-
Notifications
You must be signed in to change notification settings - Fork 0
Docfx/context7 chat #8
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -47,7 +47,7 @@ | |
| ], | ||
| "globalMetadata": { | ||
| "_appTitle": "Extensions for BenchmarkDotNet by Codebelt", | ||
| "_appFooter": "<span>Generated by <strong>DocFX</strong>. Copyright 2025-2026 Geekle. All rights reserved.</span>", | ||
| "_appFooter": "<span>Generated by <strong>DocFX</strong>. Copyright 2025-2026 Geekle. All rights reserved.</span><script src=\"https://context7.com/widget.js\" data-library=\"/codebeltnet/benchmarkdotnet\"></script>", | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Third-party script loaded without SRI or a compensating CSP — supply-chain risk. Subresource Integrity (SRI) is a security feature that enables browsers to verify that resources they fetch are delivered without unexpected manipulation; it works by providing a cryptographic hash that the fetched resource must match. However, SRI works well when importing an external script that's versioned and won't change, but when using JS as an external software service that isn't hosted locally and shouldn't be pinned to one version, SRI cannot be relied upon. The Context7 widget is exactly such a service. Without SRI, websites that load JavaScript from external sources are vulnerable to supply chain attacks — if the third-party resource is compromised — and CDN hijacking, where attackers may inject malicious code into hosted libraries. For a continuously-updating service widget like this, a Content Security Policy (CSP) — a whitelist of sites allowed to provide content — is the appropriate alternative: if pulling in a service from a given domain, you can restrict scripts to just that domain. DocFX-generated sites are typically static, so a CSP can be enforced via a hosting-layer response header (e.g., GitHub Pages Until a CSP is in place, every documentation visitor's browser is entirely reliant on context7.com's security posture. 🤖 Prompt for AI Agents |
||
| "_appLogoPath": "images/50x50.png", | ||
| "_appFaviconPath": "images/favicon.ico", | ||
| "_googleAnalyticsTagId": "G-K2NG2TXDWQ", | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| [ ] |
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,139 @@ | ||||||||||||||||||||||||||||||||||||||||
| name: Service Update | ||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||||||||||||||||
| repository_dispatch: | ||||||||||||||||||||||||||||||||||||||||
| types: [codebelt-service-update] | ||||||||||||||||||||||||||||||||||||||||
| workflow_dispatch: | ||||||||||||||||||||||||||||||||||||||||
| inputs: | ||||||||||||||||||||||||||||||||||||||||
| source_repo: | ||||||||||||||||||||||||||||||||||||||||
| description: 'Triggering source repo name (e.g. cuemon)' | ||||||||||||||||||||||||||||||||||||||||
| required: false | ||||||||||||||||||||||||||||||||||||||||
| default: '' | ||||||||||||||||||||||||||||||||||||||||
| source_version: | ||||||||||||||||||||||||||||||||||||||||
| description: 'Version released by source (e.g. 10.3.0)' | ||||||||||||||||||||||||||||||||||||||||
| required: false | ||||||||||||||||||||||||||||||||||||||||
| default: '' | ||||||||||||||||||||||||||||||||||||||||
| dry_run: | ||||||||||||||||||||||||||||||||||||||||
| type: boolean | ||||||||||||||||||||||||||||||||||||||||
| description: 'Dry run — show changes but do not commit or open PR' | ||||||||||||||||||||||||||||||||||||||||
| default: false | ||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| permissions: | ||||||||||||||||||||||||||||||||||||||||
| contents: write | ||||||||||||||||||||||||||||||||||||||||
| pull-requests: write | ||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||||||||||||||||
| service-update: | ||||||||||||||||||||||||||||||||||||||||
| runs-on: ubuntu-24.04 | ||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| steps: | ||||||||||||||||||||||||||||||||||||||||
| - name: Checkout | ||||||||||||||||||||||||||||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||||||||||
| fetch-depth: 0 | ||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| - name: Resolve trigger inputs | ||||||||||||||||||||||||||||||||||||||||
| id: trigger | ||||||||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||||||||
| SOURCE="${{ github.event.client_payload.source_repo || github.event.inputs.source_repo }}" | ||||||||||||||||||||||||||||||||||||||||
| VERSION="${{ github.event.client_payload.source_version || github.event.inputs.source_version }}" | ||||||||||||||||||||||||||||||||||||||||
| echo "source=$SOURCE" >> $GITHUB_OUTPUT | ||||||||||||||||||||||||||||||||||||||||
| echo "version=$VERSION" >> $GITHUB_OUTPUT | ||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+35
to
+41
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Critical: Script injection via
Pass all untrusted values through environment variables. Proposed fix for lines 35–41 - name: Resolve trigger inputs
id: trigger
run: |
- SOURCE="${{ github.event.client_payload.source_repo || github.event.inputs.source_repo }}"
- VERSION="${{ github.event.client_payload.source_version || github.event.inputs.source_version }}"
+ SOURCE="${PAYLOAD_SOURCE:-$INPUT_SOURCE}"
+ VERSION="${PAYLOAD_VERSION:-$INPUT_VERSION}"
echo "source=$SOURCE" >> $GITHUB_OUTPUT
echo "version=$VERSION" >> $GITHUB_OUTPUT
+ env:
+ PAYLOAD_SOURCE: ${{ github.event.client_payload.source_repo }}
+ PAYLOAD_VERSION: ${{ github.event.client_payload.source_version }}
+ INPUT_SOURCE: ${{ github.event.inputs.source_repo }}
+ INPUT_VERSION: ${{ github.event.inputs.source_version }}The same pattern must be applied at lines 109–112 where step outputs are interpolated back into a Proposed fix for lines 108–112 env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
+ NEW: ${{ steps.newver.outputs.new }}
+ BRANCH: ${{ steps.newver.outputs.branch }}
+ SOURCE: ${{ steps.trigger.outputs.source }}
+ SRC_VER: ${{ steps.trigger.outputs.version }}
run: |
- NEW="${{ steps.newver.outputs.new }}"
- BRANCH="${{ steps.newver.outputs.branch }}"
- SOURCE="${{ steps.trigger.outputs.source }}"
- SRC_VER="${{ steps.trigger.outputs.version }}"📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| - name: Determine new version for this repo | ||||||||||||||||||||||||||||||||||||||||
| id: newver | ||||||||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||||||||
| CURRENT=$(grep -oP '(?<=## \[)[\d.]+(?=\])' CHANGELOG.md | head -1) | ||||||||||||||||||||||||||||||||||||||||
| NEW=$(echo "$CURRENT" | awk -F. '{printf "%s.%s.%d", $1, $2, $3+1}') | ||||||||||||||||||||||||||||||||||||||||
| BRANCH="v${NEW}/service-update" | ||||||||||||||||||||||||||||||||||||||||
| echo "current=$CURRENT" >> $GITHUB_OUTPUT | ||||||||||||||||||||||||||||||||||||||||
| echo "new=$NEW" >> $GITHUB_OUTPUT | ||||||||||||||||||||||||||||||||||||||||
| echo "branch=$BRANCH" >> $GITHUB_OUTPUT | ||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+43
to
+51
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Version extraction fails silently with a confusing error if CHANGELOG.md has no version entries. With Proposed improvement - name: Determine new version for this repo
id: newver
run: |
CURRENT=$(grep -oP '(?<=## \[)[\d.]+(?=\])' CHANGELOG.md | head -1)
+ if [ -z "$CURRENT" ]; then
+ echo "::error::No version entry found in CHANGELOG.md"
+ exit 1
+ fi
NEW=$(echo "$CURRENT" | awk -F. '{printf "%s.%s.%d", $1, $2, $3+1}')🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| - name: Generate codebelt-aicia token | ||||||||||||||||||||||||||||||||||||||||
| id: app-token | ||||||||||||||||||||||||||||||||||||||||
| uses: actions/create-github-app-token@v1 | ||||||||||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||||||||||
| app-id: ${{ vars.CODEBELT_AICIA_APP_ID }} | ||||||||||||||||||||||||||||||||||||||||
| private-key: ${{ secrets.CODEBELT_AICIA_PRIVATE_KEY }} | ||||||||||||||||||||||||||||||||||||||||
| owner: codebeltnet | ||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||
| - name: Bump NuGet packages | ||||||||||||||||||||||||||||||||||||||||
| run: python3 .github/scripts/bump-nuget.py | ||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||
| run: python3 .github/scripts/bump-nuget.py | |
| run: | | |
| echo "Skipping NuGet package bump: bump-nuget.py script is not available in this repository." | |
| echo "TRIGGER_SOURCE=${TRIGGER_SOURCE}" | |
| echo "TRIGGER_VERSION=${TRIGGER_VERSION}" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🏁 Script executed:
fd -t f 'bump-nuget.py'Repository: codebeltnet/benchmarkdotnet
Length of output: 53
.github/scripts/bump-nuget.py does not exist in the repository.
The workflow step at line 62 references this script, but it is missing. This step will fail at runtime. Either add the missing script or remove the step if it's not needed.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/service-update.yml around lines 61 - 65, The workflow step
named "Bump NuGet packages" references a missing script
".github/scripts/bump-nuget.py"; either add that script to the repository
(implement the bump logic, make it executable, and commit it to
.github/scripts/) or remove/update the workflow step to call an existing
script/action instead; ensure the workflow's run value points to the correct
script name and path (bump-nuget.py) or replace it with the intended action so
the step no longer fails at runtime.
Copilot
AI
Feb 20, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The PackageReleaseNotes.txt update logic extracts the TFM (Target Framework Moniker) from the existing file or defaults to ".NET 10, .NET 9 and .NET Standard 2.0". However, the actual projects in this repository target only ".NET 10 and .NET 9" according to the existing PackageReleaseNotes.txt files. The fallback default includes ".NET Standard 2.0" which is incorrect for this project. Update the default to match the actual target frameworks: ".NET 10 and .NET 9".
| TFM=$(grep -m1 "^Availability:" "$f" | sed 's/Availability: //' || echo ".NET 10, .NET 9 and .NET Standard 2.0") | |
| TFM=$(grep -m1 "^Availability:" "$f" | sed 's/Availability: //' || echo ".NET 10 and .NET 9") |
Copilot
AI
Feb 20, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The version entry format in PackageReleaseNotes.txt uses "Version ${NEW}" (Version 1.2.3) but the existing file format shows "Version: 1.2.2" with a colon. This inconsistency will break the established format. The ENTRY variable should use "Version: ${NEW}\n" to match the existing convention.
| ENTRY="Version ${NEW}\nAvailability: ${TFM}\n \n# ALM\n- CHANGED Dependencies have been upgraded to the latest compatible versions for all supported target frameworks (TFMs)\n \n" | |
| ENTRY="Version: ${NEW}\nAvailability: ${TFM}\n \n# ALM\n- CHANGED Dependencies have been upgraded to the latest compatible versions for all supported target frameworks (TFMs)\n \n" |
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,78 @@ | ||||||||||||||||||||||||||||
| name: Trigger Downstream Service Updates | ||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||||
| release: | ||||||||||||||||||||||||||||
| types: [published] | ||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||||
| dispatch: | ||||||||||||||||||||||||||||
| if: github.event.release.prerelease == false | ||||||||||||||||||||||||||||
| runs-on: ubuntu-24.04 | ||||||||||||||||||||||||||||
| permissions: | ||||||||||||||||||||||||||||
| contents: read | ||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||
| steps: | ||||||||||||||||||||||||||||
| - name: Checkout (to read dispatch-targets.json) | ||||||||||||||||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||
| - name: Check for dispatch targets | ||||||||||||||||||||||||||||
| id: check | ||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||
| if [ ! -f .github/dispatch-targets.json ]; then | ||||||||||||||||||||||||||||
| echo "No dispatch-targets.json found, skipping." | ||||||||||||||||||||||||||||
| echo "has_targets=false" >> $GITHUB_OUTPUT | ||||||||||||||||||||||||||||
| exit 0 | ||||||||||||||||||||||||||||
| fi | ||||||||||||||||||||||||||||
| COUNT=$(python3 -c "import json; print(len(json.load(open('.github/dispatch-targets.json'))))") | ||||||||||||||||||||||||||||
| echo "has_targets=$([ $COUNT -gt 0 ] && echo true || echo false)" >> $GITHUB_OUTPUT | ||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||
| - name: Extract version from release tag | ||||||||||||||||||||||||||||
| if: steps.check.outputs.has_targets == 'true' | ||||||||||||||||||||||||||||
| id: version | ||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||
| VERSION="${{ github.event.release.tag_name }}" | ||||||||||||||||||||||||||||
| VERSION="${VERSION#v}" | ||||||||||||||||||||||||||||
| echo "version=$VERSION" >> $GITHUB_OUTPUT | ||||||||||||||||||||||||||||
|
Comment on lines
+32
to
+35
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Potential script injection via
Use an environment variable instead to avoid shell interpretation of the expression value. Proposed fix - name: Extract version from release tag
if: steps.check.outputs.has_targets == 'true'
id: version
run: |
- VERSION="${{ github.event.release.tag_name }}"
+ VERSION="$TAG_NAME"
VERSION="${VERSION#v}"
echo "version=$VERSION" >> $GITHUB_OUTPUT
+ env:
+ TAG_NAME: ${{ github.event.release.tag_name }}📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||
| - name: Generate codebelt-aicia token | ||||||||||||||||||||||||||||
| if: steps.check.outputs.has_targets == 'true' | ||||||||||||||||||||||||||||
| id: app-token | ||||||||||||||||||||||||||||
| uses: actions/create-github-app-token@v1 | ||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||
| app-id: ${{ vars.CODEBELT_AICIA_APP_ID }} | ||||||||||||||||||||||||||||
| private-key: ${{ secrets.CODEBELT_AICIA_PRIVATE_KEY }} | ||||||||||||||||||||||||||||
| owner: codebeltnet | ||||||||||||||||||||||||||||
|
Comment on lines
+37
to
+44
|
||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||
| - name: Dispatch to downstream repos | ||||||||||||||||||||||||||||
| if: steps.check.outputs.has_targets == 'true' | ||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||
| python3 - <<'EOF' | ||||||||||||||||||||||||||||
| import json, urllib.request, os, sys | ||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||
| targets = json.load(open('.github/dispatch-targets.json')) | ||||||||||||||||||||||||||||
| token = os.environ['GH_TOKEN'] | ||||||||||||||||||||||||||||
| version = os.environ['VERSION'] | ||||||||||||||||||||||||||||
| source = os.environ['SOURCE_REPO'] | ||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||
| for repo in targets: | ||||||||||||||||||||||||||||
| url = f'https://api.github.com/repos/codebeltnet/{repo}/dispatches' | ||||||||||||||||||||||||||||
| payload = json.dumps({ | ||||||||||||||||||||||||||||
| 'event_type': 'codebelt-service-update', | ||||||||||||||||||||||||||||
| 'client_payload': { | ||||||||||||||||||||||||||||
| 'source_repo': source, | ||||||||||||||||||||||||||||
| 'source_version': version | ||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||
| }).encode() | ||||||||||||||||||||||||||||
| req = urllib.request.Request(url, data=payload, method='POST', headers={ | ||||||||||||||||||||||||||||
| 'Authorization': f'Bearer {token}', | ||||||||||||||||||||||||||||
| 'Accept': 'application/vnd.github+json', | ||||||||||||||||||||||||||||
| 'Content-Type': 'application/json', | ||||||||||||||||||||||||||||
| 'X-GitHub-Api-Version': '2022-11-28' | ||||||||||||||||||||||||||||
| }) | ||||||||||||||||||||||||||||
| with urllib.request.urlopen(req) as r: | ||||||||||||||||||||||||||||
| print(f'✓ Dispatched to {repo}: HTTP {r.status}') | ||||||||||||||||||||||||||||
|
Comment on lines
+49
to
+73
|
||||||||||||||||||||||||||||
| EOF | ||||||||||||||||||||||||||||
| env: | ||||||||||||||||||||||||||||
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | ||||||||||||||||||||||||||||
| VERSION: ${{ steps.version.outputs.version }} | ||||||||||||||||||||||||||||
| SOURCE_REPO: ${{ github.event.repository.name }} | ||||||||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Loading an external JavaScript file from context7.com in the documentation footer introduces a third-party dependency that could have security and availability implications. If the external domain is compromised or becomes unavailable, it could affect documentation functionality or expose users to malicious scripts. Consider: 1) adding Subresource Integrity (SRI) hashes if supported by DocFX, 2) documenting the purpose and trust level of this widget, or 3) hosting the script locally if feasible.