feat(npm-blacklist): scan multiple directories in one call - #8
Conversation
Add a `working-directories` input (whitespace-separated list of NPM project paths) so a single action call can scan several projects from one installed dependency tree. It takes precedence over the singular `working-directory` and is fully backward compatible: callers that pass only `working-directory` are unaffected. This lets a CI job install dependencies once and scan every workspace package in a single step, instead of repeating the composite `uses:` per directory or re-installing per directory in a matrix. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Warning Review limit reached
More reviews will be available in 51 minutes and 1 second. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
human-approved; merging |
What
Adds a
working-directoriesinput to thenpm-blacklistcomposite action: a whitespace-separated list of NPM project paths to scan in a single action call, from one already-installed dependency tree.working-directoriestakes precedence over the singularworking-directorywhen set.checker.shover each listed directory. Every directory is checked (an early failure doesn't short-circuit), and the step fails if any directory resolves a blacklisted package.working-directory(or nothing) are unchanged.Why
CI today calls this composite action once per workspace package (e.g.
.,packages/raindex,packages/ui-components), which is fine for a static list hand-written inline. But a parameterized reusable workflow can't loop a compositeuses:over a dynamic list in YAML — its only options are to bake a fixed call count in, or run a matrix that re-installs the (expensive) dependency tree per directory.Giving the action itself a multi-directory mode lets a reusable workflow install once and scan all directories in a single step. This is the right home for the loop: the directory iteration is the action's concern, not each consumer's.
Companion PR
This unblocks the install-once design of
rainlanguage/rainix's newrainix-npm-blacklist.yamlreusable workflow (rainlanguage/rainix#229), which calls this action once with the fullworking-directorieslist after a single install.🤖 Generated with Claude Code