Stabilize failing GitHub workflows and align repo tooling #27
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -28,42 +28,46 @@ | |
|
|
||
| name: EthicalCheck-Workflow | ||
|
|
||
| on: | ||
| schedule: | ||
| - cron: '37 9 * * 2' | ||
| workflow_dispatch: | ||
|
|
||
|
Comment on lines
31
to
35
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| trigger_ethicalcheck: | ||
| runs-on: ubuntu-latest | ||
| env: | ||
| APISEC_BASE_URL: ${{ vars.APISEC_BASE_URL }} | ||
| APISEC_SPECIFICATION_PATH: ${{ vars.APISEC_SPECIFICATION_PATH }} | ||
| APISECU_TOKEN: ${{ secrets.APISECU_TOKEN }} | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Validate EthicalCheck configuration | ||
| id: config | ||
| run: | | ||
| if [ -z "${APISEC_BASE_URL}" ] || [ -z "${APISEC_SPECIFICATION_PATH}" ] || [ -z "${APISECU_TOKEN}" ]; then | ||
| echo "configured=false" >> "${GITHUB_OUTPUT}" | ||
| echo "ℹ️ EthicalCheck is not configured. Set APISEC_BASE_URL, APISEC_SPECIFICATION_PATH, and APISECU_TOKEN to enable scans." | ||
| exit 0 | ||
| fi | ||
|
|
||
| if [ ! -f "${APISEC_SPECIFICATION_PATH}" ]; then | ||
| echo "Configured OpenAPI specification file not found: ${APISEC_SPECIFICATION_PATH}" | ||
| exit 1 | ||
| fi | ||
|
|
||
| echo "configured=true" >> "${GITHUB_OUTPUT}" | ||
|
|
||
| - name: Run APIsec scan | ||
| if: steps.config.outputs.configured == 'true' | ||
| uses: apisec-university/free-API-security-test-action@beta | ||
|
There was a problem hiding this comment. 4. A mutable action can expose scan secrets The Run APIsec scan step references the third-party action through the movable beta tag while passing it APISECU_TOKEN. If that tag is moved or its repository is compromised, scheduled and manually dispatched jobs execute the replacement code with the APIsec credential and read access to the repository. Agent Prompt
Contributor
There was a problem hiding this comment. @copilot - ## Issue description Issue ContextThe replaced EthicalCheck action was pinned to a full commit SHA, and other third-party workflows in this repository follow the same pattern. Preserve the action inputs and configuration gate while replacing only the mutable reference. Fix Focus Areas
|
||
| with: | ||
|
Comment on lines
+67
to
+70
|
||
| base_url: ${{ env.APISEC_BASE_URL }} | ||
| specification_path: ${{ env.APISEC_SPECIFICATION_PATH }} | ||
| apisecu_token: ${{ env.APISECU_TOKEN }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -246,15 +246,7 @@ private function configureR2(): void | |
| throw new RuntimeException('STARMUS_R2_SECRET_KEY is not defined or is empty.'); | ||
| } | ||
|
|
||
| $r2_endpoint = $this->getRequiredStringConstant('STARMUS_R2_ENDPOINT'); | ||
|
There was a problem hiding this comment. 3. Reviewers must assess unrelated fixes The PR combines workflow runtime changes, an API security action replacement, build-validator repair, broad JavaScript formatting, and an R2 constant-loading refactor in one change set. Because the workflow, validator, formatting, and PHP groups can be removed independently without making the others incoherent, reviewers must validate several unrelated failure modes together. Agent Prompt
Contributor
There was a problem hiding this comment. @copilot - ## Issue description Issue ContextSeparate workflow/runtime repair, APIsec workflow replacement, build validation, formatting-only changes, and PHP constant handling into focused pull requests with their relevant tests. Fix Focus Areas
|
||
|
|
||
| $this->bucket = \defined('STARMUS_R2_BUCKET') ? STARMUS_R2_BUCKET : 'starmus-audio'; | ||
| $account_id = STARMUS_R2_ACCOUNT_ID; | ||
|
|
@@ -301,6 +293,27 @@ private function configureAws(): void | |
| ]); | ||
| } | ||
|
|
||
| private function getRequiredStringConstant(string $constant_name): string | ||
| { | ||
|
Comment on lines
+296
to
+297
There was a problem hiding this comment. 1. Maintainers inherit conflicting styles getRequiredStringConstant() uses a camelCase method name and a PSR-style next-line opening brace in WordPress-integrated source, with no inline waiver. When the repository's WordPress naming and core rules scan src/, this newly added helper conflicts with the preferred style and gives later additions two conventions to follow. Agent Prompt
Contributor
There was a problem hiding this comment. @copilot - ## Issue description Issue ContextRename the helper and its call site using WordPress snake_case, and place the opening brace according to the applicable WordPress standard. Update any references consistently. Fix Focus Areas
|
||
| if (! \defined($constant_name)) { | ||
| throw new RuntimeException(\sprintf('%s is not defined or is empty.', $constant_name)); | ||
| } | ||
|
|
||
|
Comment on lines
+298
to
+301
There was a problem hiding this comment. 2. Php changes can merge without tests getRequiredStringConstant() adds validation behavior, but the changed workflows run PHP static analysis and WordPress activation or end-to-end checks without invoking the configured PHPUnit suite. When endpoint constants are undefined, non-scalar, or empty, no required CI job exercises those branches, so a regression in the new helper can merge undetected. Agent Prompt
Contributor
There was a problem hiding this comment. @copilot - ## Issue description Issue ContextAdd a blocking PHP unit-test step and cover undefined, non-scalar, empty, and valid string constants. Keep the existing static-analysis step blocking. Fix Focus Areas
|
||
| $constant_value = \constant($constant_name); | ||
|
|
||
| if (! \is_scalar($constant_value)) { | ||
| throw new RuntimeException(\sprintf('%s is not defined or is empty.', $constant_name)); | ||
| } | ||
|
|
||
| $resolved_value = (string) $constant_value; | ||
|
|
||
| if ($resolved_value === '') { | ||
| throw new RuntimeException(\sprintf('%s is not defined or is empty.', $constant_name)); | ||
| } | ||
|
|
||
| return $resolved_value; | ||
| } | ||
|
Comment on lines
+296
to
+315
Comment on lines
+308
to
+315
|
||
|
|
||
| private function createOptimizedVersion(string $input, array $params): ?string | ||
| { | ||
| $temp_file = tempnam(sys_get_temp_dir(), 'starmus_africa_') . '.mp3'; | ||
|
|
||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
5. Merges skip api security scans
🐞 Bug⛨ SecurityAgent Prompt
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation toolsThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@copilot - ## Issue description
The repaired API security workflow no longer runs on pushes or pull requests because both event triggers were removed. Restore appropriate change-triggered execution while retaining the existing configuration gate so unconfigured repositories and forked pull requests skip cleanly.
Issue Context
The previous workflow targeted pushes and pull requests to
main. The new weekly schedule can complement those triggers but does not scan each update before or when it reaches the main branch.Fix Focus Areas