fix: verify committed lib/ matches source in CI by EndBug · Pull Request #756 · EndBug/add-and-commit

EndBug · 2026-08-08T20:16:04Z

Summary

Add a CI step that rebuilds the action and fails if committed lib/ differs from the fresh build (closes the build-integrity gap where only a bypassable Husky hook kept the bundle in sync).
Pin Node 24 in the Test workflow and upload the expected lib/ as an artifact when the check fails.
Document the rebuild + CI expectation in CONTRIBUTING.md (Husky unchanged as local DX).

Test plan

Confirm the Build job passes on this PR with current lib/.
Optionally verify failure mode: temporarily edit lib/index.js only and confirm Build fails and uploads the lib artifact.
Confirm Test and Lint jobs still pass with Node 24.

Made with Cursor

Summary by CodeRabbit

Chores
- Updated automated build, test, and lint checks to use Node.js 24.
- Added verification that generated build files remain synchronized, with diagnostic artifacts provided when checks fail.
Documentation
- Clarified contribution steps for building, committing generated files, and validating changes before testing.

Add a post-build diff check so the shipped action bundle cannot drift from src without failing CI, even when local hooks are bypassed. Co-authored-by: Cursor <cursoragent@cursor.com>

coderabbitai · 2026-08-08T20:16:10Z

Warning

Review limit reached

@EndBug, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 36 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f4c79ac1-8a5a-403b-acae-923a88e7d1cb

📥 Commits

Reviewing files that changed from the base of the PR and between 9ed5abc and b92c3c7.

📒 Files selected for processing (3)

.github/workflows/test.yml
CONTRIBUTING.md
lib/index.js

📝 Walkthrough

Walkthrough

The workflow now uses Node.js 24 across build, test, and lint jobs. The build job checks committed lib/ output and uploads it when verification fails. Contribution instructions now describe the build and generated-output requirements.

Changes

CI consistency

Layer / File(s)	Summary
Workflow verification and contributor guidance `.github/workflows/test.yml`, `CONTRIBUTING.md`	The workflow uses Node.js 24. The build job compares committed `lib/` with build output and uploads failed verification artifacts. The contribution instructions describe the build, generated output, Husky behavior, and test-repository testing.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main CI change: verifying that committed lib/ matches the build output.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch cursor/ci-lib-integrity-check

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Co-authored-by: Cursor <cursoragent@cursor.com>

coderabbitai

Actionable comments posted: 2

🧹 Nitpick comments (1)

CONTRIBUTING.md (1)
8-8: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Document the Node.js version used for the integrity build.

The workflow rebuilds and checks lib/ with Node.js 24, but this instruction does not state that requirement. If another Node.js version changes the build output, contributors can create a bundle that fails only in CI. State Node.js 24 here, or enforce the same version with repository toolchain metadata.
📝 Proposed wording
-4. Build the action (`npm ci && npm run build`) and include any `lib/` changes in your commit.
+4. Use Node.js 24, build the action (`npm ci && npm run build`), and include any `lib/` changes in your commit.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CONTRIBUTING.md` at line 8, Update the build instruction in CONTRIBUTING.md
to explicitly require Node.js 24 for running npm ci and npm run build, matching
the CI integrity-build environment.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/test.yml:
- Around line 22-26: Update the verify-lib check in the workflow to detect
untracked files under lib/ in addition to tracked diffs, using git ls-files
--others -- lib/ or an equivalent git status parser. Ensure any untracked
generated artifact causes the existing out-of-sync failure and prevents the
upload from being skipped.
- Around line 17-18: Update the workflow permissions to grant only contents:
read at workflow or job scope, and set persist-credentials: false on every
actions/checkout step unless a later step explicitly requires authenticated Git
commands.

---

Nitpick comments:
In `@CONTRIBUTING.md`:
- Line 8: Update the build instruction in CONTRIBUTING.md to explicitly require
Node.js 24 for running npm ci and npm run build, matching the CI integrity-build
environment.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: dd73e30d-dda5-4231-8491-d9a6dac29079

📥 Commits

Reviewing files that changed from the base of the PR and between 86ab5dc and 9ed5abc.

📒 Files selected for processing (2)

.github/workflows/test.yml
CONTRIBUTING.md

Detect untracked lib/ artifacts, drop checkout credentials, and document Node 24 for local builds. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Bumps EndBug/add-and-commit from 10 to 11. Release notes Sourced from EndBug/add-and-commit's releases. v11.0.0 What's Changed chore(deps): bump picomatch by @dependabot[bot] in EndBug/add-and-commit#724 chore(deps-dev): bump handlebars from 4.7.8 to 4.7.9 by @dependabot[bot] in EndBug/add-and-commit#725 chore(deps): bump lodash from 4.17.23 to 4.18.1 by @dependabot[bot] in EndBug/add-and-commit#728 chore(deps-dev): bump ts-jest from 29.4.6 to 29.4.9 by @dependabot[bot] in EndBug/add-and-commit#727 chore(deps): bump @actions/github from 9.0.0 to 9.1.0 by @dependabot[bot] in EndBug/add-and-commit#729 chore(deps): bump @actions/github from 9.1.0 to 9.1.1 by @dependabot[bot] in EndBug/add-and-commit#732 chore(deps): bump @actions/core from 3.0.0 to 3.0.1 by @dependabot[bot] in EndBug/add-and-commit#733 ci(deps): bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in EndBug/add-and-commit#734 chore(deps-dev): bump ts-jest from 29.4.9 to 29.4.11 by @dependabot[bot] in EndBug/add-and-commit#736 chore(deps-dev): bump jest from 30.3.0 to 30.4.2 by @dependabot[bot] in EndBug/add-and-commit#735 chore(deps-dev): bump eslint-plugin-prettier from 5.5.5 to 5.5.6 by @dependabot[bot] in EndBug/add-and-commit#738 chore(deps): bump js-yaml from 4.1.1 to 4.2.0 by @dependabot[bot] in EndBug/add-and-commit#739 ci(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in EndBug/add-and-commit#741 chore(deps): bump undici from 6.24.1 to 6.27.0 by @dependabot[bot] in EndBug/add-and-commit#744 ci(deps): bump actions/setup-node from 6 to 7 by @dependabot[bot] in EndBug/add-and-commit#749 chore(deps-dev): bump @vercel/ncc from 0.38.4 to 0.44.1 by @dependabot[bot] in EndBug/add-and-commit#746 chore(deps): bump js-yaml from 4.2.0 to 5.2.1 by @dependabot[bot] in EndBug/add-and-commit#747 chore(deps-dev): bump ts-jest from 29.4.11 to 29.4.12 by @dependabot[bot] in EndBug/add-and-commit#750 chore(deps): bump js-yaml from 5.2.1 to 5.2.2 by @dependabot[bot] in EndBug/add-and-commit#751 chore(deps): bump undici from 6.27.0 to 6.28.0 by @dependabot[bot] in EndBug/add-and-commit#753 fix: reject remote-helper git flags that enable RCE by @EndBug in EndBug/add-and-commit#754 fix: prevent git option injection via new_branch by @EndBug in EndBug/add-and-commit#755 fix: verify committed lib/ matches source in CI by @EndBug in EndBug/add-and-commit#756 fix: stop logging full git config (credential leak) by @EndBug in EndBug/add-and-commit#758 fix: reject -F/--file git args that can exfiltrate runner files by @EndBug in EndBug/add-and-commit#759 fix: reject unmatched quotes in matchGitArgs to prevent flag injection by @EndBug in EndBug/add-and-commit#760 fix: refuse unexpected gitlinks staged by git add by @EndBug in EndBug/add-and-commit#761 fix: do not report committed=true for empty commit SHA by @EndBug in EndBug/add-and-commit#757 ci: pin actions-tagger and restrict release workflow permissions by @EndBug in EndBug/add-and-commit#762 fix: neutralize bidi and control chars in action logs by @EndBug in EndBug/add-and-commit#763 Full Changelog: EndBug/add-and-commit@v10.0.0...v11.0.0 Commits 645ecc0 11.0.0 06e788f fix: neutralize bidi and control chars in action logs (#763) 68ec86a ci: pin actions-tagger and restrict release workflow permissions (#762) f1bb0cc fix: do not report committed=true for empty commit SHA (#757) ebc24bf fix: refuse unexpected gitlinks staged by git add (#761) 75038f8 fix: reject unmatched quotes in matchGitArgs to prevent flag injection (#760) d07c930 fix: reject -F/--file git args that can exfiltrate runner files (#759) 0971289 fix: stop logging full git config (credential leak) (#758) c38a33b fix: verify committed lib/ matches source in CI (#756) b4a0134 fix: prevent git option injection via new_branch (#755) Additional commits viewable in compare view Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase. Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: @dependabot rebase will rebase this PR @dependabot recreate will recreate this PR, overwriting any edits that have been made to it @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

fix: verify committed lib/ matches source in CI

f56c729

Add a post-build diff check so the shipped action bundle cannot drift from src without failing CI, even when local hooks are bypassed. Co-authored-by: Cursor <cursoragent@cursor.com>

chore: rebuild lib/ against lockfile for CI integrity check

9ed5abc

Co-authored-by: Cursor <cursoragent@cursor.com>

EndBug marked this pull request as ready for review August 8, 2026 20:22

coderabbitai Bot reviewed Aug 8, 2026

View reviewed changes

Comment thread .github/workflows/test.yml

Comment thread .github/workflows/test.yml Outdated

ci: tighten lib integrity check and workflow permissions

bae25c9

Detect untracked lib/ artifacts, drop checkout credentials, and document Node 24 for local builds. Co-authored-by: Cursor <cursoragent@cursor.com>

EndBug enabled auto-merge (squash) August 8, 2026 20:38

EndBug and others added 2 commits August 8, 2026 22:39

Merge branch 'main' into cursor/ci-lib-integrity-check

31b2b23

chore: rebuild lib/ after merging main

b92c3c7

Co-authored-by: Cursor <cursoragent@cursor.com>

EndBug merged commit c38a33b into main Aug 8, 2026
10 checks passed

EndBug deleted the cursor/ci-lib-integrity-check branch August 8, 2026 20:44

coderabbitai Bot mentioned this pull request Aug 8, 2026

ci: pin actions-tagger and restrict release workflow permissions #762

Merged

2 tasks

Navigation Menu

Uh oh!

fix: verify committed lib/ matches source in CI - #756

fix: verify committed lib/ matches source in CI#756
EndBug merged 5 commits into
mainfrom
cursor/ci-lib-integrity-check

EndBug commented Aug 8, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 8, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

EndBug commented Aug 8, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

EndBug commented Aug 8, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 8, 2026 •

edited

Loading