Feat/sp 4479 include oss file info annotation#153
Conversation
|
Warning Review limit reached
More reviews will be available in 14 minutes and 20 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (7)
📝 WalkthroughWalkthroughAdds OSS file-content fetching and inline snippet rendering, updates match comments to show GitHub-hosted file and line links or a registry fallback note, and refreshes tests, docs, changelog, and version metadata. ChangesOSS match comment links and inline source fetching
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 SCANOSS Code Similarity Detected📄 1 snippet matches found 🔗 View detailed findings on commit beb07d5 Files with similarities:
💡 Click the commit link above to see detailed annotations for each match. |
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/utils/github-comment-api.ts`:
- Around line 73-77: The prefix stripping logic at lines 76, 113, and 167
incorrectly uses indexOf('/') which finds the first slash in the string, but
this breaks for components containing slashes like 'owner/repo' or '`@scope/pkg`'.
Instead of searching for the first slash, construct the full expected prefix
pattern (combining match.component, '-', and match.ref) and search for that
complete pattern in the filePath, then extract everything after it. This ensures
the prefix is stripped correctly regardless of whether the component name
contains slashes.
- Line 275: The deduplicationKey construction uses the raw fileMatch.version
without normalization, while displayed versions are normalized elsewhere (line
147), causing semantically identical versions like v1.2.3 and 1.2.3 to generate
different dedup keys and result in duplicate comments. Apply the same version
normalization logic used on line 147 to the fileMatch.version when building the
deduplicationKey to ensure consistent deduplication across different version
formats.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 49a10ac4-9f82-4dce-9393-eaae42721888
⛔ Files ignored due to path filters (2)
dist/index.jsis excluded by!**/dist/**dist/licenses.txtis excluded by!**/dist/**
📒 Files selected for processing (4)
CHANGELOG.mdREADME.mdpackage.jsonsrc/utils/github-comment-api.ts
agustingroh
force-pushed
the
feat/SP-4479-include-OSS-file-info-annotation
branch
from
beb07d5 to
6c5c7e3
Compare
🔍 SCANOSS Code Similarity Detected📄 1 snippet matches found 🔗 View detailed findings on commit 6c5c7e3 Files with similarities:
💡 Click the commit link above to see detailed annotations for each match. |
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/utils/oss-file-contents.ts`:
- Around line 167-171: The fenced block in oss-file-contents.ts can break when
selected contains triple backticks, so update the block construction to use a
dynamic fence that is longer than any backtick run in selected before building
the Markdown string. Keep the existing behavior in the logic around
languageFromPath, selected, and MAX_INLINE_LINES, but compute a safe fence
length from the snippet contents and use it instead of a fixed ``` fence when
assembling block.
- Around line 126-141: The fetch in oss-file-contents should be bounded so a
stalled SCANOSS file_contents request can’t hang indefinitely. Update the
request logic in the snippet around the fetch(url, ...) call to use a native
AbortController timeout, pass its signal into fetch, and ensure the timeout is
cleared in both success and error paths. Keep the existing response/error
handling in place and preserve the current core.debug logging in this helper.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 325eb194-69dc-4b61-a255-c18a301d3e7b
⛔ Files ignored due to path filters (2)
dist/index.jsis excluded by!**/dist/**dist/licenses.txtis excluded by!**/dist/**
📒 Files selected for processing (7)
CHANGELOG.mdREADME.md__tests__/oss-file-contents.test.tspackage.jsonsrc/types/annotations.tssrc/utils/github-comment-api.tssrc/utils/oss-file-contents.ts
✅ Files skipped from review due to trivial changes (2)
- tests/oss-file-contents.test.ts
- package.json
🚧 Files skipped from review as they are similar to previous changes (1)
- src/utils/github-comment-api.ts
| let content: string; | ||
| try { | ||
| const response = await fetch(url, { | ||
| headers: { 'X-Session': inputs.API_KEY } | ||
| }); | ||
|
|
||
| if (!response.ok) { | ||
| core.debug(`OSS file contents request failed for ${snippet.file_hash}: HTTP ${response.status}`); | ||
| return null; | ||
| } | ||
|
|
||
| content = await response.text(); | ||
| } catch (error) { | ||
| core.debug(`OSS file contents request errored for ${snippet.file_hash}: ${error}`); | ||
| return null; | ||
| } |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
fd -H -t f 'package.json|action.yml|action.yaml|.nvmrc|.tool-versions' --max-depth 2 \
--exec sh -c 'echo "== {} =="; cat "{}"'
rg -n '"node"|runs:|using:|node-version' -g 'package.json' -g 'action.y*ml' .Repository: scanoss/gha-code-scan
Length of output: 6955
Add a timeout to the fetch call to prevent indefinite hangs.
The fetch request in src/utils/oss-file-contents.ts lacks a timeout mechanism. A slow or stalled response from the SCANOSS file_contents API will cause the Action to hang indefinitely rather than failing over gracefully.
Since the project targets Node 24, native AbortController support is available and requires no additional dependencies.
🛡️ Proposed fix to bound the request
let content: string;
try {
- const response = await fetch(url, {
- headers: { 'X-Session': inputs.API_KEY }
- });
+ const controller = new AbortController();
+ const timeout = setTimeout(() => controller.abort(), 10_000);
+ let response: Response;
+ try {
+ response = await fetch(url, {
+ headers: { 'X-Session': inputs.API_KEY },
+ signal: controller.signal
+ });
+ } finally {
+ clearTimeout(timeout);
+ }
if (!response.ok) {
core.debug(`OSS file contents request failed for ${snippet.file_hash}: HTTP ${response.status}`);
return null;
}
content = await response.text();
} catch (error) {
core.debug(`OSS file contents request errored for ${snippet.file_hash}: ${error}`);
return null;
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| let content: string; | |
| try { | |
| const response = await fetch(url, { | |
| headers: { 'X-Session': inputs.API_KEY } | |
| }); | |
| if (!response.ok) { | |
| core.debug(`OSS file contents request failed for ${snippet.file_hash}: HTTP ${response.status}`); | |
| return null; | |
| } | |
| content = await response.text(); | |
| } catch (error) { | |
| core.debug(`OSS file contents request errored for ${snippet.file_hash}: ${error}`); | |
| return null; | |
| } | |
| let content: string; | |
| try { | |
| const controller = new AbortController(); | |
| const timeout = setTimeout(() => controller.abort(), 10_000); | |
| let response: Response; | |
| try { | |
| response = await fetch(url, { | |
| headers: { 'X-Session': inputs.API_KEY }, | |
| signal: controller.signal | |
| }); | |
| } finally { | |
| clearTimeout(timeout); | |
| } | |
| if (!response.ok) { | |
| core.debug(`OSS file contents request failed for ${snippet.file_hash}: HTTP ${response.status}`); | |
| return null; | |
| } | |
| content = await response.text(); | |
| } catch (error) { | |
| core.debug(`OSS file contents request errored for ${snippet.file_hash}: ${error}`); | |
| return null; | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@src/utils/oss-file-contents.ts` around lines 126 - 141, The fetch in
oss-file-contents should be bounded so a stalled SCANOSS file_contents request
can’t hang indefinitely. Update the request logic in the snippet around the
fetch(url, ...) call to use a native AbortController timeout, pass its signal
into fetch, and ensure the timeout is cleared in both success and error paths.
Keep the existing response/error handling in place and preserve the current
core.debug logging in this helper.
6c5c7e3 to
aca2cb4
Compare
🔍 SCANOSS Code Similarity Detected📄 1 snippet matches found 🔗 View detailed findings on commit aca2cb4 Files with similarities:
💡 Click the commit link above to see detailed annotations for each match. |
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
agustingroh
force-pushed
the
feat/SP-4479-include-OSS-file-info-annotation
branch
from
aca2cb4 to
1e10df2
Compare
🔍 SCANOSS Code Similarity Detected📄 1 snippet matches found 🔗 View detailed findings on commit 1e10df2 Files with similarities:
💡 Click the commit link above to see detailed annotations for each match. |
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
agustingroh
force-pushed
the
feat/SP-4479-include-OSS-file-info-annotation
branch
from
1e10df2 to
add2970
Compare
🔍 SCANOSS Code Similarity Detected📄 1 snippet matches found 🔗 View detailed findings on commit add2970 Files with similarities:
💡 Click the commit link above to see detailed annotations for each match. |
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
agustingroh
force-pushed
the
feat/SP-4479-include-OSS-file-info-annotation
branch
from
add2970 to
514d799
Compare
🔍 SCANOSS Code Similarity Detected📄 1 snippet matches found 🔗 View detailed findings on commit 514d799 Files with similarities:
💡 Click the commit link above to see detailed annotations for each match. |
SCANOSS SCAN Completed 🚀
View more details on SCANOSS Action Summary |
1 participant
Summary by CodeRabbit