Conversation
Owner
Hmmm I will have to look into setting this up... |
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved security, CI permission, reproducibility, packaging, and release-integrity findings remain.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR automates versioning, generated-file updates, CI builds, tagging, and npm releases while excluding internal files from distributions.
Changes:
- Adds automated version synchronization and release hooks.
- Updates build commands, documentation, and generated metadata.
- Adds CI and release workflows.
- Configures package and archive exclusions.
File summaries
| File | Summary and review findings |
|---|---|
scripts/bump-coffee-version.js |
Synchronizes package and CoffeeScript versions. |
README.md |
Documents automated versioning. |
package.json |
Adds release configuration. Moderate (1 vote): git add -A may stage unrelated files; stage only intended release files. |
jquery.pretty-text-diff.js |
Updates generated metadata. |
Cakefile |
Fixes the UglifyJS output option. |
.github/workflows/release.yml |
Builds and publishes tagged releases. Critical (1 vote): job-scoped npm credentials are exposed during install/build. Moderate (1 vote): rebuilt artifacts may differ from tagged files. Moderate (3 votes): build tools are not pinned. |
.github/workflows/ci.yml |
Builds and commits generated artifacts. Moderate (2 votes): push commits lack explicit write permissions. Moderate (2 votes): build tools are unpinned. Moderate (1 vote): commit logic also runs on detached tag pushes. |
.gitattributes |
Excludes internal files from archives. Moderate (1 vote): trailing-slash patterns are not recursive. |
Review details
Suppressed comments (4)
.gitattributes:2
- Trailing-slash directory patterns are not recursive in
.gitattributes, so these entries do not applyexport-ignoreto the contents of.githuborscripts. Those internal files can still be included ingit archivesource tarballs; use recursive patterns such aspath/**instead.
.github/ export-ignore
scripts/ export-ignore
.github/workflows/ci.yml:36
- This condition is also true for tag pushes, including the
vX.Y.Ztag created bynpm version. A tag checkout is detached, so if the rebuild changes an artifact,git-auto-commit-actionwill try to commit/push from the tag and can fail; restrict this step to branch pushes.
if: github.event_name == 'push'
.github/workflows/release.yml:28
- This rebuilds the tag checkout and then publishes the working tree, but the only post-build check compares version strings. If generated output differs from the tagged files, npm will publish artifacts that are not represented by the tag; fail when the distributable files change or publish only the checked-in artifacts.
- name: Build (cake build)
run: cake build
package.json:34
git add -Astages every modified and untracked path during npm's version hook, so unrelated internal files can be included in the release commit and tag. Stage onlypackage.jsonand the generated/versioned project files instead.
"version": "node scripts/bump-coffee-version.js && cake build && git add -A"
- Files reviewed: 8/8 changed files
- Comments generated: 4
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

This would further streamline the process, as taxpayers would not need to manually modify the files containing the versions.
package.json,jquery.pretty-text-diff.*),It supports:
npm version patch: bug fixes (1.0.4→1.0.5)npm version minor: new backward-compatible features (1.0.4→1.1.0)npm version major: breaking changes (1.0.4→2.0.0)for
npm publish:secrets.NPM_TOKENis necessarybug fixed: uglifyjs
--o(double--) doesn't work anymore, it must be-oor--output