Feat: Allow repo specific dangerfile. #129

lucas-zimerman · 2025-10-06T13:01:40Z

Based on V2.

The PR allows the danger CI to also include dangerfiles from the repo. This is good since only one github comment is allowed per repo, meaning that without this change, the danger used by the repo will overwrite the comment done by this repo.

This change adds a new step, loading an external dangerfile if set.
It passes the default parameters as exposing the following items:
fail

warn
message
markdown
danger

The changes were tested on the following PR:
getsentry/sentry-react-native#5235 (comment)

How external libraries should be implemented

Here is a example file using the changes: https://github.com/getsentry/sentry-react-native/blob/3dcd68b8db138e90aff72d51e46f89a6b0b70b0c/scripts/check-replay-stubs.js
If there is approval on merging these changes on this repo, I will update the readme file with guides on how to use an external dangerfile

#skip-changelog

.github/workflows/danger.yml

lucas-zimerman · 2025-10-06T13:12:33Z

@vaind What do you think of this feature?

.github/workflows/danger.yml

lucas-zimerman · 2025-10-06T13:19:56Z

Q: Should I target V3?

vaind · 2025-10-08T17:23:06Z

@vaind What do you think of this feature?

Hey, haven't had a chance to look yet but makes sense in general.

vaind · 2025-10-09T07:34:08Z

Note: danger-js has been updated by #132 (updater job added in #131)

danger/action.yml

lucas-zimerman · 2025-10-09T12:58:12Z

sorry for the extra tests I added (they got reverted), I wasn't sure why danger for changelogs wasn't triggering, turned out there are new filters that it skips the changelog check based on the title description that didn't happen on V2.

danger/dangerfile.js

lucas-zimerman · 2025-10-10T16:14:50Z

Testesd the following cases here:

Run with extra-dangerfile and extra-install-packages
https://github.com/getsentry/sentry-react-native/actions/runs/18411426970/job/52464497860

Run with extra-dangerfile and malicious shell script
https://github.com/getsentry/sentry-react-native/actions/runs/18411514303/job/52464814813?pr=5235

Run with no extra parameters
https://github.com/getsentry/sentry-react-native/actions/runs/18411569658/job/52465003681?pr=5235

Run with extra-dangerfile, extra-install-packages and a valid diff check for extra-dangerfile
https://github.com/getsentry/sentry-react-native/actions/runs/18412024717/job/52466642228?pr=5235

lucas-zimerman · 2025-10-10T16:22:04Z

@vaind I added the following steps:

Validate package names Avoids running the CI if there is anything suspicious on extra-install-packages.
Setup container is the old Run DangerJS without the part of running danger.
Setup additional packages sets all new packages as root if set.
Run DangerJS like the original, doesn't run danger as root.

vaind · 2025-10-14T06:53:16Z

@sentry review

danger/action.yml

danger/README.md

danger/action.yml

danger/dangerfile.js

danger/action.yml

Co-authored-by: Ivan Dlugos <6349682+vaind@users.noreply.github.com>

Co-authored-by: seer-by-sentry[bot] <157164994+seer-by-sentry[bot]@users.noreply.github.com>

lucas-zimerman · 2025-10-14T16:29:38Z

@sentry review

danger/action.yml

seer-by-sentry · 2025-10-14T16:36:10Z

danger/action.yml

          --workdir /github/workspace \
          --user $(id -u) \
          -e "INPUT_ARGS" -e "GITHUB_JOB" -e "GITHUB_REF" -e "GITHUB_SHA" -e "GITHUB_REPOSITORY" -e "GITHUB_REPOSITORY_OWNER" -e "GITHUB_RUN_ID" -e "GITHUB_RUN_NUMBER" -e "GITHUB_RETENTION_DAYS" -e "GITHUB_RUN_ATTEMPT" -e "GITHUB_ACTOR" -e "GITHUB_TRIGGERING_ACTOR" -e "GITHUB_WORKFLOW" -e "GITHUB_HEAD_REF" -e "GITHUB_BASE_REF" -e "GITHUB_EVENT_NAME" -e "GITHUB_SERVER_URL" -e "GITHUB_API_URL" -e "GITHUB_GRAPHQL_URL" -e "GITHUB_REF_NAME" -e "GITHUB_REF_PROTECTED" -e "GITHUB_REF_TYPE" -e "GITHUB_WORKSPACE" -e "GITHUB_ACTION" -e "GITHUB_EVENT_PATH" -e "GITHUB_ACTION_REPOSITORY" -e "GITHUB_ACTION_REF" -e "GITHUB_PATH" -e "GITHUB_ENV" -e "GITHUB_STEP_SUMMARY" -e "RUNNER_OS" -e "RUNNER_ARCH" -e "RUNNER_NAME" -e "RUNNER_TOOL_CACHE" -e "RUNNER_TEMP" -e "RUNNER_WORKSPACE" -e "ACTIONS_RUNTIME_URL" -e "ACTIONS_RUNTIME_TOKEN" -e "ACTIONS_CACHE_URL" -e GITHUB_ACTIONS=true -e CI=true \
          -e GITHUB_TOKEN="${{ inputs.api-token }}" \


Security: Direct Input Interpolation

This line directly interpolates inputs.extra-dangerfile into the environment variable assignment. According to repository security patterns, user-controlled inputs should be assigned to job-level env variables first to prevent injection attacks.

Recommendation: Add a job-level env block and reference it as ${{ env.EXTRA_DANGERFILE }}.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

danger/action.yml

danger/dangerfile.js

danger/action.yml

lucas-zimerman · 2025-10-15T14:20:36Z

@vaind do you want me to apply the patches for the env suggestion? ( I don't see how it can make it safer but if you prefer I will apply it)

vaind · 2025-10-16T10:29:22Z

@lucas-zimerman yes please. script inputs should always be coming through the env var to prevent injection

fix reference use instefof instead of invalid contains use

lucas-zimerman · 2025-10-20T15:13:01Z

@vaind fixed the env var and also some nits

vaind

Minor changes but should be good to go. I assume you've tested this in your repo already?

danger/action.yml

danger/dangerfile.js

danger/action.yml

danger/README.md

lucas-zimerman · 2025-10-21T15:37:06Z

Minor changes but should be good to go. I assume you've tested this in your repo already?

Correct All the changes I have been testing here:

getsentry/sentry-react-native#5235

Dange Action: https://github.com/getsentry/sentry-react-native/actions/runs/18656204660/job/53185832158?pr=5235

Co-authored-by: Ivan Dlugos <6349682+vaind@users.noreply.github.com>

lucas-zimerman · 2025-10-21T16:10:48Z

latest changes are working, tested on https://github.com/getsentry/sentry-react-native/actions/runs/18690191990/job/53293610166

danger/action.yml

…install-packages features Add test coverage for the new extra-dangerfile and extra-install-packages inputs: - Create test-dangerfile.js demonstrating custom Danger checks - Add extra-dangerfile-test job to verify custom dangerfiles execute correctly - Add extra-packages-test job to verify package installation works - Tests validate that custom dangerfiles can access the Danger API and installed packages 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>

vaind · 2025-10-29T08:55:34Z

@lucas-zimerman I've made some minor adjustments, added integration tests and merged the changes. If I've accidentally broken something with your code, we can followup in another PR.

vaind · 2025-10-29T09:00:36Z

#skip-changelog

I didn't notice this in the PR description - it's a feature and should have had a changelog

lucas-zimerman · 2025-10-29T11:05:33Z

Thank you for all the reviews! the changers are working great when I point to the latest commit hash from this repo.

lucas-zimerman commented Oct 6, 2025

View reviewed changes

.github/workflows/danger.yml Outdated Show resolved Hide resolved

lucas-zimerman commented Oct 6, 2025

View reviewed changes

.github/workflows/danger.yml Outdated Show resolved Hide resolved

vaind reviewed Oct 9, 2025

View reviewed changes

danger/action.yml Outdated Show resolved Hide resolved

lucas-zimerman marked this pull request as ready for review October 9, 2025 12:59

lucas-zimerman requested a review from vaind October 9, 2025 13:01

lucas-zimerman commented Oct 9, 2025

View reviewed changes

danger/dangerfile.js Show resolved Hide resolved

seer-by-sentry bot reviewed Oct 9, 2025

View reviewed changes

danger/dangerfile.js Outdated Show resolved Hide resolved

lucas-zimerman marked this pull request as draft October 10, 2025 10:41

lucas-zimerman marked this pull request as ready for review October 10, 2025 16:14

branch cleanup

aac9829

lucas-zimerman force-pushed the lz/ext-danger branch from b45617b to aac9829 Compare October 10, 2025 16:39

Merge branch 'main' into lz/ext-danger

a2e8261

seer-by-sentry bot reviewed Oct 14, 2025

View reviewed changes

vaind reviewed Oct 14, 2025

View reviewed changes

danger/action.yml Outdated Show resolved Hide resolved

lucas-zimerman and others added 6 commits October 14, 2025 16:39

Update danger/action.yml

7e4598b

Co-authored-by: Ivan Dlugos <6349682+vaind@users.noreply.github.com>

Update danger/action.yml

c4c0849

Co-authored-by: seer-by-sentry[bot] <157164994+seer-by-sentry[bot]@users.noreply.github.com>

Update danger/action.yml

bb559db

Co-authored-by: seer-by-sentry[bot] <157164994+seer-by-sentry[bot]@users.noreply.github.com>

reviewed changes

e765013

fix customPath ref

ccf73eb

load path

8c62a42

lucas-zimerman requested a review from vaind October 14, 2025 16:32

seer-by-sentry bot reviewed Oct 14, 2025

View reviewed changes

code ref fix / simplified transversal check

2cc1eb3

use env

283729d

fix reference use instefof instead of invalid contains use

lucas-zimerman force-pushed the lz/ext-danger branch from af33680 to 283729d Compare October 20, 2025 15:11

vaind requested changes Oct 21, 2025

View reviewed changes

lucas-zimerman and others added 5 commits October 21, 2025 16:43

Apply suggestions from code review

5cbc268

Co-authored-by: Ivan Dlugos <6349682+vaind@users.noreply.github.com>

applied suggestion

5cdeef3

missing dangerfile input definition

49e1cb3

fix empty EXTRA_DANGERFILE_INPUT

f2dfd1a

fix env name

0a9ab78

applied code suggestions

3b57951

lucas-zimerman force-pushed the lz/ext-danger branch from d0106b4 to 3b57951 Compare October 21, 2025 16:13

lucas-zimerman requested a review from vaind October 21, 2025 16:14

vaind reviewed Oct 29, 2025

View reviewed changes

danger/action.yml Outdated Show resolved Hide resolved

vaind reviewed Oct 29, 2025

View reviewed changes

danger/action.yml Outdated Show resolved Hide resolved

vaind and others added 4 commits October 29, 2025 09:22

Apply suggestion from @vaind

5a3a11d

Apply suggestion from @vaind

5be5614

chore: minor refactoring

240ed21

vaind merged commit d6ae7f7 into getsentry:main Oct 29, 2025
5 checks passed

vaind added a commit that referenced this pull request Oct 29, 2025

chore: add changelog entry for recent PR #129

17cc15e

lucas-zimerman deleted the lz/ext-danger branch October 29, 2025 11:05

Uh oh!

Feat: Allow repo specific dangerfile. #129

Feat: Allow repo specific dangerfile. #129

Uh oh!

Conversation

lucas-zimerman commented Oct 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How external libraries should be implemented

Uh oh!

Uh oh!

lucas-zimerman commented Oct 6, 2025

Uh oh!

Uh oh!

lucas-zimerman commented Oct 6, 2025

Uh oh!

vaind commented Oct 8, 2025

Uh oh!

vaind commented Oct 9, 2025

Uh oh!

Uh oh!

lucas-zimerman commented Oct 9, 2025

Uh oh!

Uh oh!

Uh oh!

lucas-zimerman commented Oct 10, 2025

Uh oh!

lucas-zimerman commented Oct 10, 2025

Uh oh!

vaind commented Oct 14, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lucas-zimerman commented Oct 14, 2025

Uh oh!

Uh oh!

seer-by-sentry bot Oct 14, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lucas-zimerman commented Oct 15, 2025

Uh oh!

vaind commented Oct 16, 2025

Uh oh!

lucas-zimerman commented Oct 20, 2025

Uh oh!

vaind left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lucas-zimerman commented Oct 21, 2025

Uh oh!

lucas-zimerman commented Oct 21, 2025

Uh oh!

Uh oh!

Uh oh!

vaind commented Oct 29, 2025

Uh oh!

Uh oh!

vaind commented Oct 29, 2025

Uh oh!

lucas-zimerman commented Oct 29, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

lucas-zimerman commented Oct 6, 2025 •

edited

Loading