fix: remove @muxunorg by fengmk2 · Pull Request #406 · cnpm/unpkg-white-list

fengmk2 · 2025-08-11T01:38:10Z

was added by #25

close #405

Summary by CodeRabbit

Documentation
- Added a warning clarifying scope whitelisting: scopes must include popular packages (e.g., >10k weekly downloads); new scopes without popular packages won’t be accepted.
Chores
- Updated release automation to use an NPM-focused workflow and simplified secret requirements.
- Tightened allowed scope policy by removing one previously permitted scope.

was added by #25 close #405

coderabbitai · 2025-08-11T01:38:19Z

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

Replaced the GitHub Actions workflow to use npm-release and updated job metadata; updated README with a warning about scope eligibility; removed "@muxunorg" from package.json allowScopes.

Changes

Cohort / File(s)	Summary
CI workflow update `.github/workflows/release.yml`	Switched action to cnpm/github-actions/.github/workflows/npm-release.yml@master; renamed job from "Node.js" to "NPM"; removed NPM_TOKEN secret, retained GIT_TOKEN.
Documentation update `README.md`	Added warning stating requested scopes must already include popular packages (e.g., >10k weekly downloads); no whitelist for newly created scopes without popular packages.
Whitelist scope change `package.json`	Removed "@muxunorg" from allowScopes array; no other changes to exported/public declarations.

Sequence Diagram(s)

(omitted)

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Assessment against linked issues

Objective	Addressed	Explanation
Remove/disable @muxunorg distribution via whitelist changes [#405]	✅
Clarify policy to deter scope abuse in documentation [#405]	✅

Assessment against linked issues: Out-of-scope changes

Code Change	Explanation
Replace release workflow action and job metadata (.github/workflows/release.yml)	The abuse report (#405) pertains to scope misuse; CI release workflow changes are not referenced or required by the issue.

Possibly related PRs

feat: add @shikijs to allowScopes #396: Also edits package.json allowScopes, changing nearby entries; directly related to the same config region.
feat: add @material scope #402: Modifies allowScopes by adding "@Material"; overlaps with the same array touched here.
feat: add @jx3box #325: Adjusts README scope guidance and updates allowScopes; intersects both docs and whitelist areas.

Poem

A whisk of ears, a tap-tap key,
I prune a scope from the whitelist tree.
A note in docs, a gentle nudge,
No sneaky sacks of bits to smudge.
Pip hop, package paths made bright—
Release drum rolls into the night. 🐇✨

✨ Finishing Touches

🧪 Generate unit tests

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch remove-muxunorg-scope

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai generate unit tests to generate unit tests for this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

gemini-code-assist

Summary of Changes

Hello @fengmk2, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

I've addressed an issue by removing the "@muxunorg" scope from the unpkg-white-list's package.json file, which was previously added. This change also includes an update to the README.md to provide clearer guidelines for adding new scopes, ensuring that only popular and legitimate scopes are included to prevent misuse.

Highlights

package.json update: Removed "@muxunorg" from the allowScopes list in package.json.
README.md update: Added a warning note to the README.md clarifying that new scopes must contain popular packages (e.g., >10k weekly downloads) to prevent abuse.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in issue comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments or fill out our survey to provide feedback.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

Copilot

Pull Request Overview

This PR removes the @muxunorg scope from the whitelist and adds documentation warning about scope usage restrictions. The changes also update the GitHub Actions workflow to use the newer npm-release workflow.

Removes @muxunorg from allowScopes whitelist in package.json
Adds warning documentation about scope requirements (popular packages with 10k+ weekly downloads)
Updates GitHub workflow from node-release to npm-release

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
package.json	Removes `@muxunorg` scope from allowScopes array
README.md	Adds warning documentation about scope addition requirements
.github/workflows/release.yml	Updates workflow to use npm-release instead of node-release

README.md

Co-authored-by: Copilot <[email protected]>

gemini-code-assist

Code Review

This pull request correctly removes the @muxunorg scope from the allowScopes list in package.json. Additionally, it introduces a new guideline in README.md for adding new scopes, which helps clarify the contribution process. I have one suggestion to improve the clarity of the new guideline text.

README.md

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

killagu

LGTM

coderabbitai

Actionable comments posted: 1

♻️ Duplicate comments (1)

README.md (1)
39-41: Good: correct alert syntax and clarified anti-abuse guideline

The [!WARNING] block is correct, and the wording clearly sets the threshold (weekly downloads > 10k) and excludes newly created scopes without popular packages.

Optional: link to the tracking rationale (issue #405) to provide context for readers scanning the README.
 > 为避免滥用，申请添加的 scope 必须已包含热门包（如周下载量超过 1 万）。我们不接受为刚创建且无热门包的 scope 添加白名单。
+>
+> 参考讨论：#405

📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between fdc176d and a7fea69.

📒 Files selected for processing (3)

.github/workflows/release.yml (1 hunks)
README.md (1 hunks)
package.json (0 hunks)

💤 Files with no reviewable changes (1)

package.json

.github/workflows/release.yml

[skip ci] ## <small>1.197.1 (2025-08-11)</small> * fix: remove @muxunorg (#406) ([63493c6](63493c6)), closes [#406](#406)

github-actions · 2025-08-11T01:47:32Z

🎉 This PR is included in version 1.197.1 🎉

The release is available on:

Your semantic-release bot 📦🚀

fix: remove @muxunorg

3053825

was added by #25 close #405

fengmk2 requested a review from Copilot August 11, 2025 01:38

gemini-code-assist bot reviewed Aug 11, 2025

View reviewed changes

Copilot AI reviewed Aug 11, 2025

View reviewed changes

README.md Outdated Show resolved Hide resolved

fengmk2 enabled auto-merge August 11, 2025 01:38

Update README.md

66549fd

Co-authored-by: Copilot <[email protected]>

gemini-code-assist bot reviewed Aug 11, 2025

View reviewed changes

README.md Outdated Show resolved Hide resolved

Update README.md

a7fea69

Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>

killagu approved these changes Aug 11, 2025

View reviewed changes

fengmk2 added this pull request to the merge queue Aug 11, 2025

Merged via the queue into master with commit 63493c6 Aug 11, 2025
4 checks passed

fengmk2 deleted the remove-muxunorg-scope branch August 11, 2025 01:46

coderabbitai bot reviewed Aug 11, 2025

View reviewed changes

.github/workflows/release.yml Show resolved Hide resolved

fengmk2 pushed a commit that referenced this pull request Aug 11, 2025

Release 1.197.1

e28fdf0

[skip ci] ## <small>1.197.1 (2025-08-11)</small> * fix: remove @muxunorg (#406) ([63493c6](63493c6)), closes [#406](#406)

github-actions bot added the released label Aug 11, 2025

coderabbitai bot mentioned this pull request Oct 25, 2025

feat: add '@swup' and remove 'swup' #419

Merged

coderabbitai bot mentioned this pull request Dec 13, 2025

fix: remove @iyawoqu scope #428

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: remove @muxunorg#406

fix: remove @muxunorg#406
fengmk2 merged 3 commits intomasterfrom
remove-muxunorg-scope

fengmk2 commented Aug 11, 2025 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Aug 11, 2025 •

edited

Loading

Other AI code review bot(s) detected

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (`.coderabbit.yaml`)

Documentation and Community

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

Uh oh!

killagu left a comment

Uh oh!

Uh oh!

coderabbitai bot left a comment

Uh oh!

Uh oh!

github-actions bot commented Aug 11, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

fengmk2 commented Aug 11, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai bot commented Aug 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Other AI code review bot(s) detected

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Assessment against linked issues

Assessment against linked issues: Out-of-scope changes

Possibly related PRs

Poem

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Summary of Changes

Highlights

Footnotes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

killagu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Aug 11, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

fengmk2 commented Aug 11, 2025 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Aug 11, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)