docs: use centralized sensitive file check script by nilanjan-sikdar · Pull Request #1120 · PalisadoesFoundation/talawa-docs

nilanjan-sikdar · 2026-02-07T20:34:05Z

What kind of change does this PR introduce?

Decoupling Configuration from YAML Workflows

Issue Number:

Fixes #1119

Did you add tests for your changes?

No

Snapshots/Videos:

If relevant, did you update the documentation?

Summary

Refactored the Check-Sensitive-Files job in .github/workflows/pull-request.yml to utilize the centralized Python script from the PalisadoesFoundation/.github repository Moved the sensitive file regex patterns into a new configuration file at .github/workflows/config/sensitive_files.txt for better maintainability and centralization

Does this PR introduce a breaking change?

No

Other information

Have you read the contributing guide?

Yes

Summary by CodeRabbit

Chores
- CI/CD workflow now pulls shared pipeline scripts from a central location to streamline maintenance.
- Replaced many shell-based pattern checks with a Python-driven sensitive-file validator invoked only when files changed and still skippable via PR label.
- Added a curated configuration of sensitive filename patterns used by the validator.
- Workflow now prepares a Python environment and exits early when there are no relevant changes.

coderabbitai · 2026-02-07T20:34:21Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

Walkthrough

Adds .github/workflows/config/sensitive_files.txt containing seven sensitive-file regex patterns and updates .github/workflows/pull-request.yml to checkout centralized CI scripts, set up Python, compute changed files via git diff --name-only, and invoke sensitive_file_check.py with the new config (file ends without a trailing newline).

Changes

Cohort / File(s)	Summary
Sensitive Files Configuration `.github/workflows/config/sensitive_files.txt`	Adds new config file listing seven sensitive-file regex patterns (`^\.github/`, `^package\.json$`, `^sidebars\.js$`, `^docusaurus\.config\.js$`, `^babel\.config\.js$`, `^CODEOWNERS$`, `^LICENSE$`). File ends with no newline.
Workflow Refactor — Sensitive File Check `.github/workflows/pull-request.yml`	Replaces inline Bash sensitive-file detection with: checkout of centralized CI scripts, Python setup (`setup-python@v5`), compute `ALL_CHANGED_FILES` via `git diff --name-only`, and call `sensitive_file_check.py` with the new config and changed files. Retains PR-label gating and early exits when no base/head or no changed files.

Sequence Diagram(s)

sequenceDiagram
  participant PR as Pull Request
  participant Runner as GitHub Actions Runner
  participant Repo as Repository
  participant Central as .github-central
  participant Py as sensitive_file_check.py

  PR->>Runner: trigger pull-request workflow
  Runner->>Repo: checkout repository
  Runner->>Central: checkout centralized CI scripts into `.github-central`
  Runner->>Runner: setup Python environment
  Runner->>Runner: compute ALL_CHANGED_FILES (git diff --name-only)
  alt ALL_CHANGED_FILES non-empty
    Runner->>Py: run with config `.github/workflows/config/sensitive_files.txt` and changed files
    Py->>Py: read regex config, match patterns against changed files
    Py-->>Runner: return exit code/report (matches found or none)
    Runner-->>PR: step pass/fail based on script result
  else no changed files
    Runner-->>PR: skip sensitive-file check
  end

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR partially addresses issue `#1119` requirements. Configuration file is added (sensitive_files.txt) and workflow is refactored, but the required Python script under .github/workflows/scripts is not present in the provided changes.	Add the Python script at .github/workflows/scripts/sensitive_file_check.py that implements argparse-based file checking and integrates with the workflow as required by issue `#1119`.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: using a centralized sensitive file check script instead of inline patterns.
Description check	✅ Passed	The description follows the template, provides issue reference (`#1119`), explains the refactoring approach, and indicates no breaking changes or tests were added.
Out of Scope Changes check	✅ Passed	All changes are within scope: configuration file addition and workflow refactoring align with issue `#1119` objectives to decouple configuration from YAML workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 5

🤖 Fix all issues with AI agents

In @.github/workflows/config/sensitive_files.txt:
- Around line 55-57: The sensitive-files config currently flags all Markdown and
text files via the patterns "\.md$", "\.txt$", and "\.TXT$", which causes false
positives for this docs repo; remove those three patterns from
.github/workflows/config/sensitive_files.txt or replace them with specific
filename anchors (for example use "^README\.md$" or other exact paths) so only
truly sensitive documentation files are protected.
- Around line 42-47: The regex patterns like ".*.pem$", ".*.key$", ".*.cert$",
".*.password$", ".*.secret$", and ".*.credentials$" are ambiguous because the
dot is unescaped; decide whether you intend to match all files with those
extensions or only dot-prefixed hidden files, then update each pattern
accordingly — for all files replace ".*.ext$" with ".*\.ext$" (e.g.,
".*\.pem$"), or for only dot-prefixed files use "^\..*\.ext$" (e.g.,
"^\..*\.pem$") and apply the same change to the other listed patterns.
- Around line 5-6: Remove application-specific patterns that don't exist in this
Docusaurus docs repo: delete the entries `vitest.config.js$` and `src/App.tsx$`
and audit the rest of .github/workflows/config/sensitive_files.txt to keep only
files relevant to this project (e.g., retain pnpm-lock.yaml, Docusaurus config
files, and eslint.config.mjs if present) and remove Python, Vite, Docker, Yarn,
package-lock.json, .node-version, schema.graphql, index.html, and other
non-applicable patterns; ensure the final list matches actual repository files
so the sensitive list reflects real artifacts.

In @.github/workflows/pull-request.yml:
- Around line 136-137: Replace the direct execution of the script with an
explicit Python interpreter call: stop relying on chmod +x and shebangs for
.github-central/.github/workflows/scripts/sensitive_file_check.py and instead
invoke it via python3 (or python) with the same arguments and the
"${ALL_CHANGED_FILES[@]}" array; update the workflow step that currently runs
the script directly to call the interpreter so execution is robust across
runners and file-permission states.
- Around line 86-91: The workflow currently checks out the centralized CI/CD
repo with "repository: PalisadoesFoundation/.github" and "ref: main", which is a
supply-chain risk; update the checkout step to pin "ref" to a specific commit
SHA or an explicit release tag (instead of "main") so the action always uses a
known good commit — locate the checkout step that uses "actions/checkout@v4" and
replace the ref value with the chosen commit SHA or tag, and consider
documenting the chosen SHA/tag in the workflow or repository README for future
updates.

.github/workflows/config/sensitive_files.txt