chore(standards): synced file(s) with hallelx2/dev-standards - #1
chore(standards): synced file(s) with hallelx2/dev-standards#1hallelx2 wants to merge 10 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Reviewer's GuideSyncs dev-standards AI agent guidelines and security workflows into this repo, adding AGENTS/agent instruction docs, Copilot review guidance, path-scoped review instructions, and reusable GitHub Actions for security scanning and optional Jules security reviews on PRs. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
📝 WalkthroughWalkthroughThe change adds repository review standards, four specialized reviewer agents, Dependabot configuration, and GitHub Actions workflows for Jules reviews and security scanning. ChangesReview and security automation
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubEvent
participant security.yml
participant security.reusable.yml
participant SecurityScanners
participant SecurityEvents
GitHubEvent->>security.yml: pull request or main push
security.yml->>security.reusable.yml: invoke reusable workflow
security.reusable.yml->>SecurityScanners: run applicable scans
SecurityScanners->>SecurityEvents: upload SARIF findings
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
8ac11a7 to
8312ba0
Compare
There was a problem hiding this comment.
Pull request overview
This PR syncs shared engineering/AI-review standards and standardized security automation workflows from hallelx2/dev-standards into this repository, establishing consistent reviewer guidance and baseline security scanning across repos.
Changes:
- Adds
AGENTS.mdplus Copilot/agent reviewer definitions to standardize automated review behavior. - Introduces path-scoped backend/frontend/security instruction files under
.github/instructions/. - Adds security scanning workflows (gitleaks, Trivy, gosec) and an optional Jules-based PR security review workflow.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
AGENTS.md |
Adds repo-wide engineering and review standards for human + AI agents. |
.github/copilot-instructions.md |
Defines baseline Copilot PR review rubric and priorities. |
.github/agents/backend-reviewer.agent.md |
Adds Go-focused reviewer role definition. |
.github/agents/frontend-reviewer.agent.md |
Adds TS/Next-focused reviewer role definition. |
.github/agents/security-reviewer.agent.md |
Adds adversarial security reviewer role definition. |
.github/agents/test-reliability-reviewer.agent.md |
Adds test quality/determinism reviewer role definition. |
.github/instructions/backend.instructions.md |
Applies Go review rubric to **/*.go. |
.github/instructions/frontend.instructions.md |
Applies frontend review rubric to TS/TSX/CSS files. |
.github/instructions/security.instructions.md |
Applies security review rubric to all changed files. |
.github/workflows/security.yml |
Adds caller workflow to run standardized security scanning on PRs and main. |
.github/workflows/security.reusable.yml |
Adds reusable workflow implementing gitleaks/Trivy/gosec scanners. |
.github/workflows/jules-review.yml |
Adds optional automated Jules PR security review workflow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| security-events: write | ||
|
|
||
| jobs: | ||
| security: | ||
| # Local reference — the reusable file is synced into THIS repo too, so each repo | ||
| # is self-contained and this works whether dev-standards is public or private. | ||
| uses: ./.github/workflows/security.reusable.yml | ||
| secrets: inherit |
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| security-events: write |
| - name: gosec | ||
| if: steps.detect.outputs.is_go == 'true' | ||
| uses: securego/gosec@master | ||
| with: | ||
| args: -no-fail -fmt text ./... |
| - name: Guard — only run when a Jules key is configured | ||
| id: guard | ||
| run: | | ||
| if [ -n "${{ secrets.JULES_API_KEY }}" ]; then | ||
| echo "enabled=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "enabled=false" >> "$GITHUB_OUTPUT" | ||
| echo "No JULES_API_KEY set — skipping automated Jules review. Use @jules on the PR instead." | ||
| fi |
| - name: Jules security review | ||
| if: steps.guard.outputs.enabled == 'true' | ||
| uses: sanjay3290/jules-pr-reviewer@main | ||
| with: | ||
| jules-api-key: ${{ secrets.JULES_API_KEY }} | ||
| github-token: ${{ github.token }} |
8312ba0 to
0da8c86
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
0da8c86 to
6c99d8b
Compare
6c99d8b to
8254034
Compare
8254034 to
2cdacaa
Compare
2cdacaa to
abb9ef0
Compare
abb9ef0 to
fbcb471
Compare
* HAL-87: scaffold Vectorless docs site (Fumadocs) Brand-matched Fumadocs (Next.js App Router) documentation site for docs.vectorless.store. - Dark theme primary; Geist Sans + Geist Mono + Instrument Serif display - Blue->pink brand gradient and subtle grid background texture - Branded landing page (hero, feature grid, quickstart strip) - Sections: Getting Started, Core Concepts (tree retrieval, no-chunking, treewalk, citations), API Reference (placeholder), SDKs (TS/Python/Go), Self-hosting (Neon + R2 + QStash + Docker, placeholder) - Orama search, OG images, llms.txt - Uses canonical 'treewalk' strategy name (retired 'pageindex') * Redesign docs site to the LIGHT Vectorless brand (HAL-190) The Fumadocs site was wrongly built dark-first with a full-page grid wash and aura/glow pseudo-elements. Restyle it to match the brand visual identity in vectorless-why/DESIGN.md, which is LIGHT. - Default theme -> light (RootProvider defaultTheme: 'light'). - Light is now the primary, clean canvas: #FCFCFD, ink #0A0A0A, secondary #3F3F46, muted #71717A, hairlines #E5E7EB. - Remove the heavy body::before grid wash and body::after aura glow. Content/docs pages are clean near-white with whitespace. - Reintroduce only a very faint brand grid rgba(20,86,240,0.06) on the landing hero, masked to fade out (.vl-hero-grid). - Keep the blue->pink signal gradient on exactly one hero line; drop the second serif/gradient register on the pull quote (now plain light sans with a mono eyebrow caption). - Mono eyebrows at 0.16em tracking; body weight ~300 per DESIGN.md. - Quickstart block is now a real dark inset terminal (#0A0A0A) — the one place dark is allowed. - Dark theme retained as an optional toggle, not the default. Restyle only: nav, sidebar, search, section structure and content unchanged. pnpm build passes. * Redesign docs site to the LIGHT Vectorless brand (HAL-190) (#1) The Fumadocs site was wrongly built dark-first with a full-page grid wash and aura/glow pseudo-elements. Restyle it to match the brand visual identity in vectorless-why/DESIGN.md, which is LIGHT. - Default theme -> light (RootProvider defaultTheme: 'light'). - Light is now the primary, clean canvas: #FCFCFD, ink #0A0A0A, secondary #3F3F46, muted #71717A, hairlines #E5E7EB. - Remove the heavy body::before grid wash and body::after aura glow. Content/docs pages are clean near-white with whitespace. - Reintroduce only a very faint brand grid rgba(20,86,240,0.06) on the landing hero, masked to fade out (.vl-hero-grid). - Keep the blue->pink signal gradient on exactly one hero line; drop the second serif/gradient register on the pull quote (now plain light sans with a mono eyebrow caption). - Mono eyebrows at 0.16em tracking; body weight ~300 per DESIGN.md. - Quickstart block is now a real dark inset terminal (#0A0A0A) — the one place dark is allowed. - Dark theme retained as an optional toggle, not the default. Restyle only: nav, sidebar, search, section structure and content unchanged. pnpm build passes. * docs: use the real Vectorless V logo in nav + favicon (HAL-191) Replace the invented node-graph mark with the canonical logo — blue tile + white V (M4 4 L12 20 L20 4) + pink focal dot — matching vectorless-dashboard's icon.tsx; add the matching app favicon. Wordmark in Geist medium. Closes HAL-191. * docs: use the real Vectorless V logo in nav + favicon (HAL-191) (#2) Replace the invented node-graph mark with the canonical logo — blue tile + white V (M4 4 L12 20 L20 4) + pink focal dot — matching vectorless-dashboard's icon.tsx; add the matching app favicon. Wordmark in Geist medium. Closes HAL-191. * Polish docs home page design Elevate the marketing/home surface within the Vectorless light brand: - Hero: real V mark, staggered precision reveal, refined terminal inset - New document -> tree -> cited answer SVG motif (hairline, blue path, single pink citation dot; edges draw + nodes snap) - Feature grid with mono index numbers and hover accent - Parse/Walk/Cite three-step band - Refined Instrument-Serif thesis closer with CTA No new gradients, no dark page bg, no new mark - honors DESIGN.md. * feat(docs): premium landing page redesign with GSAP and HeroShader * style(docs): mintlify-inspired redesign and hero button fix * chore(docs): redirect primary GitHub links to vectorless-engine * fix(docs): resolve hero stacking and button visibility issues * style(docs): fix code block contrast and remove card blue border * chore: remove deprecated packages ts-sdk, openapi, and mcp-tools * feat: migrate docs and blogs to monorepo and update branding * style: premium editorial layout redesign for vectorless blog * style: expand layout to full-width page * ci: update workflows to match monorepo package configuration * fix: resolve workspace react type conflicts by overriding react and react types * chore: add typecheck scripts for all monorepo apps to run under turborepo * fix: resolve lint errors and warnings across workspace packages
fbcb471 to
3b24fc2
Compare
3b24fc2 to
96ea85b
Compare
96ea85b to
2d733c2
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # Local reference — the reusable file is synced into THIS repo too, so each repo | ||
| # is self-contained and this works whether dev-standards is public or private. | ||
| uses: ./.github/workflows/security.reusable.yml | ||
| secrets: inherit |
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Install Trivy (latest binary — avoids the action's broken setup-trivy pin) | ||
| run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin |
| name: Vulns + misconfig (Trivy) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| id: detect | ||
| run: | | ||
| if ls requirements*.txt pyproject.toml setup.py >/dev/null 2>&1; then echo "is_py=true" >> "$GITHUB_OUTPUT"; else echo "is_py=false" >> "$GITHUB_OUTPUT"; fi | ||
| - uses: actions/setup-python@v5 |
| name: Python deps + SAST (pip-audit + bandit) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - uses: gitleaks/gitleaks-action@v2 |
| name: Secrets (gitleaks) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| - package-ecosystem: npm | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 5 | ||
| labels: [dependencies, security] |
| - package-ecosystem: gomod | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 5 | ||
| labels: [dependencies, security] |
| - package-ecosystem: github-actions | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| labels: [dependencies, security] |
bc1147e to
df751a2
Compare
df751a2 to
dbf22fe
Compare
dbf22fe to
19c3e80
Compare
19c3e80 to
e146afe
Compare
Synced AI-review standards from hallelx2/dev-standards.
…m remote '.github/copilot-instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…b/agents/' Synced AI-review standards from hallelx2/dev-standards.
…tions.md' from remote '.github/instructions/backend.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…ctions.md' from remote '.github/instructions/frontend.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…ctions.md' from remote '.github/instructions/security.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
… remote '.github/workflows/security.yml' Synced AI-review standards from hallelx2/dev-standards.
…yml' from remote '.github/workflows/security.reusable.yml' Synced AI-review standards from hallelx2/dev-standards.
…from remote '.github/workflows/jules-review.yml' Synced AI-review standards from hallelx2/dev-standards.
…'.github/dependabot.yml' Synced AI-review standards from hallelx2/dev-standards.
e146afe to
230fcfc
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🧹 Nitpick comments (1)
.github/workflows/jules-review.yml (1)
9-19: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winCancel stale Jules review runs.
Multiple
synchronizeevents can start overlapping runs. An older run can post findings after a newer commit. Add a per-PR concurrency group.Proposed fix
name: jules-review +concurrency: + group: jules-review-${{ github.event.pull_request.number }} + cancel-in-progress: true + on:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/jules-review.yml around lines 9 - 19, Update the GitHub Actions workflow’s jules job configuration to add a per-pull-request concurrency group using the pull request number, and cancel in-progress runs when a newer run starts. Keep the existing triggers, permissions, and runner configuration unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/copilot-instructions.md:
- Around line 5-6: Update the “Review in this order” guidance in the
review-level instructions to flag any failed level and then continue through all
remaining levels, preserving the sequential scope, correctness, and security
checks.
- Line 22: Update the guidance around path-scoped review in the instructions
text: state that rubrics in `.github/instructions/` apply automatically, but
specialized agents in `.github/agents/` require explicit selection or workflow
invocation. Remove the implication that specialized agents apply automatically,
while preserving the existing security-review guidance.
In @.github/dependabot.yml:
- Around line 6-10: Add a cooldown configuration with default-days set to 7 to
each Dependabot update block: the github-actions block at .github/dependabot.yml
lines 6-10, the gomod block at lines 12-17, and the npm block at lines 19-24.
In @.github/workflows/jules-review.yml:
- Around line 21-29: Update the guard step identified by id "guard" so the
secret is passed through the step’s env configuration rather than interpolated
in the shell script. Test the quoted "$JULES_API_KEY" environment variable for
non-empty content while preserving the existing enabled output and skip message
behavior.
In @.github/workflows/security.reusable.yml:
- Line 46: Make the security workflow fail on configured vulnerability findings
by updating .github/workflows/security.reusable.yml:46-46 to remove Semgrep’s ||
true, 71-71 to remove govulncheck’s || true, 86-86 to remove gosec’s -no-fail,
104-105 to propagate dependency-resolution and npm-audit failures, 124-125 to
propagate pip-audit and in-scope Bandit findings, and 135-135 to configure Trivy
with a nonzero exit code for the selected severities.
- Around line 22-24: Disable credential persistence for every
actions/checkout@v4 step in .github/workflows/security.reusable.yml at lines
22-24, 35, 58, 77, 92, 111, and 131 by setting persist-credentials to false
alongside the existing checkout options.
- Around line 123-124: Update the pip-audit invocation in the security workflow
to target the repository’s Python dependency manifest rather than the scanner’s
installed environment. Use the project’s supported manifest or audit path, such
as pip-audit with the requirements files, the project directory, or the uv-based
path for sdks/python, while preserving the existing failure-handling behavior.
- Line 33: Update the Semgrep container image reference in the workflow’s image
configuration to use an explicit immutable digest instead of the mutable
semgrep/semgrep tag, preserving the existing Semgrep scan behavior.
In @.github/workflows/security.yml:
- Around line 21-22: Remove the `secrets: inherit` entry from the workflow
caller that uses `./.github/workflows/security.reusable.yml`; leave the reusable
workflow reference unchanged, since its scanner steps use `github.token` and
declare no required workflow-call secrets.
In `@AGENTS.md`:
- Line 12: Update the “Done” completion rule in AGENTS.md to show every required
repository check: configured Go build, race-enabled Go tests, Go lint, and the
applicable Bun/npm JavaScript or TypeScript build, test, and lint commands.
Replace plain go test and incomplete build-only examples, and align the commands
with the race-detection requirement referenced by the existing guidance.
---
Nitpick comments:
In @.github/workflows/jules-review.yml:
- Around line 9-19: Update the GitHub Actions workflow’s jules job configuration
to add a per-pull-request concurrency group using the pull request number, and
cancel in-progress runs when a newer run starts. Keep the existing triggers,
permissions, and runner configuration unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3e392df0-5a9d-4784-b4fa-96595697e64d
📒 Files selected for processing (13)
.github/agents/backend-reviewer.agent.md.github/agents/frontend-reviewer.agent.md.github/agents/security-reviewer.agent.md.github/agents/test-reliability-reviewer.agent.md.github/copilot-instructions.md.github/dependabot.yml.github/instructions/backend.instructions.md.github/instructions/frontend.instructions.md.github/instructions/security.instructions.md.github/workflows/jules-review.yml.github/workflows/security.reusable.yml.github/workflows/security.ymlAGENTS.md
| Review in this order, stop-and-flag if a level fails: | ||
|
|
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Continue through all review levels after a failure.
Line 5 instructs reviewers to stop after the first failed level. The repository standard requires scope, correctness, and security checks in sequence. Stopping at a scope failure can hide an independent security finding. Replace “stop-and-flag” with “flag, then continue through the remaining levels.”
As per coding guidelines, reviewers must flag failures at each level before proceeding to the next level.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/copilot-instructions.md around lines 5 - 6, Update the “Review in
this order” guidance in the review-level instructions to flag any failed level
and then continue through all remaining levels, preserving the sequential scope,
correctness, and security checks.
Source: Coding guidelines
| - New dependencies: justified, reputable, no known CVEs. | ||
| - Concurrency (Go): data races, unguarded shared state, leaked goroutines. | ||
|
|
||
| For deeper, area-specific review, the specialized agents in `.github/agents/` and the path-scoped rubrics in `.github/instructions/` apply automatically. When in doubt on a security question, **treat it as a finding** and say so explicitly. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
rg -n -C 3 'agents/|review-prompt|copilot-instructions|instructions/' AGENTS.md .githubRepository: hallelx2/vectorless
Length of output: 2797
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- AGENTS.md lines 1-35 ---\n'
sed -n '1,35p' AGENTS.md
printf '\n--- .github/copilot-instructions.md lines 1-30 ---\n'
sed -n '1,30p' .github/copilot-instructions.md
printf '\n--- .github/workflows/jules-review.yml lines 1-55 ---\n'
sed -n '1,55p' .github/workflows/jules-review.yml
printf '\n--- agent instruction files ---\n'
fd -a '\.agent\.md$|\.md$' .github/agents .github/instructions 2>/dev/null | sortRepository: hallelx2/vectorless
Length of output: 248
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- AGENTS.md lines 1-35 ---'
sed -n '1,35p' AGENTS.md
printf '%s\n' ''
printf '%s\n' '--- .github/copilot-instructions.md lines 1-30 ---'
sed -n '1,30p' .github/copilot-instructions.md
printf '%s\n' ''
printf '%s\n' '--- .github/workflows/jules-review.yml lines 1-55 ---'
sed -n '1,55p' .github/workflows/jules-review.yml
printf '%s\n' ''
printf '%s\n' '--- agent/rubric instruction files ---'
git ls-files '.github/agents/*' '.github/instructions/*' 2>/dev/null | sortRepository: hallelx2/vectorless
Length of output: 6648
Do not say specialized agents apply automatically.
Line 22 makes every specialized agent sound automatic. AGENTS.md says to tag specialized reviewers for a deep pass, and the Jules workflow feeds .github/agents/security-reviewer.agent.md through review-prompt. Reword this to say path-scoped rubrics in .github/instructions/ apply automatically, while specialized agents need explicit selection or workflow invocation.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~22-~22: The official name of this software platform is spelled with a capital “H”.
Context: ...cific review, the specialized agents in .github/agents/ and the path-scoped rubrics in...
(GITHUB)
[uncategorized] ~22-~22: The official name of this software platform is spelled with a capital “H”.
Context: ...agents/and the path-scoped rubrics in.github/instructions/` apply automatically. Whe...
(GITHUB)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/copilot-instructions.md at line 22, Update the guidance around
path-scoped review in the instructions text: state that rubrics in
`.github/instructions/` apply automatically, but specialized agents in
`.github/agents/` require explicit selection or workflow invocation. Remove the
implication that specialized agents apply automatically, while preserving the
existing security-review guidance.
| - package-ecosystem: github-actions | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| labels: [dependencies, security] |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
Add a seven-day cooldown to every Dependabot update block.
All three update blocks omit cooldown.default-days. Add:
cooldown:
default-days: 7.github/dependabot.yml#L6-L10: add the cooldown to thegithub-actionsblock..github/dependabot.yml#L12-L17: add the cooldown to thegomodblock..github/dependabot.yml#L19-L24: add the cooldown to thenpmblock.
As per coding guidelines, dependency risk is part of the required security review.
🧰 Tools
🪛 GitHub Check: Semgrep OSS
[warning] 6-10: Semgrep Finding: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown
This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a cooldown block with default-days: 7 to each package-ecosystem entry under updates to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
📍 Affects 1 file
.github/dependabot.yml#L6-L10(this comment).github/dependabot.yml#L12-L17.github/dependabot.yml#L19-L24
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/dependabot.yml around lines 6 - 10, Add a cooldown configuration
with default-days set to 7 to each Dependabot update block: the github-actions
block at .github/dependabot.yml lines 6-10, the gomod block at lines 12-17, and
the npm block at lines 19-24.
Sources: Coding guidelines, Linters/SAST tools
| - name: Guard — only run when a Jules key is configured | ||
| id: guard | ||
| run: | | ||
| if [ -n "${{ secrets.JULES_API_KEY }}" ]; then | ||
| echo "enabled=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "enabled=false" >> "$GITHUB_OUTPUT" | ||
| echo "No JULES_API_KEY set — skipping automated Jules review. Use @jules on the PR instead." | ||
| fi |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
sed -n '1,80p' .github/workflows/jules-review.yml 2>/dev/null || true
echo
echo "== all interpolations of JULES_API_KEY in workflows =="
rg -n '\$\{\{\s*secrets\.JULES_API_KEY\s*\}\}' .github/workflows || true
echo
echo "== surrounding workflow context =="
cat -n .github/workflows/jules-review.yml | sed -n '1,80p'Repository: hallelx2/vectorless
Length of output: 4045
🌐 Web query:
GitHub Actions secrets injected as environment variables command injection run step interpolate expressions avoid using untrusted expressions
💡 Result:
In GitHub Actions, using the ${{ }} expression syntax directly within run steps creates a significant security risk known as command injection [1][2][3]. This occurs because GitHub processes these expressions via macro-expansion before the shell interprets the script, effectively injecting the value directly into your command string [1][4][3]. If the value contains malicious input—such as an attacker-controlled issue title or branch name—the injected code will execute with the permissions of the runner [2][5][3]. To prevent this, you should never interpolate untrusted expressions directly into shell commands [4]. Instead, use the following best practices: 1. Use intermediate environment variables: Set the untrusted input to an environment variable in the env block of the step [1][6][7]. This ensures the value is stored in memory rather than being interpolated into the script during generation [1][8][9]. Example (Secure): env: UNTRUSTED_INPUT: ${{ github.event.issue.title }} run: | echo "$UNTRUSTED_INPUT" 2. Reference variables using native shell syntax: Once the input is assigned to an environment variable, access it using standard shell syntax (e.g., "$UNTRUSTED_INPUT") rather than GitHub's expression syntax [6][7][3]. Using the ${{ env.VAR }} syntax inside the run block will re-introduce the vulnerability by expanding the value during script generation [6]. 3. Quote variables: Always wrap shell variables in double quotes to prevent word splitting and other common shell injection issues [1][8][7]. 4. Follow the principle of least privilege: Even when using environment variables, the input remains untrusted [2][3]. Reduce the risk by limiting the permissions of the GITHUB_TOKEN for your workflows and using code scanning to detect potential injection vulnerabilities automatically [2][6][3]. By treating all external input as untrusted and relying on environment variables to pass data safely into your scripts, you can significantly mitigate the risk of command injection [1][2][5].
Citations:
- 1: https://docs.github.com/en/enterprise-server@2.22/actions/security-guides/security-hardening-for-github-actions
- 2: https://github.blog/security/supply-chain-security/four-tips-to-keep-your-github-actions-workflows-secure/
- 3: https://github.blog/security/vulnerability-research/how-to-catch-github-actions-workflow-injections-before-attackers-do/
- 4: https://phpunit.expert/articles/hardening-github-actions-workflows.html
- 5: https://docs.github.com/en/actions/concepts/security/script-injections
- 6: https://github.com/github/codeql/blob/main/actions/ql/src/Security/CWE-094/CodeInjectionMedium.md
- 7: https://securitylab.github.com/resources/github-actions-untrusted-input/
- 8: https://docs.github.com/en/actions/reference/security/secure-use
- 9: https://github.com/github/docs/blob/main/content/actions/reference/security/secure-use.md
Do not interpolate JULES_API_KEY into the workflow script.
${{ secrets.JULES_API_KEY }} is expanded before the shell parses the step, so a secret containing quotes, command substitution, or a newline can alter the commands. Pass the secret through env and test "$JULES_API_KEY".
Proposed fix
- name: Guard — only run when a Jules key is configured
id: guard
+ env:
+ JULES_API_KEY: ${{ secrets.JULES_API_KEY }}
run: |
- if [ -n "${{ secrets.JULES_API_KEY }}" ]; then
+ if [ -n "$JULES_API_KEY" ]; then📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Guard — only run when a Jules key is configured | |
| id: guard | |
| run: | | |
| if [ -n "${{ secrets.JULES_API_KEY }}" ]; then | |
| echo "enabled=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "enabled=false" >> "$GITHUB_OUTPUT" | |
| echo "No JULES_API_KEY set — skipping automated Jules review. Use @jules on the PR instead." | |
| fi | |
| - name: Guard — only run when a Jules key is configured | |
| id: guard | |
| env: | |
| JULES_API_KEY: ${{ secrets.JULES_API_KEY }} | |
| run: | | |
| if [ -n "$JULES_API_KEY" ]; then | |
| echo "enabled=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "enabled=false" >> "$GITHUB_OUTPUT" | |
| echo "No JULES_API_KEY set — skipping automated Jules review. Use `@jules` on the PR instead." | |
| fi |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/jules-review.yml around lines 21 - 29, Update the guard
step identified by id "guard" so the secret is passed through the step’s env
configuration rather than interpolated in the shell script. Test the quoted
"$JULES_API_KEY" environment variable for non-empty content while preserving the
existing enabled output and skip message behavior.
Source: Coding guidelines
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== file sizes =="
wc -l .github/workflows/security.reusable.yml 2>/dev/null || true
echo "== relevant workflow section =="
sed -n '1,160p' .github/workflows/security.reusable.yml 2>/dev/null || true
echo "== checkout occurrences with nearby lines =="
nl -ba .github/workflows/security.reusable.yml 2>/dev/null | sed -n '1,160p' | awk '/uses: actions\/checkout/{start=NR-4; end=NR+6; for(i=start;i<=end;i++) if(a[i]) print a[i]; delete a} {a[NR]=$0}'Repository: hallelx2/vectorless
Length of output: 5145
🌐 Web query:
actions/checkout v4 persist-credentials default true README
💡 Result:
In actions/checkout v4, the default value for the persist-credentials input is true [1][2][3]. When persist-credentials is set to true (the default), the action persists the authentication token or SSH key in the local git configuration [1][4]. This allows subsequent steps in your workflow to run authenticated git commands (e.g., git push) without needing to manually configure credentials [1][5]. The token is automatically removed during the post-job cleanup phase [1][4]. If you do not require these permissions for subsequent steps, you can set persist-credentials to false to opt-out and enhance your workflow security [1][5].
Citations:
- 1: https://github.com/actions/checkout/blob/v4/README.md
- 2: https://github.com/actions/checkout/blob/v4/action.yml
- 3: https://github.com/actions/checkout/blob/v4.1.1/action.yml
- 4: https://github.com/actions/checkout
- 5: https://github.com/actions/checkout/?tab=readme-ov-file
Disable credential persistence in every scanner checkout.
actions/checkout@v4 persists the workflow token in .git/config by default. Set persist-credentials: false on these seven checkout steps because the scanners only need the worktree.
🧰 Tools
🪛 GitHub Check: Semgrep OSS
[warning] 22-22: Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🪛 zizmor (1.28.0)
[warning] 22-24: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
📍 Affects 1 file
.github/workflows/security.reusable.yml#L22-L24(this comment).github/workflows/security.reusable.yml#L35-L35.github/workflows/security.reusable.yml#L58-L58.github/workflows/security.reusable.yml#L77-L77.github/workflows/security.reusable.yml#L92-L92.github/workflows/security.reusable.yml#L111-L111.github/workflows/security.reusable.yml#L131-L131
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.reusable.yml around lines 22 - 24, Disable
credential persistence for every actions/checkout@v4 step in
.github/workflows/security.reusable.yml at lines 22-24, 35, 58, 77, 92, 111, and
131 by setting persist-credentials to false alongside the existing checkout
options.
Source: Linters/SAST tools
| name: SAST — OWASP Top 10 + CWE Top 25 (Semgrep) | ||
| runs-on: ubuntu-latest | ||
| container: | ||
| image: semgrep/semgrep |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Repository files matching security workflows:\n'
git ls-files | rg '(^|/)(security.*\.yml|security.*\.yaml)$|\.github/workflows/' || true
printf '\nWorkflow snippets:\n'
for f in .github/workflows/security.yml .github/workflows/security.reusable.yml; do
if [ -f "$f" ]; then
echo "--- $f"
nl -ba "$f" | sed -n '1,220p'
fi
done
printf '\nDigest/tag-related patterns in workflows:\n'
rg -n '@|container:\s*image:|git://|sha256:|digest' .github/workflows 2>/dev/null || trueRepository: hallelx2/vectorless
Length of output: 467
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- .github/workflows/security.yml\n'
awk '{printf "%6d %s\n", NR, $0}' .github/workflows/security.yml
printf '\n--- .github/workflows/security.reusable.yml\n'
awk '{printf "%6d %s\n", NR, $0}' .github/workflows/security.reusable.yml
printf '\n--- Digest/tag-related patterns in workflows\n'
rg -n '@|container:\s*image:|git://|sha256:|digest' .github/workflows 2>/dev/null || true
python3 - <<'PY'
from urllib.request import urlopen, Request
import json
repo = 'semgrep/semgrep'
tag = 'latest' # default used when no digest/tag is supplied
ref = f'https://api.github.com/repos/{repo}/git/ref/tags/{tag}'
req = Request(ref, headers={'Accept': 'application/vnd.github+json', 'User-Agent': 'CodeRabbit-verifier'})
try:
with urlopen(req, timeout=15) as r:
data = json.loads(r.read())
print(f'TAG_REF={ref}')
print('object_type', data.get('object', {}).get('type'))
print('tag-object_sha', data.get('object', {}).get('sha'))
except Exception as e:
print('GITHUB_REF_QUERY_ERROR', repr(e))
PY
python3 - <<'PY'
from urllib.request import urlopen, Request
import json
repo = 'semgrep/semgrep'
image = 'docker-registry.redhat.io/openshift/release/semgrep'
tag = 'latest'
urls = [
f'https://api.github.com/repos/{repo}/releases/tags/{tag}',
f'https://hub.docker.com/v2/repositories/{repo}/tags/{tag}',
]
for url in urls:
req = Request(url, headers={'Accept': 'application/vnd.github+json,application/json;data=json;profiles=meta,vnd.docker.distribution.manifest.v2+json', 'User-Agent': 'CodeRabbit-verifier'})
try:
with urlopen(req, timeout=15) as r:
body = r.read(2048)
print(f'URL={url}')
print('status', r.status)
print('url', url)
print('last_modified', r.headers.get('last-modified'))
print('content_type', r.headers.get('content-type'))
print('body:', body.decode('utf-8', 'replace')[:2000])
except Exception as e:
print(f'URL={url} ERROR={repr(e)}')
PYRepository: hallelx2/vectorless
Length of output: 248
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- .github/workflows/security.yml'
awk '{printf "%6d %s", NR, $0; print ""}' .github/workflows/security.yml
printf '%s\n' ''
printf '%s\n' '--- .github/workflows/security.reusable.yml'
awk '{printf "%6d %s", NR, $0; print ""}' .github/workflows/security.reusable.yml
printf '%s\n' ''
printf '%s\n' '--- Digest/tag-related patterns in workflows'
rg -n '@|container:\s*image:|git://|sha256:|digest' .github/workflows 2>/dev/null || trueRepository: hallelx2/vectorless
Length of output: 9573
🌐 Web query:
Semgrep Docker image latest tag digest semgrep/semgrep
💡 Result:
As of August 3, 2026, the Docker image digest for the semgrep/semgrep:latest tag is sha256:296fc4912420833abfcf5090ec49a81bf1330bb61fc193cd09255f88b8267ba9 [1]. It is important to note that Docker image digests for mutable tags like latest change whenever the image is updated by the maintainers [2][3]. Because the contents of the latest tag are dynamic, you should verify the current digest in your local environment using the following command if you require the exact hash for security or reproducibility purposes: docker inspect --format='{{index.RepoDigests 0}}' semgrep/semgrep:latest Alternatively, you can view the most up-to-date digest directly on the official Docker Hub page for the semgrep/semgrep repository [2][3].
Citations:
- 1: https://hub.docker.com/layers/semgrep/semgrep/latest/images/sha256-296fc4912420833abfcf5090ec49a81bf1330bb61fc193cd09255f88b8267ba9
- 2: https://hub.docker.com/r/semgrep/semgrep/tags?name=latest&page=1
- 3: https://hub.docker.com/r/semgrep/semgrep/tags
Pin the Semgrep container image by digest.
.github/workflows/security.reusable.yml:33 uses semgrep/semgrep, which resolves to the mutable latest image. A tag update can change the scanner code or dependencies without a repository change. Pin an explicit image digest for this Semgrep scan.
🧰 Tools
🪛 zizmor (1.28.0)
[error] 33-33: unpinned image references (unpinned-images): container image is unpinned
(unpinned-images)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.reusable.yml at line 33, Update the Semgrep
container image reference in the workflow’s image configuration to use an
explicit immutable digest instead of the mutable semgrep/semgrep tag, preserving
the existing Semgrep scan behavior.
Source: Linters/SAST tools
| --config p/typescript \ | ||
| --config p/python \ | ||
| --config p/github-actions \ | ||
| --sarif --output semgrep.sarif || true |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Make detected vulnerabilities fail this security workflow.
These commands force successful exit status after findings. This reusable workflow therefore passes despite Semgrep, Go, Node, Python, and Trivy findings. The caller runs it on pull requests and pushes to main.
.github/workflows/security.reusable.yml#L46-L46: remove|| truefrom the Semgrep scan..github/workflows/security.reusable.yml#L71-L71: remove|| truefromgovulncheck..github/workflows/security.reusable.yml#L86-L86: remove-no-failfromgosec..github/workflows/security.reusable.yml#L104-L105: fail when dependency resolution ornpm auditfails..github/workflows/security.reusable.yml#L124-L125: fail whenpip-auditor Bandit finds in-scope issues..github/workflows/security.reusable.yml#L135-L135: use a nonzero Trivy exit code for configured severities.
📍 Affects 1 file
.github/workflows/security.reusable.yml#L46-L46(this comment).github/workflows/security.reusable.yml#L71-L71.github/workflows/security.reusable.yml#L86-L86.github/workflows/security.reusable.yml#L104-L105.github/workflows/security.reusable.yml#L124-L125.github/workflows/security.reusable.yml#L135-L135
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.reusable.yml at line 46, Make the security
workflow fail on configured vulnerability findings by updating
.github/workflows/security.reusable.yml:46-46 to remove Semgrep’s || true, 71-71
to remove govulncheck’s || true, 86-86 to remove gosec’s -no-fail, 104-105 to
propagate dependency-resolution and npm-audit failures, 124-125 to propagate
pip-audit and in-scope Bandit findings, and 135-135 to configure Trivy with a
nonzero exit code for the selected severities.
Sources: Coding guidelines, Learnings
| pip install --quiet pip-audit bandit | ||
| pip-audit || true |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repository files related to security workflow / requirements:"
git ls-files | rg '(^|/)(\.github/workflows/security\.reusable\.yml|requirements.*\.txt|pyproject\.toml|setup\.py|setup\.cfg|Pipfile|poetry\.lock|uv\.lock|pip-audit)' || true
echo
echo "Security workflow around relevant lines:"
if [ -f .github/workflows/security.reusable.yml ]; then
nl -ba .github/workflows/security.reusable.yml | sed -n '1,180p'
fi
echo
echo "pip-audit usage docs/sources locally if installed:"
python3 - <<'PY'
try:
import subprocess
p = subprocess.run(["pip-audit", "--help"], text=True, capture_output=True, timeout=20)
print("STDOUT:")
print(p.stdout)
print("STDERR:")
print(p.stderr)
except FileNotFoundError:
print("pip-audit command not found")
except Exception as e:
print(repr(e))
PYRepository: hallelx2/vectorless
Length of output: 389
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Security workflow around relevant lines:"
if [ -f .github/workflows/security.reusable.yml ]; then
awk '{printf "%6d\t%s\n", NR, $0}' .github/workflows/security.reusable.yml | sed -n '1,180p'
fi
echo
echo "Python dependency manifests:"
for f in sdks/python/pyproject.toml sdks/python/uv.lock; do
if [ -f "$f" ]; then
echo "--- $f ---"
awk '{printf "%6d\t%s\n", NR, $0}' "$f"
fi
done
echo
echo "pip-audit usage docs/sources locally if installed:"
python3 - <<'PY'
try:
import subprocess
p = subprocess.run(
["python3", "-m", "pip", "install", "pip-audit", "--quiet", "--dry-run"],
text=True,
capture_output=True,
timeout=20,
)
print("pip install dry-run:", p.returncode, p.stdout, p.stderr)
p2 = subprocess.run(["pip-audit", "--help"], text=True, capture_output=True, timeout=20)
print("pip-audit --help:")
print(p2.stdout)
print(p2.stderr)
except FileNotFoundError as e:
print("pip-audit command not found:", e)
except Exception as e:
print("Error:", repr(e))
PYRepository: hallelx2/vectorless
Length of output: 50376
🌐 Web query:
pip-audit help default input mode requirements.txt pyproject.toml uv.lock
💡 Result:
pip-audit defaults to a local environment scan (equivalent to running pip list) when no specific input source or path is provided [1][2]. Regarding your specific files and modes: requirements.txt: You can audit these files by using the -r or --requirement flag [1][3]. For example: pip-audit -r requirements.txt. pyproject.toml: pip-audit supports auditing pyproject.toml files when auditing from a project path (e.g., pip-audit.). Note that at the moment, the tool explicitly identifies pyproject.toml and pylock.*.toml files as supported project files [1][4]. uv.lock: pip-audit does not natively parse or audit uv.lock files directly [1][5]. If you are using uv, the recommended approach for vulnerability scanning is to use the native uv audit command (e.g., uv audit), which is designed to work with your project's lockfile [6][5]. Alternatively, if you must use pip-audit with a project using uv, you would typically need to export the lockfile to a requirements.txt format first using a tool like uv export, then run pip-audit against the resulting requirements file [7][5]. In summary, for standard requirements files, use the -r flag; for project-level scanning of pyproject.toml, use a path-based audit; and for uv projects, prefer the native uv audit command [1][6][5].
Citations:
- 1: https://github.com/pypa/pip-audit?tab=readme-ov-file
- 2: https://github.com/trailofbits/gh-action-pip-audit
- 3: https://pypi.org/project/pip-audit/
- 4: https://github.com/pypa/pip-audit/blob/main/README.md
- 5: https://github.com/owenlamont/uv-secure/blob/main/README.md
- 6: https://pydevtools.com/handbook/how-to/how-to-scan-python-dependencies-for-vulnerabilities/
- 7: https://github.com/fduplex/docker-pip-audit
Audit the Python dependency manifest, not the scanner environment.
pip-audit without arguments scans the installed local environment, so this checks only pip-audit, bandit, and their dependencies. Add the repository Python manifest, such as pip-audit ./pip-audit -r requirements*.txt or the supported uv audit path for sdks/python, so project dependencies are audited.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.reusable.yml around lines 123 - 124, Update the
pip-audit invocation in the security workflow to target the repository’s Python
dependency manifest rather than the scanner’s installed environment. Use the
project’s supported manifest or audit path, such as pip-audit with the
requirements files, the project directory, or the uv-based path for sdks/python,
while preserving the existing failure-handling behavior.
Sources: Coding guidelines, Learnings
| uses: ./.github/workflows/security.reusable.yml | ||
| secrets: inherit |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
Remove secrets: inherit from this caller.
.github/workflows/security.reusable.yml declares no workflow-call secrets and its scanner steps use ${{ github.token }}. secrets: inherit exposes every current and future repository secret to the called workflow. Remove this line. Pass a named secret only if a called step requires one.
As per coding guidelines, security-sensitive workflows must use least privilege and prevent unnecessary secret exposure.
🧰 Tools
🪛 GitHub Check: Semgrep OSS
[failure] 22-22: Semgrep Finding: yaml.github-actions.security.secrets-inherit.secrets-inherit
This workflow uses secrets: inherit to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the secrets: map, e.g. secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }.
🪛 zizmor (1.28.0)
[warning] 21-21: secrets unconditionally inherited by called workflow (secrets-inherit): this reusable workflow
(secrets-inherit)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.yml around lines 21 - 22, Remove the `secrets:
inherit` entry from the workflow caller that uses
`./.github/workflows/security.reusable.yml`; leave the reusable workflow
reference unchanged, since its scanner steps use `github.token` and declare no
required workflow-call secrets.
Sources: Coding guidelines, Linters/SAST tools
| - **One issue → one branch → one PR → one outcome.** Use the Linear branch name (`halleluyaholudele/hal-<n>-<title>`). Never commit to `main` directly. | ||
| - Put **`Closes HAL-<n>`** in the **PR description** so Linear links + auto-closes on merge. | ||
| - **No AI attribution** in commits, PRs, or any artifact. Author as the user alone. | ||
| - "Done" = real build + tests + lint pass (run them — `go build ./... && go test ./...`, `bun run build` / `npm run build`), not just typecheck. |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Make the completion rule run every required check.
Line 12 requires build, tests, and lint, but its examples run no lint command, no JavaScript/TypeScript test command, and plain go test instead of go test -race. Line 24 requires race detection. Update the examples to use the repository’s configured build, test, lint, and race commands where applicable.
Based on learnings, completion requires the real build, tests, and lint checks, including the applicable Go and Bun/npm checks.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` at line 12, Update the “Done” completion rule in AGENTS.md to show
every required repository check: configured Go build, race-enabled Go tests, Go
lint, and the applicable Bun/npm JavaScript or TypeScript build, test, and lint
commands. Replace plain go test and incomplete build-only examples, and align
the commands with the race-detection requirement referenced by the existing
guidance.
Sources: Coding guidelines, Learnings
synced local file(s) with hallelx2/dev-standards.
Changed files
AGENTS.mdfrom remoteAGENTS.md.github/copilot-instructions.mdfrom remote.github/copilot-instructions.md.github/agents/and copied all sub files/folders from remote directory.github/agents/.github/instructions/backend.instructions.mdfrom remote.github/instructions/backend.instructions.md.github/instructions/frontend.instructions.mdfrom remote.github/instructions/frontend.instructions.md.github/instructions/security.instructions.mdfrom remote.github/instructions/security.instructions.md.github/workflows/security.ymlfrom remote.github/workflows/security.yml.github/workflows/security.reusable.ymlfrom remote.github/workflows/security.reusable.yml.github/workflows/jules-review.ymlfrom remote.github/workflows/jules-review.yml.github/dependabot.ymlfrom remote.github/dependabot.ymlThis PR was created automatically by the repo-file-sync-action workflow run #30801469164
Summary by CodeRabbit