chore: update CI/CD pipeline, add PR template, and improve documentation - #50
Merged
khulnasoft-bot merged 1 commit intoDec 3, 2025
Merged
Conversation
Reviewer's GuideUpdates CI/CD workflow to a more structured multi-Node.js matrix pipeline, adds a standardized pull request template, and refreshes documentation and tests to be more robust and future-proof. Sequence diagram for CI pipeline execution on pull requestsequenceDiagram
actor Developer
participant GitHubRepo
participant GitHubActions
participant TestJob
Developer->>GitHubRepo: Open pull request to main or master
GitHubRepo-->>GitHubActions: Trigger pull_request event
GitHubActions->>GitHubActions: Match CI_CDPipeline workflow
GitHubActions->>TestJob: Start matrix job for Node 12_x, 14_x, 16_x
TestJob->>TestJob: actions_checkout_v2
TestJob->>TestJob: actions_setup_node_v2 with cache npm
TestJob->>TestJob: khulnasoft_codetypo_actions
TestJob->>TestJob: npm ci
TestJob->>TestJob: npm run lint
TestJob->>TestJob: npm test
TestJob->>TestJob: npm run build --if-present
TestJob-->>GitHubActions: Report job status for all Node versions
GitHubActions-->>GitHubRepo: Update PR checks status
GitHubRepo-->>Developer: Display CI results on pull request
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Contributor
|
Caution Review failedThe pull request is closed. WalkthroughThese changes establish CI/CD infrastructure and documentation standards: introducing a GitHub pull request template, updating the CI workflow to support multiple Node.js versions with npm caching and explicit test/build steps, documenting development and testing procedures in the README, and updating test fixtures with current version expectations. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes
Poem
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (5)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
PR Compliance Guide 🔍Below is a summary of compliance checks for this PR:
Compliance status legend🟢 - Fully Compliant🟡 - Partial Compliant 🔴 - Not Compliant ⚪ - Requires Further Human Verification 🏷️ - Compliance label |
||||||||||||||||||||||||
Contributor
|
Note Unit test generation is an Early Access feature. Expect some limitations and changes as we gather feedback and continue to improve it. Generating unit tests... This may take up to 20 minutes. |
Contributor
|
Caution The CodeRabbit agent failed during execution: Clone operation failed |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey there - I've reviewed your changes - here's some feedback:
- The CI matrix is still targeting Node.js 12.x/14.x/16.x, which are EOL; consider updating the workflow to test against currently supported LTS versions (e.g., 18.x and 20.x) to better match real-world usage.
- The new CI triggers only on push/pull_request to main/master and a weekly schedule, whereas the previous workflow also reacted to create/delete/issue_comment events; verify whether any of those older triggers are still needed for your workflow and reintroduce them if so.
- The updated Azure webhook test now uses
new Date(Date.now() + 365 * 24 * 60 * 60 * 1000)at module load time; if test determinism is important, consider injecting a fixed future date or using a helper to freeze time instead of relying on the current system clock.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The CI matrix is still targeting Node.js 12.x/14.x/16.x, which are EOL; consider updating the workflow to test against currently supported LTS versions (e.g., 18.x and 20.x) to better match real-world usage.
- The new CI triggers only on push/pull_request to main/master and a weekly schedule, whereas the previous workflow also reacted to create/delete/issue_comment events; verify whether any of those older triggers are still needed for your workflow and reintroduce them if so.
- The updated Azure webhook test now uses `new Date(Date.now() + 365 * 24 * 60 * 60 * 1000)` at module load time; if test determinism is important, consider injecting a fixed future date or using a helper to freeze time instead of relying on the current system clock.
## Individual Comments
### Comment 1
<location> `.github/workflows/scans_ci.yml:15-17` </location>
<code_context>
-
+ strategy:
+ matrix:
+ node-version: [12.x, 14.x, 16.x] # Test on multiple Node.js versions
steps:
- uses: actions/checkout@v2
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Update the Node.js matrix to supported LTS versions to avoid running CI on EOL runtimes.
12.x and 14.x are end-of-life and no longer receive security updates. Unless you specifically need to support them, consider updating the matrix to current LTS versions (e.g., 18.x and 20.x) so CI aligns with supported production runtimes and future dependency support.
```suggestion
strategy:
matrix:
node-version: [18.x, 20.x] # Test on supported LTS Node.js versions
```
</issue_to_address>
### Comment 2
<location> `.github/workflows/scans_ci.yml:43-44` </location>
<code_context>
+ - name: Run Tests
run: npm test
+
+ - name: Build
+ run: npm run build --if-present
</code_context>
<issue_to_address>
**suggestion (performance):** Consider moving the build step to a separate job to avoid redundant builds on every matrix entry.
Because `Build` runs for every matrix Node.js version, it unnecessarily multiplies build time and resource usage. If your build artifacts are runtime-agnostic, consider running `npm run build --if-present` in a separate job that executes once (e.g., on a single LTS Node version) after tests complete. This preserves multi-runtime test coverage while making the workflow faster and more efficient.
Suggested implementation:
```
- name: Run Tests
run: npm test
```
To complete the change, you should also:
1. Add a new job (e.g., `build`) under the top-level `jobs:` section that:
- Uses a single Node.js version (typically the current LTS, e.g., `20.x`).
- Depends on the matrix test job via `needs: <test-job-id>` so it only runs once after tests succeed.
- Checks out the code, sets up Node with the chosen version, runs `npm ci`, and then `npm run build --if-present`.
For example (you will need to adjust `needs:` to match your existing job id, and align indentation with your file):
```yaml
jobs:
# existing test/matrix job
tests:
runs-on: ubuntu-latest
strategy:
matrix:
node-version: [18.x, 20.x]
steps:
# ... checkout, setup-node, npm ci, lint, test (no build here)
build:
needs: tests # make sure this matches the actual test job id
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Use Node.js LTS
uses: actions/setup-node@v4
with:
node-version: 20.x
- name: Install dependencies
run: npm ci
- name: Build
run: npm run build --if-present
```
Ensure that:
- The new `build` job is at the same indentation level as your existing job(s) under `jobs:`.
- The `needs:` value references the correct existing job id (e.g., `tests`, `ci`, or whatever your current matrix job is named).
</issue_to_address>
### Comment 3
<location> `README.md:78` </location>
<code_context>
## Installation
Ensure that NodeJS is installed. If not, install it from [here](https://nodejs.org/download/).
-```
</code_context>
<issue_to_address>
**nitpick (typo):** Consider using the canonical spelling "Node.js" instead of "NodeJS".
To match the official project name and common usage, please change "NodeJS" to "Node.js" here (e.g., "Ensure that Node.js is installed.").
```suggestion
Ensure that Node.js is installed. If not, install it from [here](https://nodejs.org/download/).
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+15
to
+17
| strategy: | ||
| matrix: | ||
| node-version: [12.x, 14.x, 16.x] # Test on multiple Node.js versions |
There was a problem hiding this comment.
🚨 suggestion (security): Update the Node.js matrix to supported LTS versions to avoid running CI on EOL runtimes.
12.x and 14.x are end-of-life and no longer receive security updates. Unless you specifically need to support them, consider updating the matrix to current LTS versions (e.g., 18.x and 20.x) so CI aligns with supported production runtimes and future dependency support.
Suggested change
| strategy: | |
| matrix: | |
| node-version: [12.x, 14.x, 16.x] # Test on multiple Node.js versions | |
| strategy: | |
| matrix: | |
| node-version: [18.x, 20.x] # Test on supported LTS Node.js versions |
Comment on lines
+43
to
+44
| - name: Build | ||
| run: npm run build --if-present |
There was a problem hiding this comment.
suggestion (performance): Consider moving the build step to a separate job to avoid redundant builds on every matrix entry.
Because Build runs for every matrix Node.js version, it unnecessarily multiplies build time and resource usage. If your build artifacts are runtime-agnostic, consider running npm run build --if-present in a separate job that executes once (e.g., on a single LTS Node version) after tests complete. This preserves multi-runtime test coverage while making the workflow faster and more efficient.
Suggested implementation:
- name: Run Tests
run: npm test
To complete the change, you should also:
- Add a new job (e.g.,
build) under the top-leveljobs:section that:- Uses a single Node.js version (typically the current LTS, e.g.,
20.x). - Depends on the matrix test job via
needs: <test-job-id>so it only runs once after tests succeed. - Checks out the code, sets up Node with the chosen version, runs
npm ci, and thennpm run build --if-present.
- Uses a single Node.js version (typically the current LTS, e.g.,
For example (you will need to adjust needs: to match your existing job id, and align indentation with your file):
jobs:
# existing test/matrix job
tests:
runs-on: ubuntu-latest
strategy:
matrix:
node-version: [18.x, 20.x]
steps:
# ... checkout, setup-node, npm ci, lint, test (no build here)
build:
needs: tests # make sure this matches the actual test job id
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Use Node.js LTS
uses: actions/setup-node@v4
with:
node-version: 20.x
- name: Install dependencies
run: npm ci
- name: Build
run: npm run build --if-presentEnsure that:
- The new
buildjob is at the same indentation level as your existing job(s) underjobs:. - The
needs:value references the correct existing job id (e.g.,tests,ci, or whatever your current matrix job is named).
| @@ -77,11 +77,65 @@ A commercial version of CloudExploit hosted at Khulnasoft Wave. Try [Khulnasoft | |||
| ## Installation | |||
| Ensure that NodeJS is installed. If not, install it from [here](https://nodejs.org/download/). | |||
There was a problem hiding this comment.
nitpick (typo): Consider using the canonical spelling "Node.js" instead of "NodeJS".
To match the official project name and common usage, please change "NodeJS" to "Node.js" here (e.g., "Ensure that Node.js is installed.").
Suggested change
| Ensure that NodeJS is installed. If not, install it from [here](https://nodejs.org/download/). | |
| Ensure that Node.js is installed. If not, install it from [here](https://nodejs.org/download/). |
PR Code Suggestions ✨Explore these optional code suggestions:
|
||||||||||||
|
FortiShield
added a commit
that referenced
this pull request
Aug 10, 2026
* cloudsplit 2.0.0 fixed * Bump @babel/traverse from 7.9.0 to 7.23.2 Bumps [@babel/traverse](https://github.com/babel/babel/tree/HEAD/packages/babel-traverse) from 7.9.0 to 7.23.2. - [Release notes](https://github.com/babel/babel/releases) - [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md) - [Commits](https://github.com/babel/babel/commits/v7.23.2/packages/babel-traverse) --- updated-dependencies: - dependency-name: "@babel/traverse" dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * init commit * Create SECURITY.md Signed-off-by: Md Sulaiman <51925710+sulaiman-coder@users.noreply.github.com> * Bump @octokit/app from 14.0.1 to 14.0.2 Bumps [@octokit/app](https://github.com/octokit/app.js) from 14.0.1 to 14.0.2. - [Release notes](https://github.com/octokit/app.js/releases) - [Commits](octokit/app.js@v14.0.1...v14.0.2) --- updated-dependencies: - dependency-name: "@octokit/app" dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * Bump follow-redirects from 1.15.3 to 1.15.4 Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.3 to 1.15.4. - [Release notes](https://github.com/follow-redirects/follow-redirects/releases) - [Commits](follow-redirects/follow-redirects@v1.15.3...v1.15.4) --- updated-dependencies: - dependency-name: follow-redirects dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * ci: build * Update scans_ci.yml Signed-off-by: NxPKG <116948796+NxPKG@users.noreply.github.com> * 1.0.0 add * Update README.md Signed-off-by: NxPKG <116948796+NxPKG@users.noreply.github.com> * Azure/gov cloud * ci: build (#30) * ci: build * Update scans_ci.yml Signed-off-by: NxPKG <116948796+NxPKG@users.noreply.github.com> * 1.0.0 add * Update README.md Signed-off-by: NxPKG <116948796+NxPKG@users.noreply.github.com> * Azure/gov cloud --------- Signed-off-by: NxPKG <116948796+NxPKG@users.noreply.github.com> * fix index * Ci (#31) * ci: build * Update scans_ci.yml Signed-off-by: NxPKG <116948796+NxPKG@users.noreply.github.com> * 1.0.0 add * Update README.md Signed-off-by: NxPKG <116948796+NxPKG@users.noreply.github.com> * Azure/gov cloud * fix index --------- Signed-off-by: NxPKG <116948796+NxPKG@users.noreply.github.com> * update * Update eksKubernetesVersion.spec.js Signed-off-by: gitworkflows <118260833+gitworkflows@users.noreply.github.com> * Update scans_ci.yml Signed-off-by: gitworkflows <118260833+gitworkflows@users.noreply.github.com> * Create docker-publish.yml Signed-off-by: gitworkflows <118260833+gitworkflows@users.noreply.github.com> * Delete package-lock.json Signed-off-by: gitworkflows <118260833+gitworkflows@users.noreply.github.com> * Update .gitignore Signed-off-by: gitworkflows <118260833+gitworkflows@users.noreply.github.com> * Update scans_ci.yml Signed-off-by: gitworkflows <118260833+gitworkflows@users.noreply.github.com> * Update scans_ci.yml Signed-off-by: gitworkflows <118260833+gitworkflows@users.noreply.github.com> * Feature: CloudEploit 2.0.1 * Feature: CloudEploit 2.0.1 * Feature: CloudEploit 2.0.1 * Feature: CloudEploit 2.0.1 * Merge pull request #50 from envrs/feature/update-ci-cd-and-docs chore: update CI/CD pipeline, add PR template, and improve documentation * Bump minimatch in the npm_and_yarn group across 1 directory Bumps the npm_and_yarn group with 1 update in the / directory: [minimatch](https://github.com/isaacs/minimatch). Updates `minimatch` from 3.1.3 to 10.2.2 - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.3...v10.2.2) --- updated-dependencies: - dependency-name: minimatch dependency-version: 10.2.2 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com> * ☁️ CloudExploit by KhulnaSoft Security, Ltd. 🔐 Multi‑Cloud Security Auditing Platform 🚀 AWS • Azure • GCP • Oracle • GitHub (#52) * Merge pull request #1 from envrs/feature/update-ci-cd-and-docs Feature/update ci cd and docs * feat: ☁️ CloudExploit by KhulnaSoft Security, Ltd. 🔐 Multi‑Cloud Security Auditing Platform 🚀 AWS • Azure • GCP • Oracle • GitHub * Update helpers/shared.js Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: fortishield <161459699+FortiShield@users.noreply.github.com> * 🔧 Fix multiple issues across plugins, collectors, and helpers - Remove invalid apis property from 9 privilege analysis plugins (no-op run functions) - Fix regexMismatch length checks in iamRolePolicies.js to use Object.keys() - Fix GuardDuty BridgeResourceNameIdentifier to use 'detectorId' instead of 'id' - Update broken repo links in docs (cloudexploit/scans -> khulnasoft/cloudexploit) - Fix queueService collector to use QueueServiceClient instead of TableServiceClient * feat: migration uv --------- Signed-off-by: fortishield <161459699+FortiShield@users.noreply.github.com> Co-authored-by: fortishield <161459699+FortiShield@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: xeondesk <xeondesk@gmail.com> * improve (#54) --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Md Sulaiman <51925710+sulaiman-coder@users.noreply.github.com> Signed-off-by: NxPKG <116948796+NxPKG@users.noreply.github.com> Signed-off-by: gitworkflows <118260833+gitworkflows@users.noreply.github.com> Signed-off-by: fortishield <161459699+FortiShield@users.noreply.github.com> Co-authored-by: NxPKG <116948796+NxPKG@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Md Sulaiman <51925710+sulaiman-coder@users.noreply.github.com> Co-authored-by: gitworkflows <118260833+gitworkflows@users.noreply.github.com> Co-authored-by: khulnasoft-bot <43526132+khulnasoft-bot@users.noreply.github.com> Co-authored-by: envrs <dr.lizadmf@gmail.com> Co-authored-by: envrs <230240030+envrs@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: xeondesk <xeondesk@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR Type
Enhancement, Tests, Documentation
Description
Updated CI/CD pipeline with matrix testing across multiple Node.js versions
Added comprehensive PR template for standardized contribution process
Enhanced README with development, testing, and CI/CD documentation
Fixed test data to use dynamic dates instead of hardcoded values
Updated EKS Kubernetes version test fixture from 1.29 to 1.30
Diagram Walkthrough
File Walkthrough
scans_ci.yml
CI/CD pipeline modernization with matrix testing.github/workflows/scans_ci.yml
16.x
pull_request_template.md
New pull request template for consistency.github/pull_request_templates/pull_request_template.md
and change type
environments
README.md
Expanded documentation for development workflowREADME.md
examples
automationAcctExpiredWebhooks.spec.js
Fix webhook expiry test with dynamic datesplugins/azure/automationAccounts/automationAcctExpiredWebhooks.spec.js
timestamp
maintainability
run
eksKubernetesVersion.spec.js
Update EKS Kubernetes version fixtureplugins/aws/eks/eksKubernetesVersion.spec.js
Summary by CodeRabbit
Documentation
Tests
Chores
✏️ Tip: You can customize this high-level summary in your review settings.