Skip to content

fix(pkgdown): Fix url to the MSstatsPTM github page #128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tonywu1999 merged 3 commits into from
Apr 9, 2026
Merged

fix(pkgdown): Fix url to the MSstatsPTM github page #128

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ad1df5e
fix(pkgdown): Fix url to the MSstatsPTM github page
tonywu1999 Apr 9, 2026
3039e41
new line to pkgdown
tonywu1999 Apr 9, 2026
5ce5427
update files
tonywu1999 Apr 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .Rbuildignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,3 +6,4 @@
^_pkgdown\.yml$
^docs$
^pkgdown$
^\.github$
48 changes: 48 additions & 0 deletions .github/workflows/pkgdown.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
# Workflow derived from https://github.com/r-lib/actions/tree/v2/examples
# Need help debugging build failures? Start at https://github.com/r-lib/actions#where-to-find-help
on:
push:
branches: [devel]
pull_request:
branches: [devel]
workflow_dispatch:

name: pkgdown

permissions: read-all

jobs:
pkgdown:
runs-on: ubuntu-latest
# Only restrict concurrency for non-PR jobs
concurrency:
group: pkgdown-${{ github.event_name != 'pull_request' || github.run_id }}
env:
GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
permissions:
contents: write
steps:
- uses: actions/checkout@v4

- uses: r-lib/actions/setup-pandoc@v2

- uses: r-lib/actions/setup-r@v2
with:
use-public-rspm: true

- uses: r-lib/actions/setup-r-dependencies@v2
with:
extra-packages: any::pkgdown, local::.
needs: website

- name: Build site
run: pkgdown::build_site_github_pages(new_process = FALSE, install = FALSE)
shell: Rscript {0}

- name: Deploy to GitHub pages 🚀
if: github.event_name != 'pull_request'
uses: JamesIves/github-pages-deploy-action@v4.5.0
with:
Comment on lines +25 to +45

@coderabbitai coderabbitai Bot Apr 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify workflow actions that are not pinned to full commit SHAs.
# Expected: no output after hardening.
rg -nP '^\s*-\s*uses:\s*[^@\s]+@(?!(?:[0-9a-f]{40})\s*$).+' .github/workflows

Repository: Vitek-Lab/MSstatsPTM

Length of output: 368

🏁 Script executed:

cat -n .github/workflows/pkgdown.yaml

Repository: Vitek-Lab/MSstatsPTM

Length of output: 1676

Pin all GitHub Actions to immutable commit SHAs.

All five uses: statements in this workflow (lines 25, 27, 29, 33, and 44) are pinned to mutable version tags (@v4, @v2, @v4.5.0) rather than full commit SHAs. This weakens supply-chain integrity by allowing tag reassignment attacks. Replace each tag with its corresponding 40-character commit SHA:

  • actions/checkout@v4 → actions/checkout@<SHA>
  • r-lib/actions/setup-pandoc@v2 → r-lib/actions/setup-pandoc@<SHA>
  • r-lib/actions/setup-r@v2 → r-lib/actions/setup-r@<SHA>
  • r-lib/actions/setup-r-dependencies@v2 → r-lib/actions/setup-r-dependencies@<SHA>
  • JamesIves/github-pages-deploy-action@v4.5.0 → JamesIves/github-pages-deploy-action@<SHA>
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/pkgdown.yaml around lines 25 - 45, The workflow pins
GitHub Actions to mutable tags; replace each `uses:` entry's version tag with
the corresponding 40-character commit SHA to harden supply-chain integrity:
update `actions/checkout@v4`, `r-lib/actions/setup-pandoc@v2`,
`r-lib/actions/setup-r@v2`, `r-lib/actions/setup-r-dependencies@v2`, and
`JamesIves/github-pages-deploy-action@v4.5.0` to their full commit SHAs (locate
the exact `uses:` lines in the file and swap the `@<tag>` suffix for
`@<full-commit-sha>`). Ensure you verify the correct SHA from each action's
GitHub repository and commit the updated workflow.

clean: false
branch: gh-pages
folder: docs
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,4 @@ inst/doc
doc
Meta
docs
*.html
1 change: 1 addition & 0 deletions DESCRIPTION
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ biocViews: ImmunoOncology, MassSpectrometry, Proteomics, Software, DifferentialE
OneChannel, TwoChannel, Normalization, QualityControl
BugReports: https://github.com/Vitek-Lab/MSstatsPTM/issues
Encoding: UTF-8
URL: https://vitek-lab.github.io/MSstatsPTM/
Roxygen: list(markdown = TRUE)
RoxygenNote: 7.3.3
Config/testthat/edition: 3
3 changes: 3 additions & 0 deletions _pkgdown.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
url: https://vitek-lab.github.io/MSstatsPTM/
template:
bootstrap: 5
Loading