Skip to content
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
150 changes: 75 additions & 75 deletions .coderabbit.yaml
Original file line number Diff line number Diff line change
@@ -1,75 +1,75 @@
# CodeRabbit Configuration File
language: "en"
reviews:
profile: "assertive"
# Disables the "Prompt for all review comments with AI agents" feature
enable_prompt_for_ai_agents: false
# Disables the "🪄 Autofix (Beta)" feature and committable suggestions
finishing_touches:
autofix:
enabled: false
auto_review:
enabled: true
drafts: false
path_instructions:
- path: "**/*.html"
instructions: |
CRITICAL: Absolutely forbid the use of <table>, <tr>, <td>, or any table elements for structural layouts. If found, flag it as a major violation and instruct the user to use CSS Grid or Flexbox instead.
Ensure semantic HTML5 elements (nav, section, footer, main) are used correctly.
Ensure every <img> tag contains a meaningful, non-empty 'alt' attribute for accessibility.
Check that interactive elements use proper tags (like <button> or <a>) to maintain keyboard accessibility.
DO NOT provide any code diffs, code snippets, or committable suggestions. Provide plain text feedback only.
- path: "**/*.scss"
instructions: |
Ensure a strict Mobile-First styling approach is used (rely on min-width media queries, never max-width).
Enforce the BEM (Block-Element-Modifier) naming convention strictly for all classes.
Ensure the design layout relies strictly on display: grid or display: flex.
Flag and reject any imports or usage of external UI frameworks like Bootstrap or Material UI.
Check for proper SCSS mixins usage and standard SASS documentation/comments.
DO NOT provide any code diffs, code snippets, or committable suggestions. Provide plain text feedback only.
- path: "**/*.js"
instructions: |
Ensure the API data from the Gist endpoint is fetched only once and properly handled using async/await.
Verify that the "Spin & Win" wheel selection logic correctly picks 4 unique deals while excluding already won deals.
Ensure won deals are correctly accumulated, stored in state, and sorted by their relative validity date.
Check that Event Delegation is utilized effectively for interacting with dynamic UI lists (e.g., the Copy Code buttons).
Enforce standard JSDoc formatting and comments on all major functions.
DO NOT provide any code diffs, code snippets, or committable suggestions. Provide plain text feedback only.
tools:
eslint:
enabled: true
stylelint:
enabled: true
htmlhint:
enabled: true
gitleaks:
enabled: true
trufflehog:
enabled: true
osvScanner:
enabled: true
semgrep:
enabled: true
path_filters:
- "!node_modules/**"
- "!dist/**"
- "!build/**"
- "!.next/**"
- "!package-lock.json"
- "!yarn.lock"
- "!pnpm-lock.yaml"
- "!**/vendor/**"
- "!**/*.md"
# Disabling chat limits the AI's conversational auto-replies
chat:
auto_reply: false
# CodeRabbit Configuration File
language: 'en'

reviews:
profile: 'assertive'

# Disables the "Prompt for all review comments with AI agents" feature
enable_prompt_for_ai_agents: false

# Disables the "🪄 Autofix (Beta)" feature and committable suggestions
finishing_touches:
autofix:
enabled: false

auto_review:
enabled: true
drafts: false

path_instructions:
- path: '**/*.html'
instructions: |
CRITICAL: Absolutely forbid the use of <table>, <tr>, <td>, or any table elements for structural layouts. If found, flag it as a major violation and instruct the user to use CSS Grid or Flexbox instead.
Ensure semantic HTML5 elements (nav, section, footer, main) are used correctly.
Ensure every <img> tag contains a meaningful, non-empty 'alt' attribute for accessibility.
Check that interactive elements use proper tags (like <button> or <a>) to maintain keyboard accessibility.
DO NOT provide any code diffs, code snippets, or committable suggestions. Provide plain text feedback only.

- path: '**/*.scss'
instructions: |
Ensure a strict Mobile-First styling approach is used (rely on min-width media queries, never max-width).
Enforce the BEM (Block-Element-Modifier) naming convention strictly for all classes.
Ensure the design layout relies strictly on display: grid or display: flex.
Flag and reject any imports or usage of external UI frameworks like Bootstrap or Material UI.
Check for proper SCSS mixins usage and standard SASS documentation/comments.
DO NOT provide any code diffs, code snippets, or committable suggestions. Provide plain text feedback only.

- path: '**/*.js'
instructions: |
Ensure the API data from the Gist endpoint is fetched only once and properly handled using async/await.
Verify that the "Spin & Win" wheel selection logic correctly picks 4 unique deals while excluding already won deals.
Ensure won deals are correctly accumulated, stored in state, and sorted by their relative validity date.
Check that Event Delegation is utilized effectively for interacting with dynamic UI lists (e.g., the Copy Code buttons).
Enforce standard JSDoc formatting and comments on all major functions.
DO NOT provide any code diffs, code snippets, or committable suggestions. Provide plain text feedback only.

tools:
eslint:
enabled: true
stylelint:
enabled: true
htmlhint:
enabled: true
gitleaks:
enabled: true
trufflehog:
enabled: true
osvScanner:
enabled: true
semgrep:
enabled: true

path_filters:
- '!node_modules/**'
- '!dist/**'
- '!build/**'
- '!.next/**'
- '!package-lock.json'
- '!yarn.lock'
- '!pnpm-lock.yaml'
- '!**/vendor/**'
- '!**/*.md'

# Disabling chat limits the AI's conversational auto-replies
chat:
auto_reply: false
124 changes: 62 additions & 62 deletions .github/workflows/pr-check.yml
Original file line number Diff line number Diff line change
@@ -1,73 +1,73 @@
name: pr-check

on:
pull_request:
types: [opened, edited, reopened, synchronize]
pull_request:
types: [opened, edited, reopened, synchronize]

env:
STORY_ID: '[A-Z]{2,3}_A[0-9]+_[0-9]{2}'
STORY_ID: '[A-Z]{2,3}_A[0-9]+_[0-9]{2}'

jobs:
validate:
name: Validate branch, PR title and commits
runs-on: ubuntu-latest
steps:
- name: Checkout (full history for commit range)
uses: actions/checkout@v4
with:
fetch-depth: 0
validate:
name: Validate branch, PR title and commits
runs-on: ubuntu-latest
steps:
- name: Checkout (full history for commit range)
uses: actions/checkout@v4
with:
fetch-depth: 0
Comment on lines +15 to +18

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow file =="
cat -n .github/workflows/pr-check.yml | sed -n '1,80p'

echo
echo "== all checkout refs in workflows =="
rg -n "actions/checkout|persist-credentials|fetch-depth" .github/workflows || true

echo
echo "== diff stat/name-status =="
git diff --stat || true
git diff --name-status || true

Repository: jtg-inductions-fe/FE-Assignment-1-Manas-Gulati-UID00782-2026

Length of output: 3868


🌐 Web query:

actions/checkout v4 persist-credentials default true token local git config README

💡 Result:

In actions/checkout v4, the persist-credentials input has a default value of true [1][2][3]. When set to true, actions/checkout configures the repository's local git configuration to include an authentication token (typically the GITHUB_TOKEN) [4][5][6]. This is implemented by adding an http.{host}.extraheader configuration to the local.git/config file, which includes the authorization information [5][6]. This mechanism allows subsequent steps in the same job to execute authenticated git commands without needing to manually re-configure credentials [4][3][6]. If you set persist-credentials to false, this configuration step is skipped, and no authentication information is persisted in the local git config [5][6]. This is often recommended as a security best practice to reduce the risk of credential leakage if the workspace (including the.git directory) is uploaded as an artifact or accessed by malicious processes [6]. Note that setting this to false will prevent downstream git commands from using the automatically configured token, which may interfere with tools like gh auth setup-git that expect to manage their own credentials [5].

Citations:


Pin checkout to a commit SHA and disable credential persistence.

actions/checkout@v4 is tag-pinned, so the target can change. Also, checkout persists the workflow token in local Git config by default, which leaves credentials available to later steps. Pin a reviewed full SHA and add persist-credentials: false if the workflow only needs read-only checkout access.

🧰 Tools
🪛 zizmor (1.26.1)

[warning] 15-18: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)


[error] 16-16: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

Source: Linters/SAST tools


- name: Validate branch name
env:
BRANCH_NAME: ${{ github.head_ref }}
run: |
REGEX="^(${STORY_ID})(/.*)?$"
if ! echo "$BRANCH_NAME" | grep -Eq "$REGEX"; then
echo "::error::Invalid branch name '$BRANCH_NAME'"
echo "Branch must start with a Story ID, e.g. AJ_A1_00 or AJ_A1_00/base-setup"
exit 1
fi
echo "Branch name OK: $BRANCH_NAME"
- name: Validate branch name
env:
BRANCH_NAME: ${{ github.head_ref }}
run: |
REGEX="^(${STORY_ID})(/.*)?$"
if ! echo "$BRANCH_NAME" | grep -Eq "$REGEX"; then
echo "::error::Invalid branch name '$BRANCH_NAME'"
echo "Branch must start with a Story ID, e.g. AJ_A1_00 or AJ_A1_00/base-setup"
exit 1
fi
echo "Branch name OK: $BRANCH_NAME"

- name: Validate PR title
env:
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
REGEX="^\[(${STORY_ID})\]: .+"
if ! echo "$PR_TITLE" | grep -Eq "$REGEX"; then
echo "::error::Invalid PR title '$PR_TITLE'"
echo "PR title must follow: [Story_ID]: <Task Title> e.g. [AJ_A1_01]: Complete header section"
exit 1
fi
echo "PR title OK: $PR_TITLE"
- name: Validate PR title
env:
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
REGEX="^\[(${STORY_ID})\]: .+"
if ! echo "$PR_TITLE" | grep -Eq "$REGEX"; then
echo "::error::Invalid PR title '$PR_TITLE'"
echo "PR title must follow: [Story_ID]: <Task Title> e.g. [AJ_A1_01]: Complete header section"
exit 1
fi
echo "PR title OK: $PR_TITLE"

- name: Validate commit messages
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
BEFORE_SHA: ${{ github.event.before }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
REGEX="^\[(${STORY_ID})\]: .+"
STATUS=0
FROM_SHA="$BEFORE_SHA"
if [ -z "$FROM_SHA" ] \
|| [ "$FROM_SHA" = "0000000000000000000000000000000000000000" ] \
|| ! git cat-file -e "$FROM_SHA^{commit}" 2>/dev/null; then
FROM_SHA="$BASE_SHA"
fi
while IFS= read -r SUBJECT; do
[ -z "$SUBJECT" ] && continue
case "$SUBJECT" in
"Merge branch "*|"Merge pull request "*|"Merge remote-tracking "*) continue ;;
esac
if ! echo "$SUBJECT" | grep -Eq "$REGEX"; then
echo "::error::Invalid commit message: \"$SUBJECT\""
STATUS=1
fi
done < <(git log --format='%s' "$FROM_SHA".."$HEAD_SHA")
- name: Validate commit messages
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
BEFORE_SHA: ${{ github.event.before }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
REGEX="^\[(${STORY_ID})\]: .+"
STATUS=0
FROM_SHA="$BEFORE_SHA"
if [ -z "$FROM_SHA" ] \
|| [ "$FROM_SHA" = "0000000000000000000000000000000000000000" ] \
|| ! git cat-file -e "$FROM_SHA^{commit}" 2>/dev/null; then
FROM_SHA="$BASE_SHA"
fi
while IFS= read -r SUBJECT; do
[ -z "$SUBJECT" ] && continue
case "$SUBJECT" in
"Merge branch "*|"Merge pull request "*|"Merge remote-tracking "*) continue ;;
esac
if ! echo "$SUBJECT" | grep -Eq "$REGEX"; then
echo "::error::Invalid commit message: \"$SUBJECT\""
STATUS=1
fi
done < <(git log --format='%s' "$FROM_SHA".."$HEAD_SHA")

if [ "$STATUS" -ne 0 ]; then
echo "Each commit must follow: [Story_ID]: <message> e.g. [AJ_A1_01]: Add header"
exit 1
fi
echo "All commit messages OK"
if [ "$STATUS" -ne 0 ]; then
echo "Each commit must follow: [Story_ID]: <message> e.g. [AJ_A1_01]: Add header"
exit 1
fi
echo "All commit messages OK"
3 changes: 1 addition & 2 deletions index.html
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,9 @@
<title>Title</title>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<link rel="stylesheet" href="src/styles/main.scss" />
<link rel="stylesheet" href="./public/styles/main.css" />
</head>
<body>
<div>Hello World</div>
<script type="module" src="./src/script/index.js"></script>
</body>
</html>
Binary file added public/assets/fonts/icomoon.eot
Binary file not shown.
Binary file added public/assets/fonts/icomoon.ttf
Comment thread
manasgulatiJoshTech marked this conversation as resolved.
Outdated
Binary file not shown.
Binary file added public/assets/fonts/icomoon.woff
Binary file not shown.
Binary file added public/assets/images/Ellipse 23.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/Group 3.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/airbnb.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/booking.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/carousel.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/city.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/expedia.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/globe.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/logo.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/mountain.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/object.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/ocean.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/orbitz.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/plane.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/star.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/travel-point.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/triangles.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/tripadvisor.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file added public/assets/images/user.webp
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
35 changes: 35 additions & 0 deletions public/content.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
{
"header": {
"nav": ["home", "discover", "special deals", "contact"],
"buttons": ["log in", "sign up"]
},
"section-1": {
"float": "Explore the world!",
"heading": "Travel top destination of the world",
"sub-text": "We always make our customer happy by providing as many choices as possible "
},
"btn": ["get started", "watch demo"],
"section-2": {
"float": "travel point",
"heading": "We helping you find your dream location",
"sub-text": "Contrary to popular belief, Lorem Ipsum is not simply random text. It has roots in a piece of classical Latin literature from 45 BC."
Comment thread
manasgulatiJoshTech marked this conversation as resolved.
},
"card": {
"card_1": {
"number": "500+",
"heading": "holiday package"
},
"card_2": {
"number": "100",
"heading": "Luxury Hotel"
},
"card_3": {
"number": "7",
"heading": "Premium Airlines"
},
"card_4": {
"number": "2k+",
"heading": "Happy Customer"
}
}
}
Empty file added public/styles/main.css
Empty file.
Loading
Loading