feat(ci): add react doctor workflow - #279
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
paulbalaji
changed the title
Adds React Doctor GitHub Action to scan for React security, performance, correctness, and accessibility issues on PRs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
89c15c0 to
4ed1664
Compare
Fixes from React Doctor analysis (#279): Errors: - Add missing alt={title} on <img> in TokenIcon.tsx - Add missing alt="" on background <img> in og.tsx Warnings fixed: - ContentDetailsCard: replace useEffect with render-time state sync for bodyDecodeType - SearchFilterBar: sync local DatetimeSelector state with prop changes - CollateralCards: use txHash as stable key instead of array index - IcaDetailsCard: use destinationAddress in key, change <label> to <span> - GasDetailsCard: extract default {} to module-level constant, use composite key - ContentDetailsCard: change unassociated <label> to <span> - WarpTransferDetailsCard: parallelize 3 independent awaits with Promise.all - MessageSearch: wrap useState initializers in lazy arrow functions Skipped (legitimate patterns): - [messageId].tsx: pages router redirect in useEffect - useMessageDeliveryStatus: useEffect for toast on error state - _app.tsx: useIsSsr hook controls SSR/client render split - MessageSearch: 6 useState calls (independent filter state) - MessageSearch: 6 setState in hydration useEffect (one-time URL sync) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
| id: react-doctor | ||
| uses: millionco/react-doctor@0.0.1 | ||
| with: | ||
| verbose: 'true' |
There was a problem hiding this comment.
Unpinned third-party action execution
Medium Severity
The workflow runs millionco/react-doctor@0.0.1 from a moving ref instead of a commit SHA. If the tag is ever retargeted or the upstream repo is compromised, arbitrary code could execute in CI on PRs with the workflow’s token and repo read access.
|
|
||
| - name: Print score | ||
| run: | | ||
| echo "React Doctor score: ${{ steps.react-doctor.outputs.score }}/100" |
There was a problem hiding this comment.
Score output may be unset
Low Severity
The log line uses steps.react-doctor.outputs.score, but if the millionco/react-doctor action doesn’t define an output named score (or fails before setting it), the workflow still prints a misleading /100 score with an empty value.
1 participant
Summary
Test plan
🤖 Generated with Claude Code
Note
Low Risk
CI-only change that adds a new diagnostic workflow; no production code or runtime behavior is modified.
Overview
Adds a new GitHub Actions workflow (
.github/workflows/react-doctor.yml) that runs on PRs tomain(and manually) to executemillionco/react-doctor@0.0.1with verbose output.The job checks out the repo, runs React Doctor, and prints the resulting
/100score from the action outputs.Written by Cursor Bugbot for commit 4ed1664. This will update automatically on new commits. Configure here.