docs: add openwiki - #5
anurag6569201 wants to merge 1 commit into
Conversation
Source PR: langchain-ai#40183 Source head: 0e4cf58
⛔ Shipwright · BlockedRecommendation: do not merge PR #5 · Tier
Findings (6)
Fireworks usage: 75,370 input · 889 output · 76,259 total tokens · $0.0172 · 18s · 0 fix iteration(s) Open the Shipwright check for full evidence and the audit bundle. Use |
![shipwright-agent[bot]](https://avatars.githubusercontent.com/u/140162738?s=60&v=4){kind=small}
|
|
||
| - name: Install OpenWiki | ||
| # mermaid + jsdom are optional; they add high-fidelity validation of Mermaid diagrams. Remove if your wiki has none. | ||
| run: npm install --global openwiki@0.5.0 mermaid@11.16.0 jsdom@29.1.1 |
There was a problem hiding this comment.
Shipwright · CRITICAL
'continue-on-error: true' is set on the OpenWiki run, and the subsequent PR-creation step runs whenever the job is not cancelled.
Impact: 'continue-on-error: true' is set on the OpenWiki run, and the subsequent PR-creation step runs whenever the job is not cancelled. The PR body explicitly instructs merging partial output after a failure, so a failed or partially generated documentation run can still be merged into the repository as the new baseline. This turns a generation failure into an accepted state change.
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| - cron: "0 8 * * *" | ||
|
|
||
| permissions: | ||
| contents: write |
There was a problem hiding this comment.
Shipwright · CRITICAL
The workflow grants 'contents: write' and 'pull-requests: write' at the repository level and runs an untrusted, unpinned-by-content third-party tool ('openwiki@0.5.0') with 'ANTHRO
Impact: The workflow grants 'contents: write' and 'pull-requests: write' at the repository level and runs an untrusted, unpinned-by-content third-party tool ('openwiki@0.5.0') with 'ANTHROPIC_API_KEY', 'OPENWIKI_LANGSMITH_API_KEY', and 'LANGSMITH_API_KEY' exposed in its environment. A compromised or malicious 'openwiki' release could exfiltrate these secrets or push arbitrary code/docs to the default branch via the PR-creat…
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | ||
| with: | ||
| node-version: "22" | ||
|
|
There was a problem hiding this comment.
Shipwright · CRITICAL
The workflow installs 'openwiki@0.5.0', 'mermaid@11.16.0', and 'jsdom@29.1.1' from npm without a lockfile, integrity hash, or provenance verification.
Impact: The workflow installs 'openwiki@0.5.0', 'mermaid@11.16.0', and 'jsdom@29.1.1' from npm without a lockfile, integrity hash, or provenance verification. Any future republish or registry compromise of these packages executes arbitrary code in a job that has write access to the repository and access to multiple secrets.
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| - **Documentation:** https://docs.langchain.com/oss/python/langchain/overview and source at https://github.com/langchain-ai/docs or `../docs/`. Prefer the local install and use file search tools for best results. If needed, use the docs MCP server as defined in `.mcp.json` for programmatic access. | ||
| - **Contributing Guide:** [Contributing Guide](https://docs.langchain.com/oss/python/contributing/overview) | ||
|
|
||
| <!-- OPENWIKI:START --> |
There was a problem hiding this comment.
Shipwright · HIGH
The generated 'openwiki/' content is committed directly into the repository, but the diff contains no validation step that checks the generated pages against a schema or verifies t
Impact: The generated 'openwiki/' content is committed directly into the repository, but the diff contains no validation step that checks the generated pages against a schema or verifies that the evidence references still resolve. The AGENTS.md/CLAUDE.md text says to treat source as authoritative, yet the workflow automatically opens PRs that can overwrite 'AGENTS.md' and 'CLAUDE.md' with generated content, making it easy f…
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| # For extra workspaces, add OPENWIKI_LANGSMITH_API_KEY_2, _3, ... as repo | ||
| # secrets and env entries here. | ||
| OPENWIKI_LANGSMITH_API_KEY: ${{ secrets.OPENWIKI_LANGSMITH_API_KEY }} | ||
| # Optional: also trace this workflow's own OpenWiki run to LangSmith. |
There was a problem hiding this comment.
Shipwright · HIGH
The workflow removes 'openwiki/.run.json' only when the job is not cancelled, but the OpenWiki step itself is allowed to fail.
Impact: The workflow removes 'openwiki/.run.json' only when the job is not cancelled, but the OpenWiki step itself is allowed to fail. If OpenWiki fails before writing or after partially writing run state, the cleanup condition and the PR-creation condition can disagree about what state is safe to preserve, leaving transient state in the working tree that may be included in the generated PR.
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
| @@ -0,0 +1,77 @@ | |||
| name: OpenWiki Update | |||
|
|
|||
| on: | |||
There was a problem hiding this comment.
Shipwright · HIGH
The scheduled workflow runs daily at 08:00 UTC with no concurrency control.
Impact: The scheduled workflow runs daily at 08:00 UTC with no concurrency control. If a run takes longer than 24 hours, or a manual 'workflow_dispatch' overlaps the schedule, multiple jobs can run simultaneously against the same 'openwiki/update' branch and 'openwiki/.run.json' state, producing conflicting PRs or corrupting the generated evidence index.
Suggested fix: Review the cited evidence, fix the risk if confirmed, and rerun Shipwright.
1 participant
Source merge-base:
1e6a4f0b45b60475f566f3ad49fb32ea99d22233Source head:
0e4cf587748f38df5408ee0b1dbf091476b4c807