chore(maintenance): establish lot 0 baseline - #167
Conversation
Qodo reviews are paused for this user.Troubleshooting steps vary by plan Learn more → On a Teams plan? Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center? |
github-actions
Bot
added
documentation
📝 WalkthroughWalkthroughThe PR pins GitHub Actions, adds frontend auditing and Tauri build logs, updates dependencies and RustSec ignores, expands secret scanning with tests, documents the maintenance baseline, and refactors Tauri builder and URL parsing control flow. ChangesMaintenance baseline
Estimated code review effort: 3 (Moderate) | ~25 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Comment |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/ci.yml (1)
81-82: 🩺 Stability & Availability | 🔵 Trivial
npm auditwith no--audit-levelcan make CI brittle.Without an explicit
--audit-level, any newly-disclosed advisory (including low-severity ones in dev-only tooling) will fail this step, even on PRs unrelated to the affected dependency. Since audit enforcement is an explicit goal of this PR, consider pinning--audit-level=high(or similar) so CI failures track meaningfully actionable risk rather than every transitive dev-dependency disclosure.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 81 - 82, Update the “npm audit” workflow step to pass an explicit severity threshold, such as --audit-level=high, so CI fails only for actionable high-severity or higher advisories while preserving audit enforcement.scripts/no-secrets.sh (1)
75-92: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winStaged-mode content scan doesn't exclude
*.lockfiles like tracked mode does.Line 78's tracked-mode
git grepexcludes lockfiles via':(exclude)*.lock', but the staged-mode diff scan (line 88) has no equivalent exclusion. A staged lockfile update containing a hash that happens to match one of the API-key patterns would be blocked in the pre-commit path but not in--all/CI, which is an inconsistent policy between the two scopes.♻️ Suggested alignment
- CONTENT_LEAK=$(git diff --cached -U0 | grep -E '^\+' | grep -vE '^\+\+\+ [ab]/' | grep -iE "$API_KEY_PATTERNS" || true) + CONTENT_LEAK=$(git diff --cached -U0 -- . ':(exclude)*.lock' | grep -E '^\+' | grep -vE '^\+\+\+ [ab]/' | grep -iE "$API_KEY_PATTERNS" || true)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/no-secrets.sh` around lines 75 - 92, Update the staged-mode scan in the SCOPE branch to exclude *.lock files, matching the existing exclusion used by the tracked-mode git grep while preserving the current diff filtering and API-key pattern detection.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 21: Update the checkout steps in the rust-checks, frontend-checks,
secrets-scan, forbidden-tools, and changelog-check jobs to include the same with
configuration as build, specifically setting persist-credentials to false.
Preserve each checkout action and its existing options while applying this
security setting consistently to all five referenced jobs.
In `@scripts/no-secrets.sh`:
- Around line 94-106: Update the tracked diagnostics loop in the CONTENT_FOUND
branch so the third read that captures content also uses NUL termination,
matching git grep --cached -z output. Preserve the existing file and line reads,
match-count limit, and diagnostic formatting so tracked matches such as
credential.txt:1 are reported.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 81-82: Update the “npm audit” workflow step to pass an explicit
severity threshold, such as --audit-level=high, so CI fails only for actionable
high-severity or higher advisories while preserving audit enforcement.
In `@scripts/no-secrets.sh`:
- Around line 75-92: Update the staged-mode scan in the SCOPE branch to exclude
*.lock files, matching the existing exclusion used by the tracked-mode git grep
while preserving the current diff filtering and API-key pattern detection.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e52ccf91-9f33-47fc-9319-991dbcc70816
⛔ Files ignored due to path filters (3)
package-lock.jsonis excluded by!**/package-lock.jsonsrc-tauri/Cargo.lockis excluded by!**/*.locksrc-tauri/gen/schemas/capabilities.jsonis excluded by!**/gen/**
📒 Files selected for processing (7)
.github/workflows/ci.ymlCHANGELOG.mddeny.tomlpackage.jsonscripts/no-secrets.shscripts/test-no-secrets.shsrc-tauri/src/lib.rs
Merging this PR will improve performance by 20.79%
|
| Benchmark | BASE |
HEAD |
Efficiency | |
|---|---|---|---|---|
| ⚡ | from_status_code_500 |
125.3 ns | 94.7 ns | +32.26% |
| ⚡ | normalize_max_concurrent |
150 ns | 120.8 ns | +24.14% |
| ⚡ | create_valid |
341.7 ns | 281.4 ns | +21.42% |
| ⚡ | reject_invalid |
610.3 ns | 522.8 ns | +16.74% |
| ⚡ | full_lifecycle |
254.7 ns | 230.6 ns | +10.48% |
Tip
Curious why this is faster? Comment @codspeedbot explain why this is faster on this PR, or directly use the CodSpeed MCP with your agent.
Comparing feat/lot-0 (dafcc42) with main (46d16cb)
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/no-secrets.sh`:
- Around line 92-116: Update both git grep invocations in the API-key content
scan to restrict matches to the selected FILES scope, preserving their existing
cached-index behavior and error handling. Add a regression case covering a
committed token alongside a benign staged file, verifying the benign file’s scan
does not block due to the out-of-scope token.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: e8e72da0-de7b-48d0-b668-a76e4068ea2e
📒 Files selected for processing (3)
.github/workflows/ci.ymlscripts/no-secrets.shscripts/test-no-secrets.sh
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/ci.yml
1 participant
Résumé
.npmrcsûr et un scanner de secrets partagé, robuste et sans fuite de valeursLinear
Validation
npm audit: 0 vulnérabilitécargo deny: advisories, bans, licenses et sources validésactionlintet validation YAMLRisques résiduels
quick-xmltransitifs via Tauri/Wayland et un avis de macro procédurale via SeaORM sont documentés dansdeny.toml, avec réévaluation au 2026-10-15Summary by cubic
Restores the CI and security baseline for “Lot 0”: pins Actions to
v7(Node 24) by SHA, replaces ad‑hoc secret checks with a robust scanner that allows safe.npmrc, updates npm/Rust deps to clear audits, adds cross‑OS Tauri build diagnostics, and fixes Clippy warnings on stable. Addresses Linear MAT-126, MAT-127, and MAT-128.Bug Fixes
actions/checkout,actions/setup-node,dtolnay/rust-toolchain,Swatinem/rust-cache,taiki-e/install-action, andactions/upload-artifactby SHA; addednpm audit,persist-credentials: false, and upload of Tauri build logs on failure.scripts/no-secrets.shandscripts/test-no-secrets.sh; scans the Git index for staged or all tracked files (text and binary), is NUL‑safe for odd paths, redacts matches and secret‑looking filenames, and blocks.npmrcauth; CI runs the self‑tests and a tracked‑files scan.dialog:allow-open.Dependencies
react-routerto^7.18.1,viteto^6.4.3;npm auditreports 0 vulnerabilities.openssl,openssl-sys,plist,quick-xml,spin,tar, etc.);cargo-denypasses with residual advisories documented indeny.toml(proc-macro-error2and transitivequick-xml), with a 2026-10-15 review date.Written for commit dafcc42. Summary will update on new commits.
Summary by CodeRabbit
.npmrcsettings while continuing to block npm auth tokens.