feat: add auto-docs workflow and screenshot functionality for documen… - #667
feat: add auto-docs workflow and screenshot functionality for documen…#667priyanshu6238 wants to merge 1 commit into
Conversation
|
Warning Review limit reached
Next review available in: 46 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
📝 WalkthroughWalkthroughAdds an issue-triggered documentation workflow that checks out product repositories, invokes Claude Code, validates file scope, captures screenshots, and creates a review PR. Adds repository guidance for documentation structure, page conventions, and screenshot handling. Adds a Playwright utility that replaces 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1⚔️ Resolve merge conflicts 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 7
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/scripts/docs-agent-prompt.md:
- Around line 25-35: Add a documented allowlist of safe screenshot route
patterns in the prompt section around the SCREENSHOT placeholder instructions in
.github/scripts/docs-agent-prompt.md. In .github/scripts/take-screenshots.mjs,
validate every extracted route against that allowlist before page.goto(), reject
unapproved routes, and ensure screenshot authentication uses a staging account
containing only scrubbed demonstration data; update both affected files as
specified.
In @.github/scripts/take-screenshots.mjs:
- Around line 54-56: Replace the relative-path logic in relativeImagePath with
the public Docusaurus URL format, returning
/img/generated/${ISSUE_NUMBER}/${slug}.png using the image’s issue number and
slug instead of traversing from docFile. Ensure generated documentation links
resolve from the site root and preserve the expected PNG filename.
In @.github/workflows/auto-docs.yml:
- Around line 70-84: Parse Git status output as NUL-delimited records in both
affected sites: update .github/workflows/auto-docs.yml lines 70-84 to use
porcelain v1 with -z, a NUL-safe loop, and inspect both source and destination
paths for renames; update .github/scripts/take-screenshots.mjs lines 33-41 to
use the same NUL-delimited output and preserve each path exactly without
trimming or slicing quoted text.
- Around line 17-20: Update the auto-docs job around its workflow trigger and
branch-creation steps to serialize runs per issue using issue-scoped
concurrency, then check for an existing open pull request for that issue before
creating or pushing the branch. Reuse the existing branch/PR symbols and exit
successfully when the documentation PR already exists, while preserving normal
branch creation for new issues.
- Around line 12-15: Update every actions/checkout invocation in the workflow to
set persist-credentials: false, including the checkout covered by the later
workflow section. Ensure the Claude authoring step cannot access any
write-capable credential; provide a limited push credential only after that
step, or split authoring and pull-request creation into separate jobs with
read-only permissions for authoring.
- Around line 22-23: Update the workflow steps using actions/checkout,
anthropics/claude-code-action, and actions/setup-node to reference reviewed
immutable commit SHAs instead of mutable version tags, preserving each action’s
existing configuration and behavior.
- Around line 105-110: Update the setup-node action version in the “Set up Node”
workflow step from v3 to actions/setup-node@v4 or another newer supported
release, while preserving its existing condition and yarn cache configuration.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: e56226de-e0e0-4fb4-aa23-e217dabd3c11
⛔ Files ignored due to path filters (1)
yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (6)
.github/scripts/docs-agent-prompt.md.github/scripts/take-screenshots.mjs.github/workflows/auto-docs.yml.gitignoreCLAUDE.mdpackage.json
| 4. Wherever the doc should show a screenshot of the actual running app, insert a single | ||
| placeholder line of this exact form (a later automated step replaces it with a real | ||
| image — do not invent or guess an image path yourself): | ||
|
|
||
|  | ||
|
|
||
| - <short-slug> is a short kebab-case identifier, unique within this change (e.g. | ||
| "flow-editor-new-node"). | ||
| - <app-route-path> is the in-app route to screenshot, starting with "/" (e.g. | ||
| "/flow/configure/123"). | ||
| - Only add these where a screenshot genuinely helps the reader; no more than 3. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== tracked files =="
git ls-files | sed -n '1,120p'
echo
echo "== git diff stat =="
git diff --stat || true
echo
echo "== files of interest =="
for f in .github/scripts/docs-agent-prompt.md .github/scripts/take-screenshots.mjs; do
if [ -f "$f" ]; then
echo "--- $f ($(wc -l < "$f") lines) ---"
cat -n "$f"
else
echo "MISSING $f"
fi
done
echo
echo "== related scripts and usage =="
git ls-files .github/scripts | xargs -r -n1 sh -c 'echo "--- $1 ---"; rg -n "docs-agent-prompt|take-screenshots|screenshots|page.goto|SCREENSHOT|placeholder|route|ISSUE_NUMBER|STAGING_URL|console\\.log|mkdirSync|page\\.screenshot|placeholder|prompt" "$1" || true' sh {}Repository: glific/docs
Length of output: 15911
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflows mentioning screenshot or docs agent =="
for f in .github/workflows/*.yml .github/workflows/*.yaml; do
[ -f "$f" ] || true
done | while read -r f; do
echo "--- $f ($(wc -l < "$f") lines) ---"
rg -n "docs-agent|SCREENSHOT|take-screenshots|github_issue|issue|body|token|STAGING|GLIFIC|auto-docs|permissions|pull_request|workflow_run" "$f" || true
done
echo
echo "== config files likely containing staging credentials or relevant env =="
git ls-files | rg '(^|/)\.env|(^|/)\.env\.(sample|example|production|staging)|(^|/)docusaurus\.config|package\.json|CLAUDE\.md|README\.md' | while read -r f; do
echo "--- $f ($(wc -l < "$f") lines) ---"
rg -n "GLIFIC_STAGING|STAGING_URL|STAGING_PHONE|STAGING_PASSWORD|SCREENSHOT|take-screenshots|docs-agent|permissions|auto-docs|GitHub Apps|github_app|token" "$f" || true
done
echo
echo "== repository references to generated screenshots and auth =="
rg -n "generated/.*/.*\.png|generated/|static/img/generated|SCREENSHOT|GLIFIC_STAGING_PHONE|GLIFIC_STAGING_PASSWORD|password|phoneNumber|Login|SubmitButton|glific-frontend|glific/repo|GITHUB_TOKEN" .github README.md CLAUDE.md .env.example 2>/dev/null || trueRepository: glific/docs
Length of output: 4244
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== auto-docs workflow =="
cat -n .github/workflows/auto-docs.yml
echo
echo "== package scripts and relevant config =="
cat -n package.json
sed -n '1,80p' .github/scripts/take-screenshots.mjs
sed -n '115,145p' .github/scripts/take-screenshots.mjs
echo
echo "== static generated image references =="
git ls-files | rg '^static/img/generated/' || true
rg -n "static/img/generated|generated/" .github docs README.md CLAUDE.md 2>/dev/null || trueRepository: glific/docs
Length of output: 12340
Restrict authenticated screenshot routes to documented safe routes.
The workflow labels issue-controlled input as the doc prompt, and the screenshot script captures every SCREENSHOT:<slug>:<route> placeholder using staging login credentials before opening a PR. Add a documented allowlist in .github/scripts/docs-agent-prompt.md, validate each route against it before page.goto() in .github/scripts/take-screenshots.mjs, reject unapproved routes, and use a staging account containing only scrubbed demonstration data.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 29-29: Images should have alternate text (alt text)
(MD045, no-alt-text)
📍 Affects 2 files
.github/scripts/docs-agent-prompt.md#L25-L35(this comment).github/scripts/take-screenshots.mjs#L96-L103
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/scripts/docs-agent-prompt.md around lines 25 - 35, Add a documented
allowlist of safe screenshot route patterns in the prompt section around the
SCREENSHOT placeholder instructions in .github/scripts/docs-agent-prompt.md. In
.github/scripts/take-screenshots.mjs, validate every extracted route against
that allowlist before page.goto(), reject unapproved routes, and ensure
screenshot authentication uses a staging account containing only scrubbed
demonstration data; update both affected files as specified.
| function relativeImagePath(docFile, imagePath) { | ||
| const rel = relative(dirname(docFile), imagePath); | ||
| return rel.startsWith(".") ? rel : `./${rel}`; |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Write the public Docusaurus image path.
relativeImagePath() produces paths such as ../../static/img/generated/.... Docusaurus serves static/ at the site root, so these links resolve to a nonexistent /static/... URL in published docs. Generate /img/generated/${ISSUE_NUMBER}/${slug}.png directly.
Proposed fix
-function relativeImagePath(docFile, imagePath) {
- const rel = relative(dirname(docFile), imagePath);
- return rel.startsWith(".") ? rel : `./${rel}`;
-}
-
...
- const markdown = `})`;
+ const markdown = ``;Also applies to: 105-105
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/scripts/take-screenshots.mjs around lines 54 - 56, Replace the
relative-path logic in relativeImagePath with the public Docusaurus URL format,
returning /img/generated/${ISSUE_NUMBER}/${slug}.png using the image’s issue
number and slug instead of traversing from docFile. Ensure generated
documentation links resolve from the site root and preserve the expected PNG
filename.
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| issues: write |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Prevent Claude from reading a write-capable Git credential.
actions/checkout persists credentials by default. The issue-controlled agent can read .git/config because it has Read access. A prompt-injected issue can cause the agent to write that credential into an allowed documentation file, and the workflow then publishes it in a PR.
Set persist-credentials: false on all checkouts. Inject a limited push credential only after the Claude step. If the Claude action can still access a write token, split authoring and PR creation into separate jobs and give the authoring job read-only permissions.
Also applies to: 22-37
🧰 Tools
🪛 zizmor (1.29.0)
[error] 13-13: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level
(excessive-permissions)
[error] 14-14: overly broad permissions (excessive-permissions): pull-requests: write is overly broad at the workflow level
(excessive-permissions)
[error] 15-15: overly broad permissions (excessive-permissions): issues: write is overly broad at the workflow level
(excessive-permissions)
[warning] 13-13: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/auto-docs.yml around lines 12 - 15, Update every
actions/checkout invocation in the workflow to set persist-credentials: false,
including the checkout covered by the later workflow section. Ensure the Claude
authoring step cannot access any write-capable credential; provide a limited
push credential only after that step, or split authoring and pull-request
creation into separate jobs with read-only permissions for authoring.
Source: Linters/SAST tools
| jobs: | ||
| auto-docs: | ||
| if: github.event.label.name == 'auto-docs' && github.event.issue.pull_request == null | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win
Serialize and make repeated issue runs idempotent.
A second auto-docs label event for the same issue can overlap the first run or occur after its branch exists. git checkout -b "$branch" then fails, or concurrent pushes conflict. Add issue-scoped workflow concurrency and detect an existing open PR before creating the branch.
Also applies to: 135-142
🧰 Tools
🪛 zizmor (1.29.0)
[info] 18-18: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/auto-docs.yml around lines 17 - 20, Update the auto-docs
job around its workflow trigger and branch-creation steps to serialize runs per
issue using issue-scoped concurrency, then check for an existing open pull
request for that issue before creating or pushing the branch. Reuse the existing
branch/PR symbols and exit successfully when the documentation PR already
exists, while preserving normal branch creation for new issues.
Source: Linters/SAST tools
| - name: Checkout docs | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
cat -n .github/workflows/auto-docs.yml | sed -n '1,130p'
echo
echo "== git diff stat/name-status (if available) =="
git diff --stat HEAD~1..HEAD 2>/dev/null || true
git diff --numstat HEAD~1..HEAD 2>/dev/null || true
echo
echo "== references to checkout/setup-node/claude-code-action in workflow =="
rg -n "actions/checkout|anthropics/claude-code-action|actions/setup-node|uses:" .github/workflows/auto-docs.ymlRepository: glific/docs
Length of output: 6560
Pin GitHub Actions to commit SHAs.
This workflow runs with write permissions and passes ANTHROPIC_API_KEY, GITHUB_TOKEN, and staging credentials to the code fetched by these actions. Pin actions/checkout, anthropics/claude-code-action, and actions/setup-node to reviewed commit SHAs instead of mutable tags.
🧰 Tools
🪛 zizmor (1.29.0)
[warning] 22-23: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/auto-docs.yml around lines 22 - 23, Update the workflow
steps using actions/checkout, anthropics/claude-code-action, and
actions/setup-node to reference reviewed immutable commit SHAs instead of
mutable version tags, preserving each action’s existing configuration and
behavior.
Source: Linters/SAST tools
| changed=$(git status --porcelain | cut -c4-) | ||
| bad=0 | ||
| while IFS= read -r f; do | ||
| [ -z "$f" ] && continue | ||
| case "$f" in | ||
| *' -> '*) f="${f#*-> }" ;; # renames: check the destination path | ||
| esac | ||
| case "$f" in | ||
| docs/*|pr-body.md) ;; | ||
| *) | ||
| echo "::error::Unexpected file changed outside docs/: $f" | ||
| bad=1 | ||
| ;; | ||
| esac | ||
| done <<< "$changed" |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Parse Git status paths as NUL-delimited records.
git status --porcelain C-quotes paths that contain spaces. Both sites treat the quoted output as a literal path. This rejects valid documentation paths such as docs/3. Product Features/... in the guardrail and causes readFileSync() to read a nonexistent quoted path.
.github/workflows/auto-docs.yml#L70-L84: usegit status --porcelain=v1 -zand a NUL-safe loop. Handle both paths for rename records..github/scripts/take-screenshots.mjs#L33-L41: use NUL-delimited porcelain output and preserve each path without trimming or slicing quoted text.
📍 Affects 2 files
.github/workflows/auto-docs.yml#L70-L84(this comment).github/scripts/take-screenshots.mjs#L33-L41
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/auto-docs.yml around lines 70 - 84, Parse Git status
output as NUL-delimited records in both affected sites: update
.github/workflows/auto-docs.yml lines 70-84 to use porcelain v1 with -z, a
NUL-safe loop, and inspect both source and destination paths for renames; update
.github/scripts/take-screenshots.mjs lines 33-41 to use the same NUL-delimited
output and preserve each path exactly without trimming or slicing quoted text.
| - name: Set up Node | ||
| if: steps.guardrail.outputs.skip == 'false' | ||
| uses: actions/setup-node@v3 | ||
| with: | ||
| node-version: 18 | ||
| cache: yarn |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
npx --yes actionlint .github/workflows/auto-docs.ymlRepository: glific/docs
Length of output: 626
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files .github/workflows || true
echo "== target workflow relevant lines =="
if [ -f .github/workflows/auto-docs.yml ]; then
nl -ba .github/workflows/auto-docs.yml | sed -n '90,120p'
fi
echo "== all setup-node actions in workflows =="
rg -n 'uses:\s*actions/setup-node@' .github/workflows || true
echo "== available binaries/tools =="
command -v actionlint || true
command -v npx || true
npm config get registry || trueRepository: glific/docs
Length of output: 412
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== target workflow lines with line numbers =="
python3 - <<'PY'
from pathlib import Path
path = Path('.github/workflows/auto-docs.yml')
for idx, line in enumerate(path.read_text().splitlines(), 1):
if 90 <= idx <= 120:
print(f"{idx:4}: {line}")
PY
echo "== all setup-node action pins =="
python3 - <<'PY'
from pathlib import Path
for path in Path('.github/workflows').glob('*'):
text = path.read_text(errors='replace')
for line in text.splitlines():
if 'uses:' in line and 'actions/setup-node@' in line:
print(f"{path}:{line.strip()}")
PY
echo "== actionlint availability =="
command -v actionlint || true
command -v npx || true
echo "== actionlint from npm if installed globally in prefix =="
for bin in /usr/local/opt/ruby/bin/actionlint \
/usr/local/bin/actionlint \
/usr/bin/actionlint \
~/.npm-g-global/bin/actionlint; do
[ -x "$bin" ] && echo "$bin exists and is executable" || true
doneRepository: glific/docs
Length of output: 1889
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== actionlint workflow report =="
/usr/bin/actionlint .github/workflows/auto-docs.yml || true
echo "== actionlint version =="
/usr/bin/actionlint --version || true
echo "== actionlint setup-node failure scan across workflows =="
/usr/bin/actionlint .github/workflows || trueRepository: glific/docs
Length of output: 702
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== all actionlint action runner warnings =="
python3 - <<'PY'
import subprocess, pathlib
for path in pathlib.Path('.github/workflows').glob('*'):
result = subprocess.run(['/usr/bin/actionlint', str(path)], text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
if result.returncode != 0:
for line in (result.stdout + result.stderr).splitlines():
if 'runner' in line and 'too old' in line:
print(line)
PY
echo "== GitHub actions/setup-node v4 branch existence =="
curl -fsSLI -o /dev/null https://github.com/actions/setup-node/tree/v4 || trueRepository: glific/docs
Length of output: 1841
🌐 Web query:
actions/setup-node v4 branch GitHub releases
💡 Result:
The actions/setup-node repository manages its releases using Git tags, and v4 is a specific major version series within that history [1][2]. Key details regarding v4 and the repository's release structure: 1. Versioning: The action uses Semantic Versioning (SemVer) with tags like v4.0.0, v4.0.4, and v4.4.0 [3][4][5]. Each major version (e.g., v4, v5, v6, v7) represents a distinct branch or evolution of the action, often involving updates to the underlying Node.js runtime for the action itself [3][6][7][8]. 2. Current Status: As of August 7, 2026, the current major version is v7 [6][8]. The v4 series is no longer the latest [1][6]. 3. GitHub Releases: All releases, including the v4 series, are documented on the official GitHub Releases page for the repository [1]. Each tag corresponds to a specific release state, allowing users to pin their workflows to specific versions (e.g., actions/setup-node@v4 or actions/setup-node@v4.4.0) to ensure stability [1][5][8]. For users looking to reference v4 specifically in their workflows, using the tag actions/setup-node@v4 will generally point to the latest minor/patch release within that major version [1][5]. However, it is recommended to check the releases page for the specific requirements and features associated with newer major versions like v7 [1][6][8].
Citations:
- 1: https://github.com/actions/setup-node/releases
- 2: https://github.com/actions/setup-node/tree/v4.0.0
- 3: https://github.com/actions/setup-node/releases/tag/v4.0.0
- 4: https://github.com/actions/setup-node/releases/tag/v4.0.4
- 5: https://github.com/actions/setup-node/releases/tag/v4.4.0
- 6: https://github.com/actions/setup-node/releases/tag/v7.0.0
- 7: https://github.com/actions/setup-node/tree/refs/heads/main
- 8: https://github.com/actions/setup-node?tab=readme-ov-file
Upgrade actions/setup-node to a supported version.
actionlint reports that actions/setup-node@v3 uses a runner that GitHub Actions no longer supports, so this Node dependency setup can fail before yarn install. Update the pin to actions/setup-node@v4 or a newer supported release and revalidate the workflow.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 107-107: the runner of "actions/setup-node@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue
(action)
🪛 zizmor (1.29.0)
[error] 107-107: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/auto-docs.yml around lines 105 - 110, Update the
setup-node action version in the “Set up Node” workflow step from v3 to
actions/setup-node@v4 or another newer supported release, while preserving its
existing condition and yarn cache configuration.
Source: Linters/SAST tools
363faef to
aa96a0a
Compare
1 participant
…tation updates
Summary by CodeRabbit
New Features
Documentation
Chores