Skip to content

Move frontmatter schema to subfolder#58

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ashleyshaw merged 1 commit into from
Nov 12, 2025
Merged

Move frontmatter schema to subfolder #58

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/workflows/.gitignore
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
# Workflow artifacts and logs
validation-errors.log
*.log
130 changes: 130 additions & 0 deletions .github/workflows/frontmatter-validation.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
---
name: Frontmatter Validation

on:
push:
branches:
- main
- develop
- 'claude/**'
paths:
- '**.md'
- 'schemas/frontmatter/**'
- '.github/workflows/frontmatter-validation.yml'
pull_request:
paths:
- '**.md'
- 'schemas/frontmatter/**'
- '.github/workflows/frontmatter-validation.yml'
workflow_dispatch:

Comment on lines +1 to +20

@coderabbitaicoderabbitaiBotNov 12, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Add explicit permissions and concurrency controls.

The workflow is missing two critical GitHub Actions best practices:

  1. Explicit permissions: Add a top-level permissions key to follow the principle of least privilege
  2. Concurrency controls: Add a concurrency key to prevent overlapping runs and save CI resources

As per coding guidelines, apply this diff:

 ---
name: Frontmatter Validation
+permissions:+ contents: read++concurrency:+ group: ${{ github.workflow }}-${{ github.ref }}+ cancel-in-progress: true+
on:
push:
📝 Committable suggestion

‼️IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
---
name: Frontmatter Validation
on:
push:
branches:
- main
- develop
- 'claude/**'
paths:
- '**.md'
- 'schemas/frontmatter/**'
- '.github/workflows/frontmatter-validation.yml'
pull_request:
paths:
- '**.md'
- 'schemas/frontmatter/**'
- '.github/workflows/frontmatter-validation.yml'
workflow_dispatch:
---
name: Frontmatter Validation
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
on:
push:
branches:
- main
- develop
- 'claude/**'
paths:
- '**.md'
- 'schemas/frontmatter/**'
- '.github/workflows/frontmatter-validation.yml'
pull_request:
paths:
- '**.md'
- 'schemas/frontmatter/**'
- '.github/workflows/frontmatter-validation.yml'
workflow_dispatch:
🤖 Prompt for AI Agents
In .github/workflows/frontmatter-validation.yml around lines 1 to 20, the
workflow lacks top-level permissions and concurrency settings; add a top-level
permissions block (e.g., permissions: contents: read) to follow least-privilege
and a concurrency block to avoid overlapping runs (e.g., concurrency: group: ${{
github.workflow }}-${{ github.ref }} cancel-in-progress: true), placing both
keys at the top level (immediately after the name: line and before the on:
block).

jobs:
validate-schema:
name: Validate Frontmatter Schema
runs-on: ubuntu-latest

steps:
- name: Checkout repository
uses: actions/checkout@v4

@coderabbitaicoderabbitaiBotNov 12, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Pin actions to commit SHAs instead of mutable tags.

The workflow uses mutable version tags (@v4) for actions, which can be updated and potentially introduce supply-chain vulnerabilities. Pin all actions to full-length commit SHAs.

As per coding guidelines, find the commit SHAs for these versions and pin them:

#!/bin/bash# Find latest commit SHAs for the actions in useecho"=== actions/checkout@v4 ==="
gh api repos/actions/checkout/git/ref/tags/v4 | jq -r '.object.sha'echo"=== actions/setup-node@v4 ==="
gh api repos/actions/setup-node/git/ref/tags/v4 | jq -r '.object.sha'echo"=== actions/upload-artifact@v4 ==="
gh api repos/actions/upload-artifact/git/ref/tags/v4 | jq -r '.object.sha'echo"=== tj-actions/changed-files@v44 ==="
gh api repos/tj-actions/changed-files/git/ref/tags/v44 | jq -r '.object.sha'echo"=== actions/github-script@v7 ==="
gh api repos/actions/github-script/git/ref/tags/v7 | jq -r '.object.sha'

Also applies to: 56-56, 88-88

🤖 Prompt for AI Agents
.github/workflows/frontmatter-validation.yml lines 28, 56 and 88: the workflow
currently uses mutable tags like actions/checkout@v4; replace each action
reference with the corresponding full-length commit SHA to pin the dependency
and avoid supply-chain drift — look up the latest commit SHA for each tag (e.g.,
via the GitHub API or gh CLI for actions/checkout@v4, actions/setup-node@v4,
actions/upload-artifact@v4, tj-actions/changed-files@v44,
actions/github-script@v7) and update the workflow to use the full 40-character
commit SHA instead of the @v* tag in each uses: line, commit the change, and
verify the workflow runs correctly.


- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: schemas/frontmatter/package-lock.json

- name: Install dependencies
working-directory: schemas/frontmatter
run: npm ci

- name: Validate schema structure
working-directory: schemas/frontmatter
run: npm run validate:schema

- name: Run schema tests
working-directory: schemas/frontmatter
run: npm test

validate-frontmatter:
name: Validate All Frontmatter
runs-on: ubuntu-latest
needs: validate-schema

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: schemas/frontmatter/package-lock.json

- name: Install dependencies
working-directory: schemas/frontmatter
run: npm ci

- name: Validate all frontmatter files
working-directory: schemas/frontmatter
run: npm run validate

- name: Upload validation report
if: failure()
uses: actions/upload-artifact@v4
with:
name: validation-errors
path: schemas/frontmatter/validation-errors.log
retention-days: 7

frontmatter-changed-files:
name: Validate Changed Files Only
runs-on: ubuntu-latest
if: github.event_name == 'pull_request'

steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: schemas/frontmatter/package-lock.json

- name: Install dependencies
working-directory: schemas/frontmatter
run: npm ci

- name: Get changed markdown files
id: changed-files
uses: tj-actions/changed-files@v44
with:
files: |
**.md

- name: Validate changed files
if: steps.changed-files.outputs.any_changed == 'true'
working-directory: schemas/frontmatter
run: |
echo "Validating changed files:"
for file in ${{ steps.changed-files.outputs.all_changed_files }}; do
echo " - $file"
node validate.js "../../$file" || exit 1
done

- name: Comment on PR
if: failure() && github.event_name == 'pull_request'
uses: actions/github-script@v7
with:
script: |
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: '⚠️ **Frontmatter validation failed**\n\nPlease check the workflow logs for details and ensure all frontmatter follows the schema at `schemas/frontmatter/frontmatter.schema.json`.\n\nSee [Frontmatter Documentation](https://github.com/lightspeedwp/.github/blob/develop/schemas/frontmatter/README.md) for guidance.'
})
Loading
Loading