docs: add widget screenshots#6
Conversation
📝 WalkthroughWalkthroughThe PR adds a new "Widget Screenshots" section to the README, updates several GitHub Action versions in two workflows, and removes green rest-progress overlay rectangles from workout SVG templates. ChangesRepository updates
🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
Comment |
Beta npm buildMaintainers can publish this PR to npm for fast testing. Comment The workflow will:
Security note: beta publish is only enabled for branches inside this repository. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr_beta_prompt.yml:
- Line 21: The workflow uses mutable action tags; replace the two occurrences
"actions/setup-node@v6.4.0" and "actions/github-script@v9.0.0" with their
corresponding full 40-character commit SHAs (pin to the specific commit) so the
workflow no longer uses mutable tags; locate the strings
"actions/setup-node@v6.4.0" and "actions/github-script@v9.0.0" in the file and
update each `uses:` entry to the exact commit SHA for that action release.
In @.github/workflows/pr_beta_publish.yml:
- Line 32: Replace all mutable GitHub Action tag refs with immutable SHA-pinned
refs: locate each uses: entry such as uses: actions/github-script@v9.0.0 (and
the other occurrences flagged) and change the tag to the corresponding full
commit SHA for that action (e.g., actions/github-script@<full-commit-sha>);
obtain the correct commit SHAs from the action's repository (GitHub UI or git
ls-remote) and update each uses: line so every third-party action is pinned to a
40-character commit SHA.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 1c588799-1521-4c50-abca-5061618cae43
📒 Files selected for processing (3)
.github/workflows/pr_beta_prompt.yml.github/workflows/pr_beta_publish.ymlsrc/helpers/workout.ts
💤 Files with no reviewable changes (1)
- src/helpers/workout.ts
| steps: | ||
| - name: Setup Node.js | ||
| uses: actions/setup-node@v6 | ||
| uses: actions/setup-node@v6.4.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify all workflow `uses:` refs are SHA-pinned.
# Expected result: no matches.
rg -nP '^\s*uses:\s*[^@\s]+@(?![0-9a-f]{40}\b).+$' .github/workflows/*.ymlRepository: Cap-go/capacitor-widget-kit
Length of output: 2087
Pin actions/* workflow uses to commit SHAs (still mutable in this workflow).
.github/workflows/pr_beta_prompt.yml uses mutable tags:
actions/setup-node@v6.4.0actions/github-script@v9.0.0
Pin both to full 40-char commit SHAs to satisfy the unpinned-uses policy.
🧰 Tools
🪛 zizmor (1.25.2)
[error] 21-21: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr_beta_prompt.yml at line 21, The workflow uses mutable
action tags; replace the two occurrences "actions/setup-node@v6.4.0" and
"actions/github-script@v9.0.0" with their corresponding full 40-character commit
SHAs (pin to the specific commit) so the workflow no longer uses mutable tags;
locate the strings "actions/setup-node@v6.4.0" and
"actions/github-script@v9.0.0" in the file and update each `uses:` entry to the
exact commit SHA for that action release.
| - name: Resolve PR and access checks | ||
| id: pr | ||
| uses: actions/github-script@v8 | ||
| uses: actions/github-script@v9.0.0 |
There was a problem hiding this comment.
All updated third-party actions must be SHA-pinned.
Lines 32, 110, 157, 164, 198, 215, and 276 use mutable tag refs. This violates the enforced unpinned-uses policy and weakens supply-chain integrity for a publish-capable workflow.
🔧 Example patch pattern
- uses: actions/github-script@v9.0.0
+ uses: actions/github-script@<40-char-commit-sha> # v9.0.0
- uses: actions/checkout@v6.0.2
+ uses: actions/checkout@<40-char-commit-sha> # v6.0.2
- - uses: oven-sh/setup-bun@v2.2.0
+ - uses: oven-sh/setup-bun@<40-char-commit-sha> # v2.2.0
- uses: actions/setup-node@v6.4.0
+ uses: actions/setup-node@<40-char-commit-sha> # v6.4.0#!/bin/bash
set -euo pipefail
# Verify all workflow `uses:` refs are SHA-pinned.
# Expected result: no matches.
rg -nP '^\s*uses:\s*[^@\s]+@(?![0-9a-f]{40}\b).+$' .github/workflows/*.ymlAlso applies to: 110-110, 157-157, 164-164, 198-198, 215-215, 276-276
🧰 Tools
🪛 zizmor (1.25.2)
[error] 32-32: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr_beta_publish.yml at line 32, Replace all mutable GitHub
Action tag refs with immutable SHA-pinned refs: locate each uses: entry such as
uses: actions/github-script@v9.0.0 (and the other occurrences flagged) and
change the tag to the corresponding full commit SHA for that action (e.g.,
actions/github-script@<full-commit-sha>); obtain the correct commit SHAs from
the action's repository (GitHub UI or git ls-remote) and update each uses: line
so every third-party action is pinned to a 40-character commit SHA.
1 participant
Summary\n- Add README screenshots for iOS Home Screen / SpringBoard widgets\n- Add README screenshots for Lock Screen / Live Activity and Dynamic Island surfaces\n- Add README screenshot for Android AppWidget\n\n## Validation\n- bun run build\n- bun run lint\n- xmllint --noout docs/screenshots/*.svg
Summary by CodeRabbit
Documentation
Bug Fixes
Chores