🐛 fix(ui): resolve iconify aliases in the icon bundle (forward-port #683) - #686
Merged
Conversation
…bundle Forward-port of #683 (squash commit 97a2f56 on dev/v1.6) to dev/v1.7. The icon bundle is regenerated from the locked `@iconify-json` packages during every Docker image build (`npm run build` → `npm run icons`), but `extract-icons.mjs` only looked up plain icon entries — never aliases. lucide 1.2.121 demoted `history` to an alias of `rotate-ccw-clock`, so a bundle built against lockfile-correct packages silently drops any icon that becomes an alias upstream, with no network fallback since the iconify API module is offline-only. `extract-icons.mjs` now resolves alias chains (parent-following, depth-capped at 5); aliases carrying rotate/flip transforms are refused with a warning since the body-only bundle can't represent them. A new `ui/tests/boot/icon-bundle.spec.ts` guard test asserts every `'prefix:name'` reference in `src/icons.ts` exists in the generated bundle with a body. dev/v1.7 already carried #680's independent fix for the same class of stale reference (direct renames in `icons.ts` + `ui/tests/icons.spec.ts` guard). Both are kept: `iconoir:history`/`gitlab`/`key-alt` and `lucide:more-vertical` stay on #680's already-correct targets (`clock-rotate-right`/`gitlab-full`/`key`/`ellipsis-vertical`); the `iconoir:stack` conflict resolved to this fix's `multiple-pages` target (#680 had picked `cube`) since `multiple-pages` is what actually exists in the locked iconoir 1.2.11 collection — verified by a zero-warning bundle regeneration. `@iconify-json/fa6-brands` bumped to the exact-pinned 1.2.6 devDependency this fix adds. Bundle regenerated against dev/v1.7's lockfile: 576/576 references extracted, zero warnings.
scttbnsn
requested review from
ALARGECOMPANY and
biggest-littlest
as code owners
August 9, 2026 04:37
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThe icon extraction script now resolves direct icons and untransformed aliases recursively, with a five-level limit. Transformed aliases are rejected. The Font Awesome brands dependency is updated. The stack mapping and generated bundle now use Possibly related PRs
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
scttbnsn
added a commit
that referenced
this pull request
Aug 12, 2026
Three things landed on `dev/v1.6` during the GA push and never reached `dev/v1.7`. Found by diffing the two branches after the GA sync made `dev/v1.6` and `main` tree-identical. ### 1. OpenSSF assurance evidence (`a8b33673`, #699) `GOVERNANCE.md`, `SECURITY-ASSURANCE.md`, and the Best Practices badge in the README. This is the one that actually bites: drydock earned the [Silver badge](https://www.bestpractices.dev/en/projects/11915) on 2026-08-12 specifically because the GA sync put that badge on `main`'s front page. The first v1.7 sync to `main` would have deleted it again and dropped `documentation_achievements` back to Unmet, losing Silver. ### 2. Star history through GraphQL (`38819656`) v1.7 still had the REST `/stargazers` path. That endpoint 401s anonymously and, for a fine-grained token, demands `contents=write` — far more than a public star chart should hold — so the route fell back on every request and getdrydock.com just said "loading". The GraphQL stargazers connection needs only `metadata=read`. ### 3. Auditable soak override (`2b55ff4b`) The `soak_override_reason` dispatch input, its validation, and the 311-line test. The 604800s floor is untouched. Used once, for the v1.6.0 GA cut at 3.0 days; v1.7 should have the same escape hatch and the same audit trail. ### Deliberately not carried over - `daf12292` — v1.6.0 GA release identity and CHANGELOG. v1.7 produces its own. - `b98808e7` — rc.13 release identity. - `bd6f598d` — base-image digest bumps. The Dockerfile is already byte-identical; `cee3a686` covered it on this branch. - `#689` and `#683` show up in the commit gap but were already forward-ported as `#690` and `#686`. ### Verification - `apps/web/src/app/api/star-history/route.ts` and `.github/workflows/release-cut.yml` are byte-identical to `dev/v1.6`. - `npm run test:workflows` — 80/80. - `node --test apps/web/scripts/marketing-performance.test.mjs` — 6/6. - Full pre-push gate green, including coverage. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Changelog - ✨ Added OpenSSF governance, security-assurance documentation, and Best Practices Silver badge. - ✨ Added authenticated GitHub GraphQL pagination for star history. - ✨ Added GA-only `soak_override_reason` support with validation, audit output, and release-note disclosure. - ✨ Added tests for GraphQL pagination, malformed responses, token handling, and soak override boundaries. - 🔧 Replaced REST `/stargazers` requests with GitHub GraphQL requests. - 🔒 Documented per-path outbound-request controls, fail-closed authentication, release integrity, and residual risks. ## Concerns - Verify `GITHUB_TOKEN` exists in every runtime that serves the star-history route. - Verify malformed or incomplete GraphQL pagination returns fallback data and no partial results. - Verify prerelease workflows reject `soak_override_reason` before release actions run. - Verify shortened, multiline, and sanitized override reasons remain safe in workflow outputs and release notes. - Review the documented IFTTT outbound path and its missing shared timeout control. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Test <test@example.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Forward-ports #683 to dev/v1.7. #680 fixed the symptom here (direct icon-name renames) but not the root cause:
ui/scripts/extract-icons.mjsstill dropped icons that iconify collections demote to aliases (collection.aliases[name].parent), so any future collection bump could silently ship broken icons again — that's exactly how rc.12 shipped a blank Audit icon.What's in the port:
extract-icons.mjs:resolveIcon()follows alias parent chains (depth-capped), merges alias overrides, refuses transform-requiring aliases with a warning.ui/tests/boot/icon-bundle.spec.ts: guard test — everyprefix:nameref inicons.tsmust exist in the bundle with a body.iconoir:stack→multiple-pages(🔒 security: v1.7 hygiene — icon integrity, base-image CVE bumps, dead SW rule #680 had pickedcube;multiple-pagesmatches v1.6 and verified valid against locked iconoir 1.2.11).@iconify-json/fa6-brands1.2.4 → 1.2.6 exact-pinned (devDependencies).npm run buildleaves the tree clean.4508 UI tests, 100% coverage, full pre-push gate green.
Changelog
iconoir:cubewithiconoir:multiple-pagesfor thestackicon.@iconify-json/fa6-brandsto1.2.6.Concerns
icons.tsreference formats.