[trvny]

The 7 individual github-readme-stats-action@v2 calls each repeat pnpm/Node setup and may reinstall the core renderer. Checkout the upstream v2.1.0 renderer once at a pinned SHA, prepare pnpm/Node once, share a lockfile-keyed pnpm cache, and generate all 7 SVGs through its unchanged entrypoint using the original options/token selection.

Card generation stays restricted to workflow_dispatch/workflow_call. The contributor-only scheduled/push path does not install Node dependencies. Use the upstream bundled core 2.2.0 and fail closed on renderer API errors rather than committing an error-card SVG.

Summary by CodeRabbit

• 功能更新
  • 手动触发或通过可复用工作流调用时，现在会生成七张个人资料卡片，卡片类型、选项和输出位置保持不变。
• 可靠性改进
  • 卡片生成失败时，工作流会明确报告失败。

[kanarek-companion]

🐤 Kanarek · 🟣 merged

main ✅

Merged. Kanarek applies the tiny official beak stamp.

_{Kanarek · 1 files}

[sourcery-ai]

Reviewer's Guide

The workflow now checks out a pinned upstream renderer, prepares Node/pnpm and installs dependencies once with lockfile-backed caching, then invokes the renderer directly to generate all seven cards while preserving their options, tokens, outputs, and event restrictions; renderer errors fail the job instead of producing error-card assets.

Sequence diagram for shared stats card generation

sequenceDiagram
    participant Workflow
    participant RendererRepo
    participant PnpmCache
    participant Renderer
    participant GitHubAPI

    Workflow->>RendererRepo: checkout pinned renderer
    Workflow->>PnpmCache: restore pnpm cache by pnpm-lock.yaml
    Workflow->>Renderer: pnpm install --frozen-lockfile --prod --ignore-scripts
    loop seven cards
        Workflow->>Renderer: node index.js with card options and token
        Renderer->>GitHubAPI: fetch card data
        GitHubAPI-->>Renderer: card data
        Renderer-->>Workflow: write SVG output
    end
    alt renderer API error
        Renderer-->>Workflow: fail with error
        Workflow-->>Workflow: stop before commit
    end

Loading

File-Level Changes

Change	Details	Files
Consolidate renderer setup and dependency installation for all profile cards.	Check out the upstream renderer at a pinned v2.1.0 commit. Set up pnpm and Node once using the renderer package metadata. Install production dependencies with the lockfile and enable pnpm caching keyed to it.	.github/workflows/stats.yml
Replace seven composite action invocations with one shared rendering step while preserving card behavior.	Define a Bash helper that invokes the unchanged renderer entrypoint with per-card inputs and fail-on-error enabled. Generate the six repository/language cards and one gist card with their existing options and token selection. Keep card generation limited to manual and reusable workflow events.	.github/workflows/stats.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-17T10:38:46.541128Z	87a8d6b	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. The shared generation step puts GH_PAT in the environment for every renderer invocation, not just the gist-card invocation, so renderer code for any card can read it. If mishandled, the token could be exposed and used before a revert; revoking or rotating it would be needed to contain that.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: 2d2704ce-3899-4e68-9fbb-bc26731f2b68

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gptomek]

Addressed Sourcery's token-scope finding in dc94dfc: six public cards now render in a step with only GITHUB_TOKEN; only the separate gist step receives GH_PAT. Both reuse the same upstream checkout and dependency installation.