond above which requests will be throttled for a list users request. 0 will use the 'dispatchThrottling.threshold' value as maximum | `0` | | ||
| | `sharedIterator` | | `` | | | | |
There was a problem hiding this comment.
sharedIterator table row is incomplete
Type, flag name, description and default value are empty, which renders an empty row and breaks copy-paste workflows.
Quick fix:
-| `sharedIterator` | | `` | | | |
+| `sharedIterator.enabled` | <div id="OPENFGA_SHARED_ITERATOR_ENABLED"><code>OPENFGA_SHARED_ITERATOR_ENABLED</code></div> | `shared-iterator-enabled` | boolean | Enable reuse of iterator state across requests (experimental). | `false` |If the option is intentionally undocumented, drop the row entirely to avoid confusion.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| | `sharedIterator` | | `` | | | | | |
| | `sharedIterator.enabled` | <div id="OPENFGA_SHARED_ITERATOR_ENABLED"><code>OPENFGA_SHARED_ITERATOR_ENABLED</code></div> | `shared-iterator-enabled` | boolean | Enable reuse of iterator state across requests (experimental). | `false` | |
🤖 Prompt for AI Agents
In docs/content/getting-started/setup-openfga/configuration.mdx at line 202, the
table row for `sharedIterator` is incomplete with missing type, flag name,
description, and default value, causing an empty row and copy-paste issues.
Either fill in all the missing details for this option if it should be
documented, or remove the entire row if it is not meant to be documented to
prevent confusion.
There was a problem hiding this comment.
Instead of having the deploy workflow commit directly to the repo, let's add a separate nightly job that checks for changes and commit only if any are made.
Let's keep the deploy as is.
Can you remove the parts that are unrelated from this (dep updates + eslint)?
|
No dependency changes detected. Learn more about Socket for GitHub. 👍 No dependency changes detected in pull request |
Related #1054
Summary by CodeRabbit
Documentation
Chores