ci: add self-updating star history chart workflow - #206
Conversation
Add narayann7/star-history-action on a daily schedule (plus manual dispatch) to render light/dark star-growth charts into assets/star-history/ and rewrite the new marker block at the bottom of README.md. The action only commits when star data actually changed and its commit message carries [skip ci], so chart refreshes neither spam history nor trigger the CI workflow. The action is pinned to an immutable SHA instead of the mutable v1 tag: it is a third-party action holding contents:write that pushes to the repo, so its supply chain must not be silently updatable. The upstream example's per-star watch trigger is deliberately left out to avoid a commit for every star event. The first chart appears after a manual workflow_dispatch run once this lands on main; until then the marker block renders as empty. Signed-off-by: Kevin Cui <bh@bugs.cc>
Summary by CodeRabbit
WalkthroughThe README now contains a Star History section with markers for generated content. A GitHub Actions workflow runs daily at 03:00 UTC or through manual dispatch, prevents overlapping executions, grants repository content write access, checks out the repository, and invokes a pinned star-history action to refresh and commit the chart and README. 🚥 Pre-merge checks | ✅ 3 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (3 passed)
✨ Finishing Touches✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/star-history.yml (1)
28-31: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin
actions/checkoutto an immutable SHA too.This workflow grants write access and relies on checkout’s persisted credentials for the later push. Pinning the checkout action to its full release SHA would make the complete write-capable workflow reproducible and align with GitHub’s supply-chain guidance. (docs.github.com)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/star-history.yml around lines 28 - 31, Update the Checkout step’s actions/checkout reference in the star-history workflow from the mutable v7 tag to the full immutable commit SHA for the intended release, preserving the existing persisted-credentials behavior required by the later push.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/star-history.yml:
- Around line 9-12: Restrict the workflow job triggered by workflow_dispatch to
the main branch by adding a job-level condition that requires github.ref to
equal refs/heads/main. Preserve the existing scheduled execution behavior.
---
Nitpick comments:
In @.github/workflows/star-history.yml:
- Around line 28-31: Update the Checkout step’s actions/checkout reference in
the star-history workflow from the mutable v7 tag to the full immutable commit
SHA for the intended release, preserving the existing persisted-credentials
behavior required by the later push.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b8507947-4135-4845-a614-0db3627f5770
📒 Files selected for processing (2)
.github/workflows/star-history.ymlREADME.md
| on: | ||
| schedule: | ||
| - cron: "0 3 * * *" | ||
| workflow_dispatch: |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
set -euo pipefail
printf '\n== .github/workflows/star-history.yml ==\n'
cat -n .github/workflows/star-history.yml
printf '\n== search for star-history references ==\n'
rg -n "star-history|workflow_dispatch|contents: write|actions/checkout" .github/workflows .github -g '!**/*.png' || trueRepository: oomol-lab/open-connector
Length of output: 3528
🏁 Script executed:
python3 - <<'PY'
from pathlib import Path
p = Path('.github/workflows/star-history.yml')
print(p.exists())
PYRepository: oomol-lab/open-connector
Length of output: 167
🏁 Script executed:
set -euo pipefail
sed -n '1,220p' .github/workflows/star-history.ymlRepository: oomol-lab/open-connector
Length of output: 1583
🌐 Web query:
GitHub Actions workflow_dispatch manual run selected branch defaults checkout ref repository push behavior documentation
💡 Result:
When you manually trigger a workflow using the workflow_dispatch event, GitHub Actions sets the github.ref context to the specific branch, tag, or commit SHA selected by the user in the GitHub UI, CLI, or API [1][2]. The behavior of the actions/checkout action regarding this selection is as follows: 1. Default Checkout Behavior: By default, the actions/checkout action checks out the ref that triggered the workflow [3][4][5]. Because workflow_dispatch sets github.ref to the selected branch, actions/checkout automatically checks out that specific branch when used without a specified ref input [2]. 2. Technical Mechanism: The actions/checkout documentation states that for the repository that triggered the workflow, the ref input defaults to the reference or SHA for that event [3][6]. Since workflow_dispatch defines that event context based on the user's selection, no additional configuration is typically required to ensure the correct branch is checked out [2]. 3. Overriding the Behavior: If you wish to force the workflow to use a specific branch regardless of the user's selection, you can explicitly set the ref input in your actions/checkout step [4][2]: - uses: actions/checkout@v4 with: ref: main 4. Validating Selection: If you need to ensure that a workflow only runs on a specific branch (e.g., to prevent manual runs on non-production branches), you can add a job step to check the github.ref context and fail the workflow if it does not match your requirement [2]: jobs: validate: runs-on: ubuntu-latest steps: - name: Validate branch if: github.ref!= 'refs/heads/main' run: | echo "This workflow can only be run on the main branch." exit 1
Citations:
- 1: https://docs.github.com/en/actions/how-tos/manage-workflow-runs/manually-run-a-workflow?tool=webui
- 2: https://www.w3tutorials.net/blog/github-action-workflow-dispatch-how-to-always-use-the-master-branch-remove-option-to-change-branch/
- 3: https://github.com/actions/checkout/blob/72f2cec99f417b1a1c5e2e88945068983b7965f9/action.yml
- 4: https://github.com/actions/checkout/tree/0299a0d2b67d48224ce047d03c69693b37fe77fe
- 5: https://raw.githubusercontent.com/actions/checkout/v6/action.yml
- 6: https://github.com/actions/checkout/blob/main/README.md
Restrict workflow_dispatch to main.
Manual runs can target another branch, and checkout will use that ref by default, so this workflow can generate and push the chart/README to a feature branch instead of main. Add a job-level guard like if: github.ref == 'refs/heads/main'.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/star-history.yml around lines 9 - 12, Restrict the
workflow job triggered by workflow_dispatch to the main branch by adding a
job-level condition that requires github.ref to equal refs/heads/main. Preserve
the existing scheduled execution behavior.
1 participant
Adds narayann7/star-history-action on a daily schedule (plus
workflow_dispatch) to render the repo's star-growth chart as light/dark SVGs intoassets/star-history/and keep the new marker block at the bottom ofREADME.mdup to date. The action only commits when star data actually changed, and its commit message carries[skip ci], so refreshes neither spam history nor trigger the CI workflow.Two deliberate deviations from the upstream example: the action is pinned to an immutable SHA instead of the mutable
v1tag, since a third-party action holdingcontents: writethat pushes to this repo shouldn't be silently updatable; and the per-starwatchtrigger is left out to avoid a commit for every star event — daily is enough.The first chart appears after a manual
workflow_dispatchrun once this lands on main; until then the marker block renders as empty. Localized READMEs underdocs/are untouched for now — they can reference the same generated SVGs once the first run produces them.