Merged
Conversation
dosubot
bot
added
the
size:XXL
📝 WalkthroughWalkthroughAdds an automated sponsor synchronization flow: a TypeScript script that fetches sponsor JSON, generates a typed sponsors module, replaces Sponsors sections across READMEs, a scheduled / dispatchable GitHub Actions workflow to run the sync and commit updates, and a small package script; also removes a few legacy redirects and replaces sponsor badges with multi-tier galleries. Changes
Sequence Diagram(s)sequenceDiagram
participant Scheduler as GitHub Actions Scheduler
participant Workflow as Sponsors Sync Workflow
participant Runner as CI Runner
participant Script as sync-sponsor.ts
participant Remote as Sponsor JSON API
participant Repo as Git Repo
participant GitHub as GitHub (commit)
Scheduler->>Workflow: trigger (cron / workflow_dispatch)
Workflow->>Runner: start job (checkout, setup pnpm)
Runner->>Script: run `sponsors:sync`
Script->>Remote: fetch sponsor JSON
Remote-->>Script: sponsor data
Script->>Script: generate `apps/content/.vitepress/theme/sponsors.ts`
Script->>Script: render/update README Sponsors sections
Script->>Repo: write changes
Runner->>GitHub: commit & push changes (EndBug/add-and-commit, GITHUB_TOKEN)
GitHub-->>Repo: branch updated
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly improves the management and display of sponsor information by automating the synchronization process. It transitions from a static SVG-based approach to a dynamic system that generates detailed sponsor listings across multiple Highlights
Changelog
Ignored Files
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
More templates
@orpc/ai-sdk
@orpc/arktype
@orpc/client
@orpc/contract
@orpc/experimental-durable-iterator
@orpc/hey-api
@orpc/interop
@orpc/json-schema
@orpc/nest
@orpc/openapi
@orpc/openapi-client
@orpc/otel
@orpc/experimental-pino
@orpc/experimental-publisher
@orpc/experimental-publisher-durable-object
@orpc/experimental-ratelimit
@orpc/react
@orpc/react-query
@orpc/experimental-react-swr
@orpc/server
@orpc/shared
@orpc/solid-query
@orpc/standard-server
@orpc/standard-server-aws-lambda
@orpc/standard-server-fastify
@orpc/standard-server-fetch
@orpc/standard-server-node
@orpc/standard-server-peer
@orpc/svelte-query
@orpc/tanstack-query
@orpc/trpc
@orpc/valibot
@orpc/vue-colada
@orpc/vue-query
@orpc/zod
commit: |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request automates the synchronization of sponsor information across the repository. It introduces a script to generate a sponsors.ts file with sponsor data and updates all README.md files to display a detailed list of sponsors. While this automation is a great step for maintainability, I have a couple of suggestions to further improve the clarity of the generated data and reduce code duplication in the documentation files.
| amount: number | ||
| link: string | ||
| org: boolean | ||
| createdAt?: string |
Contributor
There was a problem hiding this comment.
The property name createdAt is misleading. Based on the data, it seems to represent the sponsorship expiration date (e.g., '2026-03-15T14:00:10Z'). I recommend renaming it to expiresAt to more accurately reflect its purpose. This will improve code clarity and prevent potential confusion for future developers.
Suggested change
| createdAt?: string | |
| expiresAt?: string |
README.md
Outdated
Comment on lines
+203
to
+299
| If you find oRPC valuable and would like to support its development, you can do so here: [GitHub Sponsors](https://github.com/sponsors/dinwwwh). | ||
|
|
||
| ### 🏆 Platinum Sponsor | ||
|
|
||
| <table> | ||
| <tr> | ||
| <td align="center"><a href="https://screenshotone.com/?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="ScreenshotOne.com"><img src="https://avatars.githubusercontent.com/u/97035603?v=4" width="130" alt="ScreenshotOne.com"/><br />ScreenshotOne.com</a></td> | ||
| </tr> | ||
| </table> | ||
|
|
||
| ### 🥇 Gold Sponsor | ||
|
|
||
| <table> | ||
| <tr> | ||
| <td align="center"><a href="https://zuplo.com/?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Zuplo"><img src="https://avatars.githubusercontent.com/u/85497839?v=4" width="115" alt="Zuplo"/><br />Zuplo</a></td> | ||
| </tr> | ||
| </table> | ||
|
|
||
| ### 🥈 Silver Sponsor | ||
|
|
||
| <table> | ||
| <tr> | ||
| <td align="center"><a href="https://misskey.io/?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="村上さん"><img src="https://avatars.githubusercontent.com/u/37681609?u=0dd4c7e4ba937cbb52b068c55914b1d8164dc0c7&v=4" width="100" alt="村上さん"/><br />村上さん</a></td> | ||
| <td align="center"><a href="https://valerii15298.github.io/?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Valerii Petryniak"><img src="https://avatars.githubusercontent.com/u/44531564?u=88ac74d9bacd20401518441907acad21063cd397&v=4" width="100" alt="Valerii Petryniak"/><br />Valerii Petryniak</a></td> | ||
| <td align="center"><a href="https://github.com/christ12938?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="christ12938"><img src="https://avatars.githubusercontent.com/u/25758598?v=4" width="100" alt="christ12938"/><br />christ12938</a></td> | ||
| </tr> | ||
| </table> | ||
|
|
||
| ### Generous Sponsors | ||
|
|
||
| <table> | ||
| <tr> | ||
| <td align="center"><a href="https://github.com/ln-markets?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="LN Markets"><img src="https://avatars.githubusercontent.com/u/70597625?v=4" width="88" alt="LN Markets"/><br />LN Markets</a></td> | ||
| </tr> | ||
| </table> | ||
|
|
||
| ### Sponsors | ||
|
|
||
| <table> | ||
| <tr> | ||
| <td align="center"><a href="https://github.com/hrmcdonald?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Reece McDonald"><img src="https://avatars.githubusercontent.com/u/39349270?v=4" width="76" alt="Reece McDonald"/><br />Reece McDonald</a></td> | ||
| <td align="center"><a href="https://github.com/Scrumplex?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Sefa Eyeoglu"><img src="https://avatars.githubusercontent.com/u/11587657?u=ab503582165c0bbff0cca47ce31c9450bb1553c9&v=4" width="76" alt="Sefa Eyeoglu"/><br />Sefa Eyeoglu</a></td> | ||
| <td align="center"><a href="https://github.com/u1-liquid?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="あわわわとーにゅ"><img src="https://avatars.githubusercontent.com/u/17376330?u=de3353804be889f009f7e0a1582daf04d0ab292d&v=4" width="76" alt="あわわわとーにゅ"/><br />あわわわとーにゅ</a></td> | ||
| <td align="center"><a href="https://github.com/nicognaW?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="nk"><img src="https://avatars.githubusercontent.com/u/66731869?u=4699bda3a9092d3ec34fbd959450767bcc8b8b6d&v=4" width="76" alt="nk"/><br />nk</a></td> | ||
| <td align="center"><a href="https://github.com/supastarter?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="supastarter"><img src="https://avatars.githubusercontent.com/u/110960143?v=4" width="76" alt="supastarter"/><br />supastarter</a></td> | ||
| <td align="center"><a href="https://github.com/divmgl?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Dexter Miguel"><img src="https://avatars.githubusercontent.com/u/5452298?u=645993204be8696c085ecf0d228c3062efe2ed65&v=4" width="76" alt="Dexter Miguel"/><br />Dexter Miguel</a></td> | ||
| </tr> | ||
| <tr> | ||
| <td align="center"><a href="https://github.com/herrfugbaum?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="herrfugbaum"><img src="https://avatars.githubusercontent.com/u/12859776?u=644dc1666d0220bc0468eb0de3c56b919f635b16&v=4" width="76" alt="herrfugbaum"/><br />herrfugbaum</a></td> | ||
| <td align="center"><a href="https://github.com/ryota-murakami?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Ryota Murakami"><img src="https://avatars.githubusercontent.com/u/5501268?u=599389e03340734325726ca3f8f423c021d47d7f&v=4" width="76" alt="Ryota Murakami"/><br />Ryota Murakami</a></td> | ||
| <td align="center"><a href="https://github.com/dcramer?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="David Cramer"><img src="https://avatars.githubusercontent.com/u/23610?v=4" width="76" alt="David Cramer"/><br />David Cramer</a></td> | ||
| <td align="center"><a href="https://github.com/happyboy2022?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="happyboy"><img src="https://avatars.githubusercontent.com/u/103669586?u=65b49c4b893ed3703909fbb3a7a22313f3f9c121&v=4" width="76" alt="happyboy"/><br />happyboy</a></td> | ||
| <td align="center"><a href="https://github.com/letstri?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Valerii Strilets"><img src="https://avatars.githubusercontent.com/u/13253748?u=c7b10399ccc8f8081e24db94ec32cd9858e86ac3&v=4" width="76" alt="Valerii Strilets"/><br />Valerii Strilets</a></td> | ||
| <td align="center"><a href="https://github.com/K-Mistele?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Kyle Mistele"><img src="https://avatars.githubusercontent.com/u/18430555?u=3afebeb81de666e35aaac3ed46f14159d7603ffb&v=4" width="76" alt="Kyle Mistele"/><br />Kyle Mistele</a></td> | ||
| </tr> | ||
| <tr> | ||
| <td align="center"><a href="https://github.com/andrewpeters9?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Andrew Peters"><img src="https://avatars.githubusercontent.com/u/36251325?v=4" width="76" alt="Andrew Peters"/><br />Andrew Peters</a></td> | ||
| <td align="center"><a href="https://github.com/R44VC0RP?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Ryan Vogel"><img src="https://avatars.githubusercontent.com/u/89211796?u=1857347b9787d8d8a7ea5bfc333f96be92d5a683&v=4" width="76" alt="Ryan Vogel"/><br />Ryan Vogel</a></td> | ||
| <td align="center"><a href="https://github.com/peter-adam-dy?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Peter Adam"><img src="https://avatars.githubusercontent.com/u/132129459?u=4f3dbbb3b443990b56acb7d6a5d11ed2c555f6db&v=4" width="76" alt="Peter Adam"/><br />Peter Adam</a></td> | ||
| <td align="center"><a href="https://github.com/yukimotochern?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Chen, Zhi-Yuan"><img src="https://avatars.githubusercontent.com/u/20896173?u=945c33fc21725e4d566a0d02afc54b136ca1d67a&v=4" width="76" alt="Chen, Zhi-Yuan"/><br />Chen, Zhi-Yuan</a></td> | ||
| <td align="center"><a href="https://github.com/Ryanjso?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Ryan Soderberg"><img src="https://avatars.githubusercontent.com/u/39172778?u=5ed913c31d57e7221b75784abcad48c7ebddde27&v=4" width="76" alt="Ryan Soderberg"/><br />Ryan Soderberg</a></td> | ||
| </tr> | ||
| </table> | ||
|
|
||
| ### Backers | ||
|
|
||
| <table> | ||
| <tr> | ||
| <td align="center"><a href="https://github.com/rhinodavid?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="David Walsh"><img src="https://avatars.githubusercontent.com/u/5778036?u=b5521f07d2f88c3db2a0dae62b5f2f8357214af0&v=4" width="54" alt="David Walsh"/><br />David Walsh</a></td> | ||
| <td align="center"><a href="https://github.com/Robbe95?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Robbe Vaes"><img src="https://avatars.githubusercontent.com/u/44748019?u=e0232402c045ad4eac7cbd217f1f47e083103b89&v=4" width="54" alt="Robbe Vaes"/><br />Robbe Vaes</a></td> | ||
| <td align="center"><a href="https://github.com/aidansunbury?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Aidan Sunbury"><img src="https://avatars.githubusercontent.com/u/64103161?v=4" width="54" alt="Aidan Sunbury"/><br />Aidan Sunbury</a></td> | ||
| <td align="center"><a href="https://github.com/soonoo?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="soonoo"><img src="https://avatars.githubusercontent.com/u/5436405?u=5d0b4aa955c87e30e6bda7f0cccae5402da99528&v=4" width="54" alt="soonoo"/><br />soonoo</a></td> | ||
| <td align="center"><a href="https://github.com/kporten?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Kevin Porten"><img src="https://avatars.githubusercontent.com/u/1839345?u=dc2263d5cfe0d927ce1a0be04a1d55dd6b55405c&v=4" width="54" alt="Kevin Porten"/><br />Kevin Porten</a></td> | ||
| <td align="center"><a href="https://github.com/pumpkinlink?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Denis"><img src="https://avatars.githubusercontent.com/u/11864620?u=5f47bbe6c65d0f6f5cf011021490238e4b0593d0&v=4" width="54" alt="Denis"/><br />Denis</a></td> | ||
| </tr> | ||
| <tr> | ||
| <td align="center"><a href="https://github.com/christopher-kapic?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Christopher Kapic"><img src="https://avatars.githubusercontent.com/u/59740769?v=4" width="54" alt="Christopher Kapic"/><br />Christopher Kapic</a></td> | ||
| <td align="center"><a href="https://github.com/thomasballinger?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Tom Ballinger"><img src="https://avatars.githubusercontent.com/u/458879?u=4b045ac75d721b6ac2b42a74d7d37f61f0414031&v=4" width="54" alt="Tom Ballinger"/><br />Tom Ballinger</a></td> | ||
| <td align="center"><a href="https://github.com/SSam0419?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Sam"><img src="https://avatars.githubusercontent.com/u/102863520?u=3c89611f549d5070be232eb4532f690c8f2e7a65&v=4" width="54" alt="Sam"/><br />Sam</a></td> | ||
| <td align="center"><a href="https://github.com/Titoine?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Titoine"><img src="https://avatars.githubusercontent.com/u/3514286?u=1bb1e86b0c99c8a1121372e56d51a177eea12191&v=4" width="54" alt="Titoine"/><br />Titoine</a></td> | ||
| <td align="center"><a href="https://github.com/Mnigos?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Igor Makowski"><img src="https://avatars.githubusercontent.com/u/56691628?u=ee8c879478f7c151b9156aef6c74243fa3e247a8&v=4" width="54" alt="Igor Makowski"/><br />Igor Makowski</a></td> | ||
| <td align="center"><a href="https://github.com/steelbrain?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Anees Iqbal"><img src="https://avatars.githubusercontent.com/u/4278113?u=22b80b5399eed68ac76cd58b02961b0481f1db11&v=4" width="54" alt="Anees Iqbal"/><br />Anees Iqbal</a></td> | ||
| </tr> | ||
| <tr> | ||
| <td align="center"><a href="https://github.com/piscis?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Alex"><img src="https://avatars.githubusercontent.com/u/326163?u=b245f368bd940cf51d08c0b6bf55f8257f359437&v=4" width="54" alt="Alex"/><br />Alex</a></td> | ||
| </tr> | ||
| </table> | ||
|
|
||
| ### Past Sponsors | ||
|
|
||
| <p> | ||
| <a href="https://github.com/MrMaxie?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Maxie"><img src="https://avatars.githubusercontent.com/u/3857836?u=5e6b57973d4385d655663ffdd836e487856f2984&v=4" width="32" height="32" style="border-radius: 50%;" alt="Maxie" /></a> | ||
| <a href="https://github.com/Stijn-Timmer?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Stijn Timmer"><img src="https://avatars.githubusercontent.com/u/100147665?u=106b2c18e9c98a61861b4ee7fc100f5b9906a6c9&v=4" width="32" height="32" style="border-radius: 50%;" alt="Stijn Timmer" /></a> | ||
| <a href="https://github.com/motopods?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="motopods"><img src="https://avatars.githubusercontent.com/u/58200641?u=18833983d65b481ae90a4adec2373064ec58bcf3&v=4" width="32" height="32" style="border-radius: 50%;" alt="motopods" /></a> | ||
| <a href="https://github.com/franciscohermida?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Francisco Hermida"><img src="https://avatars.githubusercontent.com/u/483242?u=bbcbc80eb9d8781ff401f7dafc3b59cd7bea0561&v=4" width="32" height="32" style="border-radius: 50%;" alt="Francisco Hermida" /></a> | ||
| <a href="https://github.com/theoludwig?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Théo LUDWIG"><img src="https://avatars.githubusercontent.com/u/25207499?u=a6a9653725a2f574c07893748806668e0598cdbe&v=4" width="32" height="32" style="border-radius: 50%;" alt="Théo LUDWIG" /></a> | ||
| <a href="https://github.com/abhay-ramesh?ref=orpc" target="_blank" rel="sponsored noopener noreferrer" title="Abhay Ramesh"><img src="https://avatars.githubusercontent.com/u/66196314?u=c5c2b0327b26606c2efcfaf17046ab18c3d25c57&v=4" width="32" height="32" style="border-radius: 50%;" alt="Abhay Ramesh" /></a> |
Contributor
There was a problem hiding this comment.
While it's great to give sponsors more visibility, this large block of HTML is now duplicated across many README files in the repository. This makes the files noisy and harder to maintain, even with automation.
Consider generating a central SPONSORS.md file and linking to it from each README. You could still feature top-tier sponsors in the main READMEs to give them prominent visibility, but keep the full list in one place. This would make the individual READMEs much cleaner.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds an automated sponsors synchronization pipeline that fetches canonical sponsor data and updates README sponsor sections (and the website sponsors data file) on a schedule.
Changes:
- Introduces
scripts/sync-sponsor.tsto fetch sponsors JSON, regenerate the “## Sponsors” sections across README files, and emit a website sponsors TS data file. - Rewrites sponsor sections in multiple package READMEs and the root README from an embedded SVG approach to explicit sponsor lists with tracking links.
- Adds a scheduled GitHub Actions workflow plus a
pnpm sponsors:syncscript to run the sync and commit updates back tomain.
Reviewed changes
Copilot reviewed 53 out of 53 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/sync-sponsor.ts | New sync script: fetches sponsor data, regenerates README sponsor sections, and writes the website sponsors data file. |
| package.json | Adds sponsors:sync script to run the sync and format outputs via ESLint. |
| .github/workflows/sponsors-sync.yaml | Adds scheduled workflow to run the sync daily and commit changes. |
| apps/content/public/_redirects | Removes redirect rules previously used for legacy docs routes and /sponsor. |
| README.md | Replaces the sponsors SVG embed with generated sponsor tiers/links. |
| packages/zod/README.md | Same sponsors section replacement. |
| packages/vue-query/README.md | Same sponsors section replacement. |
| packages/vue-colada/README.md | Same sponsors section replacement. |
| packages/svelte-query/README.md | Same sponsors section replacement. |
| packages/solid-query/README.md | Same sponsors section replacement. |
| packages/server/README.md | Same sponsors section replacement. |
| packages/react/README.md | Same sponsors section replacement. |
| packages/react-query/README.md | Same sponsors section replacement. |
| packages/otel/README.md | Same sponsors section replacement. |
| packages/nest/README.md | Same sponsors section replacement. |
| packages/contract/README.md | Same sponsors section replacement. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+48
to
+54
| function withTracking(url: string): string { | ||
| const tracked = new URL(url) | ||
|
|
||
| tracked.searchParams.set('ref', 'orpc') | ||
|
|
||
| return tracked.toString() | ||
| } |
package.json
Outdated
| "sherif:fix": "pnpm run sherif --fix", | ||
| "knip": "knip --production", | ||
| "knip:fix": "pnpm run knip --fix --allow-remove-files", | ||
| "sponsors:sync": "node --experimental-strip-types scripts/sync-sponsor.ts && eslint --max-warnings=0 --fix README.md **/README.md apps/content/.vitepress/theme/sponsors.ts", |
|
|
||
| - run: pnpm i | ||
|
|
||
| - run: pnpm sponsors:sync |
scripts/sync-sponsor.ts
Outdated
Comment on lines
+100
to
+111
| const tierLevels = [...groupedSponsors.keys()] | ||
|
|
||
| for (const tierLevel of tierLevels) { | ||
| const tierSponsors = groupedSponsors.get(tierLevel) | ||
|
|
||
| if (!tierSponsors || tierSponsors.length === 0) { | ||
| continue | ||
| } | ||
|
|
||
| const tierTitle = tierSponsors[0]?.tierTitle ?? `Tier ${tierLevel}` | ||
| const imageSize = getTierImageSize(tierLevel, tierLevels) | ||
| const columns = 6 |
Comment on lines
+234
to
+237
|
|
||
| if (!response.ok) { | ||
| throw new Error(`Failed to fetch sponsors data: ${response.status} ${response.statusText}`) | ||
| } |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
packages/client/README.md (1)
95-189: Add generated-content markers to prevent manual drift.Given this is auto-synced content, consider wrapping the block with explicit markers (for example,
<!-- sponsors:start -->/<!-- sponsors:end -->) so future updates stay deterministic and conflicts are easier to resolve.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/client/README.md` around lines 95 - 189, The sponsors block in packages/client/README.md (the section starting at the "🏆 Platinum Sponsor" / "Sponsors" headings) is auto-synced and should be wrapped with deterministic generated-content markers to avoid manual drift; add explicit HTML comments such as <!-- sponsors:start --> before the start of the sponsor list and <!-- sponsors:end --> after the end, and update any sync scripts or CI that regenerate this content to only replace the content between those markers (refer to the "🏆 Platinum Sponsor" / "Sponsors" block to locate the exact insertion points).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/sponsors-sync.yaml:
- Line 24: The sync script currently writes upstream data without validating it;
in scripts/sync-sponsor.ts after parsing the response into the sponsors array
(e.g., const sponsors = await response.json() as Sponsor[] inside the function
that fetches sponsors or main), add a guard that throws an Error and aborts
before any file-write/commit when sponsors.length === 0 (so the write/commit
logic such as writeSponsors(), updateReadmes(), or any Git commit step is not
reached); ensure the thrown error causes the process to exit non-zero so the
.github/workflows/sponsors-sync.yaml run (pnpm sponsors:sync) fails instead of
committing an empty sponsors payload.
In `@apps/content/.vitepress/theme/sponsors.ts`:
- Around line 5-17: The schema rename removed the backward-compatible fields
used by consumers and breaks sidebar sponsor logic; restore compatibility by
adding aliases or mappings so the old properties (rightSidebarSize,
rightSidebarLink, rightSidebarLogo) remain available while using the new names
(sidebarSize, sidebarLogo), or update the consumer component AsideSponsors.vue
to read sidebarSize and sidebarLogo (and derive the link from link/tier if
needed). Locate the JSONSponsor interface and ensure it exposes the old property
names (as optional getters/aliases or keep them in the serialized shape) or
update the consumer code that references
rightSidebarSize/rightSidebarLink/rightSidebarLogo to use
sidebarSize/sidebarLogo (and link) consistently.
---
Nitpick comments:
In `@packages/client/README.md`:
- Around line 95-189: The sponsors block in packages/client/README.md (the
section starting at the "🏆 Platinum Sponsor" / "Sponsors" headings) is
auto-synced and should be wrapped with deterministic generated-content markers
to avoid manual drift; add explicit HTML comments such as <!-- sponsors:start
--> before the start of the sponsor list and <!-- sponsors:end --> after the
end, and update any sync scripts or CI that regenerate this content to only
replace the content between those markers (refer to the "🏆 Platinum Sponsor" /
"Sponsors" block to locate the exact insertion points).
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 797bce99-6100-4a28-8c96-d1cefb274ba9
📒 Files selected for processing (53)
.github/workflows/sponsors-sync.yamlREADME.mdapps/content/.vitepress/theme/sponsors.tsapps/content/public/_redirectspackage.jsonpackages/ai-sdk/README.mdpackages/arktype/README.mdpackages/client/README.mdpackages/contract/README.mdpackages/durable-iterator/README.mdpackages/hey-api/README.mdpackages/interop/README.mdpackages/json-schema/README.mdpackages/nest/README.mdpackages/openapi-client/README.mdpackages/openapi/README.mdpackages/otel/README.mdpackages/pino/README.mdpackages/publisher-durable-object/README.mdpackages/publisher/README.mdpackages/ratelimit/README.mdpackages/react-query/README.mdpackages/react-swr/README.mdpackages/react/README.mdpackages/server/README.mdpackages/shared/README.mdpackages/solid-query/README.mdpackages/standard-server-aws-lambda/README.mdpackages/standard-server-fastify/README.mdpackages/standard-server-fetch/README.mdpackages/standard-server-node/README.mdpackages/standard-server-peer/README.mdpackages/standard-server/README.mdpackages/svelte-query/README.mdpackages/tanstack-query/README.mdpackages/trpc/README.mdpackages/valibot/README.mdpackages/vue-colada/README.mdpackages/vue-query/README.mdpackages/zod/README.mdplaygrounds/astro/README.mdplaygrounds/browser-extension/README.mdplaygrounds/bun-websocket-otel/README.mdplaygrounds/cloudflare-worker/README.mdplaygrounds/contract-first/README.mdplaygrounds/electron/README.mdplaygrounds/nest/README.mdplaygrounds/next/README.mdplaygrounds/nuxt/README.mdplaygrounds/solid-start/README.mdplaygrounds/svelte-kit/README.mdplaygrounds/tanstack-start/README.mdscripts/sync-sponsor.ts
💤 Files with no reviewable changes (1)
- apps/content/public/_redirects
|
|
||
| - run: pnpm i | ||
|
|
||
| - run: pnpm sponsors:sync |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the sync script's handling of sponsors data
cat scripts/sync-sponsor.ts | head -250Repository: middleapi/orpc
Length of output: 7445
Add safeguard for empty sponsors data before committing changes.
The scripts/sync-sponsor.ts script fetches from the upstream source and immediately writes sponsor data without validating if the sponsors array is empty. If the upstream source returns an empty array due to an API issue or misconfiguration, this workflow will commit changes that overwrite all sponsor sections in 28+ README files with just the header and call-to-action text, effectively removing all sponsor visibility.
Add validation in the sync script to abort if the sponsors array is unexpectedly empty:
const sponsors = await response.json() as Sponsor[]
if (sponsors.length === 0) {
throw new Error('Sponsors array is empty - aborting to prevent accidental data loss')
}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/sponsors-sync.yaml at line 24, The sync script currently
writes upstream data without validating it; in scripts/sync-sponsor.ts after
parsing the response into the sponsors array (e.g., const sponsors = await
response.json() as Sponsor[] inside the function that fetches sponsors or main),
add a guard that throws an Error and aborts before any file-write/commit when
sponsors.length === 0 (so the write/commit logic such as writeSponsors(),
updateReadmes(), or any Git commit step is not reached); ensure the thrown error
causes the process to exit non-zero so the .github/workflows/sponsors-sync.yaml
run (pnpm sponsors:sync) fails instead of committing an empty sponsors payload.
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
packages/ratelimit/README.md (1)
73-189: LGTM! Systematic sponsor gallery implementation looks great.The auto-generated multi-tier sponsor gallery is well-structured with consistent formatting, proper link attributes, and appropriate image sizing across all tiers. The automation approach via the sync script is sound.
💡 Optional consideration for README focus
While the sponsor gallery looks great, consider whether all package-level READMEs need the complete gallery. An alternative approach could be to show top-tier sponsors only and link to a central sponsors page, keeping individual package READMEs more focused on their specific functionality. However, this is purely optional since the current approach provides good visibility for all sponsor tiers.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/ratelimit/README.md` around lines 73 - 189, Reviewer approved the sponsor gallery but suggested optionally simplifying package READMEs by showing only top-tier sponsors and linking to a central sponsors page; update packages/ratelimit/README.md by keeping the "🏆 Platinum Sponsor" and "🥇 Gold Sponsor" sections (remove or collapse "🥈 Silver Sponsor", "Generous Sponsors", "Sponsors", "Backers", "Past Sponsors") and add a clear link labeled (e.g., "Full sponsor list") to the central sponsors page, or alternatively implement a collapsible/details block for lower tiers using the existing section headings to keep the README focused on package content.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@scripts/sync-sponsor.ts`:
- Around line 65-74: The image sizing depends on the order of the tierLevels
array (derived from Map keys), so ensure tierLevels is sorted by numeric tier
value in descending order before calculating rank in getTierImageSize; change
the code that builds/passes tierLevels (or sort inside getTierImageSize) to
perform a numeric sort like tierLevels.sort((a,b)=>b-a) so higher tiers map to
larger sizes consistently when getTierImageSize uses findIndex and sizesByRank.
- Around line 173-224: The generated file uses sidebarSize/sidebarLogo but the
site expects rightSidebarSize/rightSidebarLogo and a rightSidebarLink field; in
buildWebsiteSponsorsFileContent map normalizedSponsors to use rightSidebarSize
(from sponsor.sidebarSize with same validation), rightSidebarLogo (from
sponsor.sidebarLogo or sponsor.avatar), and add rightSidebarLink (prefer
sponsor.sidebarLink if present else sponsor.link) instead of the current
sidebar* names, and update the exported JSONSponsor interface in the generated
string to declare rightSidebarSize: 'normal' | 'small' | 'none',
rightSidebarLink?: string, and rightSidebarLogo: string so the consuming
composable AsideSponsors.vue and composables/sponsors.ts receive the expected
field names.
---
Nitpick comments:
In `@packages/ratelimit/README.md`:
- Around line 73-189: Reviewer approved the sponsor gallery but suggested
optionally simplifying package READMEs by showing only top-tier sponsors and
linking to a central sponsors page; update packages/ratelimit/README.md by
keeping the "🏆 Platinum Sponsor" and "🥇 Gold Sponsor" sections (remove or
collapse "🥈 Silver Sponsor", "Generous Sponsors", "Sponsors", "Backers", "Past
Sponsors") and add a clear link labeled (e.g., "Full sponsor list") to the
central sponsors page, or alternatively implement a collapsible/details block
for lower tiers using the existing section headings to keep the README focused
on package content.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 3ff7800d-f610-4793-9e42-3721cd5a98fe
📒 Files selected for processing (49)
README.mdpackages/ai-sdk/README.mdpackages/arktype/README.mdpackages/client/README.mdpackages/contract/README.mdpackages/durable-iterator/README.mdpackages/hey-api/README.mdpackages/interop/README.mdpackages/json-schema/README.mdpackages/nest/README.mdpackages/openapi-client/README.mdpackages/openapi/README.mdpackages/otel/README.mdpackages/pino/README.mdpackages/publisher-durable-object/README.mdpackages/publisher/README.mdpackages/ratelimit/README.mdpackages/react-query/README.mdpackages/react-swr/README.mdpackages/react/README.mdpackages/server/README.mdpackages/shared/README.mdpackages/solid-query/README.mdpackages/standard-server-aws-lambda/README.mdpackages/standard-server-fastify/README.mdpackages/standard-server-fetch/README.mdpackages/standard-server-node/README.mdpackages/standard-server-peer/README.mdpackages/standard-server/README.mdpackages/svelte-query/README.mdpackages/tanstack-query/README.mdpackages/trpc/README.mdpackages/valibot/README.mdpackages/vue-colada/README.mdpackages/vue-query/README.mdpackages/zod/README.mdplaygrounds/astro/README.mdplaygrounds/browser-extension/README.mdplaygrounds/bun-websocket-otel/README.mdplaygrounds/cloudflare-worker/README.mdplaygrounds/contract-first/README.mdplaygrounds/electron/README.mdplaygrounds/nest/README.mdplaygrounds/next/README.mdplaygrounds/nuxt/README.mdplaygrounds/solid-start/README.mdplaygrounds/svelte-kit/README.mdplaygrounds/tanstack-start/README.mdscripts/sync-sponsor.ts
✅ Files skipped from review due to trivial changes (2)
- packages/json-schema/README.md
- packages/arktype/README.md
🚧 Files skipped from review as they are similar to previous changes (14)
- packages/client/README.md
- packages/publisher-durable-object/README.md
- playgrounds/browser-extension/README.md
- packages/interop/README.md
- playgrounds/svelte-kit/README.md
- packages/otel/README.md
- playgrounds/bun-websocket-otel/README.md
- packages/nest/README.md
- packages/valibot/README.md
- playgrounds/solid-start/README.md
- packages/tanstack-query/README.md
- playgrounds/electron/README.md
- packages/standard-server-fetch/README.md
- packages/openapi/README.md
Comment on lines
+173
to
+224
| function buildWebsiteSponsorsFileContent(sponsors: Sponsor[]): string { | ||
| const normalizedSponsors = sponsors.map((sponsor) => { | ||
| const createdAt = typeof sponsor.createdAt === 'string' && sponsor.createdAt.length > 0 | ||
| ? sponsor.createdAt | ||
| : undefined | ||
|
|
||
| const sidebarSize = sponsor.sidebarSize === 'normal' || sponsor.sidebarSize === 'small' || sponsor.sidebarSize === 'none' | ||
| ? sponsor.sidebarSize | ||
| : 'none' | ||
|
|
||
| const sidebarLogo = typeof sponsor.sidebarLogo === 'string' && sponsor.sidebarLogo.length > 0 | ||
| ? sponsor.sidebarLogo | ||
| : sponsor.avatar | ||
|
|
||
| return { | ||
| name: sponsor.name, | ||
| login: sponsor.login, | ||
| avatar: sponsor.avatar, | ||
| amount: sponsor.amount, | ||
| link: sponsor.link, | ||
| org: sponsor.org, | ||
| ...(createdAt ? { createdAt } : {}), | ||
| tierTitle: sponsor.tierTitle, | ||
| tierLevel: sponsor.tierLevel, | ||
| sidebarSize, | ||
| sidebarLogo, | ||
| } | ||
| }) | ||
| // eslint-disable-next-line ban/ban | ||
| const sponsorsJson = JSON.stringify(normalizedSponsors, null, 2) | ||
|
|
||
| return `// This file is auto-generated by scripts/sync-sponsor.ts. Do not edit manually. | ||
|
|
||
| export type SidebarPlacementSize = 'normal' | 'small' | 'none' | ||
|
|
||
| export interface JSONSponsor { | ||
| name: string | null | ||
| login: string | ||
| avatar: string | ||
| amount: number | ||
| link: string | ||
| org: boolean | ||
| createdAt?: string | ||
| tierTitle: string | ||
| tierLevel: number | ||
| sidebarSize: SidebarPlacementSize | ||
| sidebarLogo: string | ||
| } | ||
|
|
||
| export const sponsors: JSONSponsor[] = ${sponsorsJson} | ||
| ` | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify field names used in AsideSponsors component and sponsors composable
echo "=== Fields accessed in AsideSponsors.vue ==="
rg -n 'rightSidebar' apps/content/.vitepress/theme/components/AsideSponsors.vue
echo ""
echo "=== Interface in composables/sponsors.ts ==="
rg -n -A 10 'interface JSONSponsor' apps/content/.vitepress/theme/composables/sponsors.tsRepository: middleapi/orpc
Length of output: 1029
Critical: Field names don't match consuming component expectations.
The generated sponsors.ts exports fields sidebarSize and sidebarLogo, but the consuming component (AsideSponsors.vue) and composable (composables/sponsors.ts) expect:
rightSidebarSize(notsidebarSize)rightSidebarLink(this field is missing entirely)rightSidebarLogo(notsidebarLogo)
The composable interface at apps/content/.vitepress/theme/composables/sponsors.ts defines:
export interface JSONSponsor {
rightSidebarSize: 'normal' | 'small' | 'none'
rightSidebarLink?: string
rightSidebarLogo: string
// ...
}The component filters sponsors using s.rightSidebarSize and renders using sponsor.rightSidebarLink and sponsor.rightSidebarLogo. With the current field names, sidebar sponsors will not display.
Proposed fix: Align field names with existing interface
return {
name: sponsor.name,
login: sponsor.login,
avatar: sponsor.avatar,
amount: sponsor.amount,
link: sponsor.link,
org: sponsor.org,
...(createdAt ? { createdAt } : {}),
tierTitle: sponsor.tierTitle,
tierLevel: sponsor.tierLevel,
- sidebarSize,
- sidebarLogo,
+ rightSidebarSize: sidebarSize,
+ rightSidebarLink: sponsor.link,
+ rightSidebarLogo: sidebarLogo,
}Also update the interface in the generated file:
export interface JSONSponsor {
name: string | null
login: string
avatar: string
amount: number
link: string
org: boolean
createdAt?: string
tierTitle: string
tierLevel: number
- sidebarSize: SidebarPlacementSize
- sidebarLogo: string
+ rightSidebarSize: SidebarPlacementSize
+ rightSidebarLink: string
+ rightSidebarLogo: string
}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@scripts/sync-sponsor.ts` around lines 173 - 224, The generated file uses
sidebarSize/sidebarLogo but the site expects rightSidebarSize/rightSidebarLogo
and a rightSidebarLink field; in buildWebsiteSponsorsFileContent map
normalizedSponsors to use rightSidebarSize (from sponsor.sidebarSize with same
validation), rightSidebarLogo (from sponsor.sidebarLogo or sponsor.avatar), and
add rightSidebarLink (prefer sponsor.sidebarLink if present else sponsor.link)
instead of the current sidebar* names, and update the exported JSONSponsor
interface in the generated string to declare rightSidebarSize: 'normal' |
'small' | 'none', rightSidebarLink?: string, and rightSidebarLogo: string so the
consuming composable AsideSponsors.vue and composables/sponsors.ts receive the
expected field names.
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.github/workflows/sponsors-sync.yaml (1)
24-24:⚠️ Potential issue | 🟠 MajorBlock empty sponsor payloads before write/commit.
At Line 24,
pnpm sponsors:synccan still propagate an empty upstream payload becausescripts/sync-sponsor.tsparses sponsors and proceeds to write without an explicitsponsors.length === 0guard.🔧 Proposed fix in
scripts/sync-sponsor.tsconst sponsors = await response.json() as Sponsor[] +if (sponsors.length === 0) { + throw new Error('Sponsors array is empty - aborting to prevent accidental data loss') +} await writeWebsiteSponsorsFile(sponsors)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/sponsors-sync.yaml at line 24, The CI step invoking "pnpm sponsors:sync" can write an empty payload because scripts/sync-sponsor.ts does not guard against zero-length results; update scripts/sync-sponsor.ts to check the parsed sponsors array (e.g., the variable returned by parseSponsors or getSponsors) and if sponsors.length === 0 either abort with a non-zero exit (process.exit(1)) or skip the write/commit path and log a clear warning, ensuring the writeSponsors/saveSponsors code path is only executed when the array has at least one entry.
🧹 Nitpick comments (2)
README.md (1)
203-319: Consider collapsing the long sponsor gallery for readability.
The expanded section is accurate, but it makes the root README significantly harder to scan. A<details>wrapper for “Backers”/“Past Sponsors” (or linking to a central sponsors page) would keep discoverability while reducing noise.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@README.md` around lines 203 - 319, The sponsor galleries (notably the "Backers" and "Past Sponsors" sections) make README.md hard to scan; wrap those long tables in collapsible <details> blocks (e.g., around the "Backers" and "Past Sponsors" headings and their following <table> or <p> content) or replace them with a short link to a separate sponsors page so the README shows only a brief summary and a "Show more" expander/link for full lists.scripts/sync-sponsor.ts (1)
240-248: Consider adding basic JSON structure validation.The
as Sponsor[]type assertion trusts the upstream JSON completely. While the source is controlled, a malformed response could cause cryptic errors downstream.💡 Optional: Add minimal validation
const sponsors = await response.json() as Sponsor[] + + if (!Array.isArray(sponsors)) { + throw new Error('Expected sponsors data to be an array') + } + await writeWebsiteSponsorsFile(sponsors)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@scripts/sync-sponsor.ts` around lines 240 - 248, In main(), don't blindly trust the upstream JSON or use a raw "as Sponsor[]"; after fetching and before calling writeWebsiteSponsorsFile, parse and perform minimal validation: ensure the parsed value is an array (Array.isArray) and that each element contains the required Sponsor properties (e.g., id/name/tier/website or whatever fields the Sponsor type defines) with correct primitive types; if validation fails, throw a clear Error including SPONSORS_SOURCE_URL and the offending structure so failures are actionable; keep identifiers Sponsor, main, SPONSORS_SOURCE_URL, and writeWebsiteSponsorsFile in your check so the change is easy to locate and maintain.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/sponsors-sync.yaml:
- Line 14: The workflow pins third-party actions using mutable tags (e.g.,
actions/checkout@v4 and two other actions pinned as `@v9`); replace those tag pins
with the corresponding immutable commit SHAs for each action reference (locate
the action usages like actions/checkout@v4 and the two `@v9` entries) by finding
the exact release commit SHA on the action's GitHub repository and update the
workflow to use e.g., actions/checkout@<full-commit-sha> (repeat for each
actions/*@v9 entry) so all three action uses are referenced by their full commit
SHAs.
---
Duplicate comments:
In @.github/workflows/sponsors-sync.yaml:
- Line 24: The CI step invoking "pnpm sponsors:sync" can write an empty payload
because scripts/sync-sponsor.ts does not guard against zero-length results;
update scripts/sync-sponsor.ts to check the parsed sponsors array (e.g., the
variable returned by parseSponsors or getSponsors) and if sponsors.length === 0
either abort with a non-zero exit (process.exit(1)) or skip the write/commit
path and log a clear warning, ensuring the writeSponsors/saveSponsors code path
is only executed when the array has at least one entry.
---
Nitpick comments:
In `@README.md`:
- Around line 203-319: The sponsor galleries (notably the "Backers" and "Past
Sponsors" sections) make README.md hard to scan; wrap those long tables in
collapsible <details> blocks (e.g., around the "Backers" and "Past Sponsors"
headings and their following <table> or <p> content) or replace them with a
short link to a separate sponsors page so the README shows only a brief summary
and a "Show more" expander/link for full lists.
In `@scripts/sync-sponsor.ts`:
- Around line 240-248: In main(), don't blindly trust the upstream JSON or use a
raw "as Sponsor[]"; after fetching and before calling writeWebsiteSponsorsFile,
parse and perform minimal validation: ensure the parsed value is an array
(Array.isArray) and that each element contains the required Sponsor properties
(e.g., id/name/tier/website or whatever fields the Sponsor type defines) with
correct primitive types; if validation fails, throw a clear Error including
SPONSORS_SOURCE_URL and the offending structure so failures are actionable; keep
identifiers Sponsor, main, SPONSORS_SOURCE_URL, and writeWebsiteSponsorsFile in
your check so the change is easy to locate and maintain.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: c073d33a-0de8-4d99-8f57-4645ee111b3b
📒 Files selected for processing (53)
.github/workflows/sponsors-sync.yamlREADME.mdapps/content/.vitepress/theme/components/AsideSponsors.vueapps/content/.vitepress/theme/components/FullSponsors.vueapps/content/.vitepress/theme/composables/sponsors.tspackages/ai-sdk/README.mdpackages/arktype/README.mdpackages/client/README.mdpackages/contract/README.mdpackages/durable-iterator/README.mdpackages/hey-api/README.mdpackages/interop/README.mdpackages/json-schema/README.mdpackages/nest/README.mdpackages/openapi-client/README.mdpackages/openapi/README.mdpackages/otel/README.mdpackages/pino/README.mdpackages/publisher-durable-object/README.mdpackages/publisher/README.mdpackages/ratelimit/README.mdpackages/react-query/README.mdpackages/react-swr/README.mdpackages/react/README.mdpackages/server/README.mdpackages/shared/README.mdpackages/solid-query/README.mdpackages/standard-server-aws-lambda/README.mdpackages/standard-server-fastify/README.mdpackages/standard-server-fetch/README.mdpackages/standard-server-node/README.mdpackages/standard-server-peer/README.mdpackages/standard-server/README.mdpackages/svelte-query/README.mdpackages/tanstack-query/README.mdpackages/trpc/README.mdpackages/valibot/README.mdpackages/vue-colada/README.mdpackages/vue-query/README.mdpackages/zod/README.mdplaygrounds/astro/README.mdplaygrounds/browser-extension/README.mdplaygrounds/bun-websocket-otel/README.mdplaygrounds/cloudflare-worker/README.mdplaygrounds/contract-first/README.mdplaygrounds/electron/README.mdplaygrounds/nest/README.mdplaygrounds/next/README.mdplaygrounds/nuxt/README.mdplaygrounds/solid-start/README.mdplaygrounds/svelte-kit/README.mdplaygrounds/tanstack-start/README.mdscripts/sync-sponsor.ts
💤 Files with no reviewable changes (1)
- apps/content/.vitepress/theme/composables/sponsors.ts
✅ Files skipped from review due to trivial changes (1)
- packages/publisher-durable-object/README.md
🚧 Files skipped from review as they are similar to previous changes (10)
- packages/openapi-client/README.md
- packages/standard-server-aws-lambda/README.md
- playgrounds/nuxt/README.md
- packages/ratelimit/README.md
- packages/vue-colada/README.md
- packages/client/README.md
- packages/solid-query/README.md
- playgrounds/bun-websocket-otel/README.md
- playgrounds/svelte-kit/README.md
- packages/react-swr/README.md
| permissions: | ||
| contents: write | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify workflow actions that are still tag-pinned (non-SHA).
rg -n '^\s*-\s*uses:\s*[^@]+@v[0-9]+' .github/workflows
# Expected after fix: no matchesRepository: middleapi/orpc
Length of output: 1019
Pin GitHub Actions to immutable commit SHAs.
At lines 14, 18, and 26, actions are pinned by major tags (@v4, @v9) instead of full commit SHAs, which weakens workflow supply-chain integrity.
🔒 Suggested hardening
- - uses: actions/checkout@v4
+ - uses: actions/checkout@<full-commit-sha>
- - uses: pnpm/action-setup@v4
+ - uses: pnpm/action-setup@<full-commit-sha>
- - uses: EndBug/add-and-commit@v9
+ - uses: EndBug/add-and-commit@<full-commit-sha>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/sponsors-sync.yaml at line 14, The workflow pins
third-party actions using mutable tags (e.g., actions/checkout@v4 and two other
actions pinned as `@v9`); replace those tag pins with the corresponding immutable
commit SHAs for each action reference (locate the action usages like
actions/checkout@v4 and the two `@v9` entries) by finding the exact release commit
SHA on the action's GitHub repository and update the workflow to use e.g.,
actions/checkout@<full-commit-sha> (repeat for each actions/*@v9 entry) so all
three action uses are referenced by their full commit SHAs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Documentation
Chores