fix(pkgdown): Fix url to the MSstatsPTM github page#128
Merged
tonywu1999 merged 3 commits intodevelfrom Apr 9, 2026
Merged
Conversation
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow and a pkgdown configuration to build the pkgdown site on pushes/PRs (and manual dispatch) targeting Changes
Sequence Diagram(s)sequenceDiagram
rect rgba(220,240,255,0.5)
participant GitHub as GitHub (push/PR/dispatch)
end
rect rgba(200,255,220,0.5)
participant Actions as GitHub Actions Workflow
end
rect rgba(255,245,200,0.5)
participant Runner as Runner (ubuntu-latest)
end
rect rgba(255,220,230,0.5)
participant Pages as GitHub Pages (gh-pages)
end
GitHub->>Actions: trigger workflow
Actions->>Runner: start job (pkgdown)
Runner->>Runner: checkout repo
Runner->>Runner: install Pandoc
Runner->>Runner: setup R + install deps (including pkgdown, local::.)
Runner->>Runner: build pkgdown site (docs/)
Runner->>Pages: deploy `docs` to `gh-pages` (via deploy action)
Pages-->>GitHub: site updated
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/pkgdown.yaml:
- Around line 25-45: The workflow pins GitHub Actions to mutable tags; replace
each `uses:` entry's version tag with the corresponding 40-character commit SHA
to harden supply-chain integrity: update `actions/checkout@v4`,
`r-lib/actions/setup-pandoc@v2`, `r-lib/actions/setup-r@v2`,
`r-lib/actions/setup-r-dependencies@v2`, and
`JamesIves/github-pages-deploy-action@v4.5.0` to their full commit SHAs (locate
the exact `uses:` lines in the file and swap the `@<tag>` suffix for
`@<full-commit-sha>`). Ensure you verify the correct SHA from each action's
GitHub repository and commit the updated workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: c6ea6e2b-715b-449e-8b02-117b9cabab09
📒 Files selected for processing (2)
.github/workflows/pkgdown.yaml_pkgdown.yml
Comment on lines
+25
to
+45
| - uses: actions/checkout@v4 | ||
|
|
||
| - uses: r-lib/actions/setup-pandoc@v2 | ||
|
|
||
| - uses: r-lib/actions/setup-r@v2 | ||
| with: | ||
| use-public-rspm: true | ||
|
|
||
| - uses: r-lib/actions/setup-r-dependencies@v2 | ||
| with: | ||
| extra-packages: any::pkgdown, local::. | ||
| needs: website | ||
|
|
||
| - name: Build site | ||
| run: pkgdown::build_site_github_pages(new_process = FALSE, install = FALSE) | ||
| shell: Rscript {0} | ||
|
|
||
| - name: Deploy to GitHub pages 🚀 | ||
| if: github.event_name != 'pull_request' | ||
| uses: JamesIves/github-pages-deploy-action@v4.5.0 | ||
| with: |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify workflow actions that are not pinned to full commit SHAs.
# Expected: no output after hardening.
rg -nP '^\s*-\s*uses:\s*[^@\s]+@(?!(?:[0-9a-f]{40})\s*$).+' .github/workflowsRepository: Vitek-Lab/MSstatsPTM
Length of output: 368
🏁 Script executed:
cat -n .github/workflows/pkgdown.yamlRepository: Vitek-Lab/MSstatsPTM
Length of output: 1676
Pin all GitHub Actions to immutable commit SHAs.
All five uses: statements in this workflow (lines 25, 27, 29, 33, and 44) are pinned to mutable version tags (@v4, @v2, @v4.5.0) rather than full commit SHAs. This weakens supply-chain integrity by allowing tag reassignment attacks. Replace each tag with its corresponding 40-character commit SHA:
actions/checkout@v4→actions/checkout@<SHA>r-lib/actions/setup-pandoc@v2→r-lib/actions/setup-pandoc@<SHA>r-lib/actions/setup-r@v2→r-lib/actions/setup-r@<SHA>r-lib/actions/setup-r-dependencies@v2→r-lib/actions/setup-r-dependencies@<SHA>JamesIves/github-pages-deploy-action@v4.5.0→JamesIves/github-pages-deploy-action@<SHA>
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/pkgdown.yaml around lines 25 - 45, The workflow pins
GitHub Actions to mutable tags; replace each `uses:` entry's version tag with
the corresponding 40-character commit SHA to harden supply-chain integrity:
update `actions/checkout@v4`, `r-lib/actions/setup-pandoc@v2`,
`r-lib/actions/setup-r@v2`, `r-lib/actions/setup-r-dependencies@v2`, and
`JamesIves/github-pages-deploy-action@v4.5.0` to their full commit SHAs (locate
the exact `uses:` lines in the file and swap the `@<tag>` suffix for
`@<full-commit-sha>`). Ensure you verify the correct SHA from each action's
GitHub repository and commit the updated workflow.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation and Context
The repository's pkgdown configuration URL pointed incorrectly; there was also no automated workflow to build and publish the pkgdown site. This PR fixes the pkgdown site URL and adds a GitHub Actions workflow to build the site and (when appropriate) deploy it to GitHub Pages so the project's documentation is built automatically and hosted at the correct URL.
Solution summary
Detailed Changes
.github/workflows/pkgdown.yamldevel, pull requests targetingdevel, and manual dispatch.ubuntu-latest.pkgdownand the local package with thewebsitecomponent.pkgdown::build_site_github_pages(new_process = FALSE, install = FALSE).docstogh-pagesusingJamesIves/github-pages-deploy-action; deployment is skipped on pull requests.secrets.GITHUB_TOKENfor the PAT environment variable._pkgdown.ymlhttps://vitek-lab.github.io/MSstatsPTM/.5.Unit Tests