refactor: ci and build by jasonsaayman · Pull Request #7340 · axios/axios

jasonsaayman · 2026-01-24T14:40:51Z

Summary by cubic

Reworked CI and release flows to stabilize builds across Node 12–24, simplify publishing, and automate sponsor updates. Also cleaned up old workflows and refreshed issue/PR templates.

New Features
- Added PR CI workflow (Node 12–24) to build, run unit/browser/package tests, do dependency review, and run CodeQL; only runs when core files change.
- Added release-branch workflow to bump version, build, test, and open a release PR.
- Added scheduled sponsor-block updater using resources/update-sponsors.js that opens an update PR.
Refactors
- Simplified publish: publish to NPM on tag push (Node 24, NPM_TOKEN).
- Removed legacy workflows (CI, CodeQL, deps review, labeler, notify, npm-tag, release PR, sponsors, stale) and updated issue/PR templates (links to main).
- Removed bin/sponsors.js and added mise.toml to standardize local Node (22).

^{Written for commit 458f942. Summary will update on new commits.}

cubic-dev-ai

8 issues found across 15 files

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name=".github/workflows/resources/sponsors.js">

<violation number="1" location=".github/workflows/resources/sponsors.js:2">
P0: Incorrect import path: `../index.js` resolves to `.github/workflows/index.js` which doesn't exist. The axios entry point is at the repository root. This will cause a module not found error at runtime.</violation>

<violation number="2" location=".github/workflows/resources/sponsors.js:3">
P0: Incorrect import path: `./repo.js` does not exist. The file is located at `bin/repo.js`. This will cause a module not found error at runtime.</violation>

<violation number="3" location=".github/workflows/resources/sponsors.js:4">
P0: Incorrect import path: `./helpers/colorize.js` does not exist. The file is located at `bin/helpers/colorize.js`. This will cause a module not found error at runtime.</violation>
</file>

<file name=".github/workflows/update-sponsor-block.yml">

<violation number="1" location=".github/workflows/update-sponsor-block.yml:43">
P2: The "Exit gracefully" step does not actually stop the workflow; it only exits that step. Subsequent steps still run even when `changed` is false, which can cause `cat ./temp/sponsors.md` to fail (or open a no-op PR). Gate the remaining steps with an `if: steps.sponsors-requires-update.outputs.changed == 'true'` condition (or move the condition to the job) so the workflow truly stops when no updates are needed.</violation>
</file>

<file name=".github/workflows/run-ci.yml">

<violation number="1" location=".github/workflows/run-ci.yml:25">
P2: This step has only a name and no `run` or `uses`, so the workflow fails validation. Combine the name and `uses` in a single step.</violation>

<violation number="2" location=".github/workflows/run-ci.yml:49">
P2: This step exits 0 but does not stop the job; without `if:` conditions on later steps, CI still runs even when only non-core files changed.</violation>

<violation number="3" location=".github/workflows/run-ci.yml:83">
P1: `matrix.language` is undefined because the matrix only contains `node-version`. CodeQL init will receive an empty language list and fail.</violation>

<violation number="4" location=".github/workflows/run-ci.yml:86">
P1: `uses` is indented too far and won’t be recognized as part of the step, which breaks the workflow YAML.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

.github/workflows/resources/sponsors.js

.github/workflows/run-ci.yml

.github/workflows/update-sponsor-block.yml

.github/workflows/run-ci.yml

github-advanced-security · 2026-01-24T14:51:22Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

.github/workflows/run-ci.yml

+          persist-credentials: true
+      - name: Check if core code files were modified
+        id: changed-core-code-files
+        uses: tj-actions/changed-files@v47


.github/workflows/update-sponsor-block.yml

+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: git config
+        run: |
+          git config user.name "${GITHUB_ACTOR}"
+          git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
+      - name: Setup node
+        uses: actions/setup-node@v6
+        with:
+          node-version: 24.x
+          cache: npm
+      - name: Install dependencies
+        run: npm ci
+      - name: Check if sponsors require updates
+        id: sponsors-requires-update
+        run: node ./resources/update-sponsors.js
+      - name: Exit gracefully if no sponsor updates are needed
+        run: |
+          if [ "${{ steps.sponsors-requires-update.outputs.changed }}" = "false" ]; then
+            echo "No sponsor updates needed. Skipping further steps."
+            echo "only_modified=false" >> $GITHUB_OUTPUT
+            exit 0
+          else
+            echo "Sponsor updates needed. Continuing with the workflow."
+            echo "only_modified=false" >> $GITHUB_OUTPUT
+          fi
+      - name: Read sponsors.md file content
+        run: |
+          echo 'CONTENT<<EOF' >> $GITHUB_ENV
+          cat ./temp/sponsors.md >> $GITHUB_ENV
+          echo 'EOF' >> $GITHUB_ENV
+        shell: bash
+      - name: Echo sponsors content
+        run: |
+          echo "$CONTENT"
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@v7
+        with:
+          branch: sponsors
+          delete-branch: true
+          commit-message: "chore(sponsor): update sponsor block"
+          title: "[Chore] Update sponsor block"
+          body: |
+            **New sponsor block update:**
+            ${{ env.CONTENT }}
+          labels: |
+            pr::docs
+            bot
+            automerge
+          signoff: false
+          draft: false


In general, the fix is to explicitly define a permissions block, either at the root of the workflow (applying to all jobs) or inside the sponsors job, granting only the minimal permissions that the workflow actually needs. This constrains the GITHUB_TOKEN instead of relying on potentially broad repository/organization defaults.

For this specific workflow, the Create pull request step uses peter-evans/create-pull-request@v7 to create a branch, push commits, and open a PR. That requires write access to repository contents and to pull requests. Other steps (checkout, reading/writing files locally, Node setup, running scripts) do not require additional token scopes. The minimal safe permissions block is therefore contents: write and pull-requests: write. The cleanest fix is to add a permissions block at the workflow root (after the on: block and before jobs:) so it applies to the sponsors job without further changes. No imports or external definitions are needed, only a YAML edit to .github/workflows/update-sponsor-block.yml.

Concretely: in .github/workflows/update-sponsor-block.yml, add:

permissions: contents: write pull-requests: write

between the on: block (ending at line 9) and the jobs: block (starting at line 11). This preserves existing functionality while enforcing least privilege and satisfying CodeQL.

.github/workflows/update-sponsor-block.yml

+        run: |
+          echo "$CONTENT"
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@v7


Copilot

Pull request overview

This PR aims to consolidate and modernize GitHub Actions workflows for CI/CD, automate sponsor block updates, and clean up legacy configuration. However, the PR contains several critical issues that will break key functionality.

Changes:

Added new CI workflow (run-ci.yml) that runs tests across Node 12-24 and includes CodeQL/dependency review
Added automated sponsor block updater workflow with daily schedule
Simplified publish workflow to trigger on version tags
Added release branch creation workflow with version bumping
Removed 9 legacy workflows and issue templates
Added mise.toml for Node version management

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
`.github/workflows/run-ci.yml`	New consolidated CI workflow replacing old ci.yml; runs tests, builds, and security scans across multiple Node versions
`.github/workflows/update-sponsor-block.yml`	New workflow to automate sponsor block updates on a schedule
`.github/workflows/release-branch.yml`	New workflow to create release branches with version bumping and testing
`.github/workflows/publish.yml`	Simplified NPM publish workflow, now triggers on tags instead of merged PRs
`.github/workflows/ci.yml`	Removed old CI workflow (replaced by run-ci.yml)
`.github/workflows/sponsors.yml`	Removed old sponsors workflow (replaced by update-sponsor-block.yml)
`.github/workflows/pr.yml`	Removed old release PR workflow (replaced by release-branch.yml)
`.github/workflows/stale.yml`	Removed stale issue/PR management workflow
`.github/workflows/notify.yml`	Removed notification workflow
`.github/workflows/labeler.yml`	Removed PR labeler workflow
`.github/workflows/npm-tag.yml`	Removed NPM tag management workflow
`.github/workflows/depsreview.yaml`	Removed standalone dependency review (now part of run-ci.yml)
`.github/workflows/codeql-analysis.yml`	Removed standalone CodeQL workflow (now part of run-ci.yml)
`bin/sponsors.js`	Deleted sponsors script that was supposed to be relocated but replacement is missing
`.github/labeler.yml`	Removed labeler configuration file
`.github/ISSUE_TEMPLATE/*.yml`	Removed all issue template files
`.github/ISSUE_TEMPLATE/config.yml`	Removed issue template configuration
`.github/PULL_REQUEST_TEMPLATE.md`	Updated PR template with clearer instructions and branch reference fix
`.github/ISSUE_TEMPLATE.md`	Updated issue template with branch reference fixes and formatting improvements
`mise.toml`	Added mise configuration to standardize on Node 22 locally

Comments suppressed due to low confidence (1)

.github/workflows/ci.yml:1

The PR description states "Moved legacy workflows to .github/workflows/old" but the workflows are actually being deleted, not moved. There is no .github/workflows/old/ directory in the repository. This is a discrepancy between the PR description and the actual code changes. If the intention is to preserve these workflows for reference, they should be moved rather than deleted. If deletion is intentional, the PR description should be updated to reflect this.

.github/workflows/publish.yml

.github/workflows/run-ci.yml

.github/workflows/publish.yml

.github/workflows/release-branch.yml

.github/workflows/run-ci.yml

.github/workflows/update-sponsor-block.yml

.github/workflows/publish.yml

.github/workflows/run-ci.yml

.github/workflows/release-branch.yml

cubic-dev-ai

1 issue found across 5 files (changes from recent commits).

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name=".github/workflows/update-sponsor-block.yml">

<violation number="1" location=".github/workflows/update-sponsor-block.yml:36">
P1: The workflow references `./bin/update-sponsors.js`, but that file does not exist in the repository. This will cause the sponsor update job to fail at runtime. Point the workflow at the existing script (or add the missing file).</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

.github/workflows/update-sponsor-block.yml

jasonsaayman added 3 commits January 20, 2026 20:31

chore: add mise

e98641b

chore: re-position ci

2fcf501

chore: move sponsors script

d8e9145

github-actions bot added pr::fix labels Jan 24, 2026

jasonsaayman added 3 commits January 24, 2026 16:43

chore: fix yml

6a63938

chore: yml

c6bf368

fix: yml

b7285f5

cubic-dev-ai bot reviewed Jan 24, 2026

View reviewed changes

github-advanced-security bot found potential problems Jan 24, 2026

View reviewed changes

jasonsaayman added 4 commits January 24, 2026 16:56

fix: yml

bd0843b

chore: tweak sponsor yml

0400214

chore: implement security suggestion

12d4805

chore: update templates for issues and PRs and update all workflows

458f942

Copilot AI review requested due to automatic review settings January 25, 2026 13:24

Copilot started reviewing on behalf of jasonsaayman January 25, 2026 13:25 View session

Copilot AI reviewed Jan 25, 2026

View reviewed changes

jasonsaayman added 2 commits January 25, 2026 15:57

fix: copilot feedback

71489f9

feat: always run CI

6852020

cubic-dev-ai bot reviewed Jan 25, 2026

View reviewed changes

.github/workflows/update-sponsor-block.yml Outdated Show resolved Hide resolved

jasonsaayman changed the title ~~Fix/build and other errors~~ refactor: ci and build Jan 25, 2026

jasonsaayman added 2 commits January 25, 2026 16:02

fix: linked resources

e92ef09

chore: cancel run if new run starts

bef08d8

jasonsaayman self-assigned this Jan 25, 2026

jasonsaayman added commit::refactor The PR is related to refactoring and removed pr::fix labels Jan 25, 2026

@@ -8,6 +8,10 @@
               schedule:
                 - cron: "0 1 * * *"
+            permissions:
+              contents: write
+              pull-requests: write
             jobs:
               sponsors:
                 runs-on: ubuntu-latest

Uh oh!

Conversation

jasonsaayman commented Jan 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-advanced-security bot commented Jan 24, 2026

Uh oh!

Check warning

Check warning

Copilot Autofix

Check warning

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jasonsaayman commented Jan 24, 2026 •

edited

Loading