fix(action): support title override for col-axis charts#267
Conversation
📝 WalkthroughWalkthroughThe GitHub Action now accepts an optional ChangesGitHub Action title override
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8)action.ymlTraceback (most recent call last): Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@action.yml`:
- Line 263: Update the argument construction around VIZB_ARGS to pass
inputs.title through the step environment instead of interpolating it into
generated Bash source. Expand the environment variable only at runtime when
appending --title, preserving the existing conditional behavior and safely
handling quotes, command substitutions, backticks, and newlines.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 6a4c2ddb-9c65-45e2-a26b-f93d7f7eac42
📒 Files selected for processing (2)
action.ymldocs/src/content/docs/ci-cd/github-action.mdx
| [ -n "${{ inputs.tag }}" ] && VIZB_ARGS+=(--tag "${{ inputs.tag }}") | ||
| [ -n "${{ inputs.id }}" ] && VIZB_ARGS+=(--id "${{ inputs.id }}") | ||
| [ -n "${{ inputs.name }}" ] && VIZB_ARGS+=(-n "${{ inputs.name }}") | ||
| [ -n "${{ inputs.title }}" ] && VIZB_ARGS+=(--title "${{ inputs.title }}") |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Avoid interpolating inputs.title directly into Bash source.
A title containing ", $(), backticks, or newlines can alter this generated shell command and execute unintended commands. Pass the input through the step environment, then expand the environment variable inside the array.
Proposed fix
env:
INPUT_SELECT: ${{ inputs.select }}
+ INPUT_TITLE: ${{ inputs.title }}
...
- [ -n "${{ inputs.title }}" ] && VIZB_ARGS+=(--title "${{ inputs.title }}")
+ [ -n "$INPUT_TITLE" ] && VIZB_ARGS+=(--title "$INPUT_TITLE")📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| [ -n "${{ inputs.title }}" ] && VIZB_ARGS+=(--title "${{ inputs.title }}") | |
| [ -n "$INPUT_TITLE" ] && VIZB_ARGS+=(--title "$INPUT_TITLE") |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@action.yml` at line 263, Update the argument construction around VIZB_ARGS to
pass inputs.title through the step environment instead of interpolating it into
generated Bash source. Expand the environment variable only at runtime when
appending --title, preserving the existing conditional behavior and safely
handling quotes, command substitutions, backticks, and newlines.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
3 participants
Related Issue
Fixes #237
Related PR #245
Changes
Summary by CodeRabbit
New Features
titleinput to the GitHub Action for overriding the chart title when a single chart is generated.Documentation
titleinput and clarified its distinction from the existingnameinput.