Nisarg Patel
2e369e2d3b
setup-node@v5 defaults `package-manager-cache: true`, which auto-detects a `packageManager` field (e.g. pnpm) and runs the package manager to resolve the cache path. Consumer CI that doesn't install pnpm fails with "Unable to locate executable file: pnpm", which then cascades into the skipped scan step and a "Missing report path" render crash. The action runs via `npm exec` and never installs the consumer's deps, so there is nothing to cache — turn it off. Co-authored-by: Cursor <cursoragent@cursor.com>
Your agent writes bad React, this catches it.
React Doctor deterministically scans your codebase and finds issues across state & effects, performance, architecture, security, and accessibility.
Works for all React frameworks and libraries - Next.js, Vite, TanStack, React Native, Expo, you name it.
Install
1. Quick start
Run this at your project root to get an audit.
npx react-doctor@latest
https://github.com/user-attachments/assets/07cc88d9-9589-44c3-aa73-5d603cb1c570
2. Install for agents
Once you have an audit, you can install the skill for your coding agent to learn from the issues and fix them in the future.
npx react-doctor@latest install
Works with Claude Code, Cursor, Codex, OpenCode, and many more.
3. Run in CI (GitHub Actions) for your team
Add the reusable GitHub Action from Marketplace to scan every pull request, show inline annotations, and leave findings where reviewers already look.
name: React Doctor
on:
pull_request:
types: [opened, synchronize, reopened, ready_for_review]
permissions:
contents: read
pull-requests: write
issues: write
concurrency:
group: react-doctor-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
jobs:
react-doctor:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: millionco/react-doctor@main
React Doctor scans the files changed in the pull request, emits inline annotations, blocks on error-level findings, and updates one sticky PR comment with the score and issue summary. The built-in GitHub token is used automatically; no secret or PAT is required. On forked PRs where GitHub withholds write permissions, the scan and annotations still run, but the sticky comment may be skipped.
Contributing
MIT-licensed