HT-10: repo skeleton + free-OSS CI/quality foundation - #6
Merged
Conversation
package.json (npm, Node 20, ESM), Vitest (test-first, v8 coverage), Biome (lint+format), and the best-of-breed free-for-public CI stack: - ci.yml: typecheck + lint + coverage->Codecov + gitleaks - codeql.yml: CodeQL SAST (js/ts) - scorecard.yml: OpenSSF Scorecard STATUS.md as the living status page. A real smoke module + test (src/meta.ts) proves the whole pipeline end to end. Verified locally: typecheck exit 0, lint clean (11 files), tests 2/2, coverage generated. Also fixed a latent NodeNext typecheck break in src/providers (barrel re-exports needed .js extensions — never caught before because there was no package.json to run tsc against), and Biome applied its format to the existing provider files (quotes/semicolons only, no logic change). Pinned: typescript 7.0.2, vitest 4.1.10, @vitest/coverage-v8 4.1.10, @biomejs/biome 2.5.3. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TqG66PPZreBrj17VbAqe3b
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe project gains npm, TypeScript, Biome, Vitest, coverage, and metadata foundations; provider declarations adopt consistent ESM formatting; GitHub Actions workflows add quality and security checks; and README, status, and ignore-file updates document the setup. ChangesProject foundation and tooling
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
… action) The gitleaks GitHub Action refuses to run on organization repos without a paid GITLEAKS_LICENSE. The gitleaks binary itself is free — install a pinned release and run 'gitleaks git .' directly. Verified locally: scans history, exit 0, no leaks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TqG66PPZreBrj17VbAqe3b
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (2)
tests/meta.test.ts (1)
9-12: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick winAssert the actual stack description.
The test currently allows any non-empty string containing
PROJECT, so an incorrect or multilinedescribeStack()result would still pass. Assert the stable output directly.Proposed test improvement
const description = describeStack() - expect(description).toContain(PROJECT) - expect(description.length).toBeGreaterThan(0) + expect(description).toBe('helpthread: TypeScript, strict, NodeNext')🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/meta.test.ts` around lines 9 - 12, Update the “describes the stack in one line” test to assert the exact stable string returned by describeStack(), rather than only checking that it contains PROJECT and is non-empty; preserve the test’s intended one-line output validation..github/workflows/ci.yml (1)
17-17: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winPin workflow actions to immutable commit SHAs.
actions/checkout,actions/setup-node, Codecov, and Gitleaks are referenced by mutable tags. Pin each action to a verified full-length commit SHA, retaining a version comment for readability. This is especially important for newly added security automation; Scorecard recommends full SHA pinning. (github.com)Also applies to: 20-20, 38-38, 53-53
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml at line 17, Pin every workflow action referenced in ci.yml—including actions/checkout, actions/setup-node, Codecov, and Gitleaks—to verified full-length immutable commit SHAs, retaining comments with the corresponding version tags for readability; update all occurrences identified by the affected action steps.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 16-17: Add `persist-credentials: false` to both
`actions/checkout@v4` steps in the quality and secret-scan jobs, ensuring
neither job retains the GitHub token after checkout.
In @.github/workflows/codeql.yml:
- Around line 26-28: Disable credential persistence in the Checkout step by
setting persist-credentials to false on the actions/checkout@v4 configuration in
the CodeQL workflow, matching the convention used by scorecard.yml.
In `@biome.json`:
- Around line 8-10: Update the Biome configuration’s files.includes and
ignoreUnknown settings to prevent unsupported YAML workflow files from being
scanned; either set ignoreUnknown to true or narrow includes to supported file
types while preserving existing exclusions.
In `@README.md`:
- Line 22: Update the code fence in README.md around line 22 to specify the
shell language by changing the opening fence to ```sh, resolving markdownlint
MD040.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Line 17: Pin every workflow action referenced in ci.yml—including
actions/checkout, actions/setup-node, Codecov, and Gitleaks—to verified
full-length immutable commit SHAs, retaining comments with the corresponding
version tags for readability; update all occurrences identified by the affected
action steps.
In `@tests/meta.test.ts`:
- Around line 9-12: Update the “describes the stack in one line” test to assert
the exact stable string returned by describeStack(), rather than only checking
that it contains PROJECT and is non-empty; preserve the test’s intended one-line
output validation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: a4939bd9-90f1-4358-9217-9f3731cfb19d
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (17)
.github/workflows/ci.yml.github/workflows/codeql.yml.github/workflows/scorecard.yml.gitignoreREADME.mdSTATUS.mdbiome.jsonpackage.jsonsrc/meta.tssrc/providers/blob.tssrc/providers/inbound-email.tssrc/providers/index.tssrc/providers/queue.tssrc/providers/scheduler.tstests/meta.test.tstsconfig.jsonvitest.config.ts
|
|
||
| Prerequisites: Node 20+. | ||
|
|
||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Specify the code-fence language.
Line 22 triggers markdownlint MD040. Mark this as a shell fence:
-```
+```sh🧰 Tools
🪛 markdownlint-cli2 (0.22.1)
[warning] 22-22: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` at line 22, Update the code fence in README.md around line 22 to
specify the shell language by changing the opening fence to ```sh, resolving
markdownlint MD040.
Source: Linters/SAST tools
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 54-59: Update the “Install gitleaks” step to download the
corresponding gitleaks_8.30.1_checksums.txt file, verify gitleaks.tar.gz against
the expected Linux x64 checksum using a strict checksum command, and only
extract and install gitleaks after verification succeeds.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: fad072ba-3218-4ca8-82a6-2031b537f142
📒 Files selected for processing (1)
.github/workflows/ci.yml
Security (CodeRabbit 🔒 Major x2): set persist-credentials: false on every actions/checkout — the default persists the GITHUB_TOKEN into the git config, and the quality job runs PR-controlled install/test code, so on a public repo a malicious PR could exfiltrate it. Applied to ci.yml (both jobs) and codeql.yml. Correctness (CodeRabbit 🎯 Major): biome ignoreUnknown -> true so Biome skips files it can't parse (YAML workflows) instead of erroring. Verified: lint clean, typecheck exit 0, tests pass. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TqG66PPZreBrj17VbAqe3b
…ajor) CodeRabbit flagged that the gitleaks tarball was fetched and installed without integrity verification. Now download the release's published checksums.txt and verify the tarball's SHA-256 against it before extracting — a compromised or MITM'd download fails the build instead of running. Tested locally: passes on the authentic file, rejects a tampered one. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TqG66PPZreBrj17VbAqe3b
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The guarded foundation before engine code. Everything after this lands into a repo where every check runs on each PR.
Toolchain (best-of-breed, free-for-OSS — not RIQ's cost-minimized set): npm + Node 20 + ESM, TypeScript 7, Vitest (test-first, v8 coverage), Biome (lint+format, one fast tool).
CI/quality stack (all free for public repos):
ci.yml— typecheck + lint + test-with-coverage → Codecov + gitleaks secret scancodeql.yml— CodeQL SAST (javascript-typescript), on PR + weeklyscorecard.yml— OpenSSF Scorecard security-posture badgeSTATUS.md — living status page at repo root (public progress view).
A real smoke module + test (
src/meta.ts) proves the pipeline end to end. Verified locally: typecheck exit 0, lint clean, tests 2/2, coverage generated. Also fixed a latent NodeNext typecheck break in the provider barrel (missing.jsextensions — never caught because there was nopackage.jsonto runtscagainst yet).Note: Codecov uses tokenless public-repo upload (
fail_ci_if_error: false) — it may need the Codecov GitHub app authorized to show reports; won't fail the build either way.Jira: https://resonantiq.atlassian.net/browse/HT-10
🤖 Generated with Claude Code
Summary by CodeRabbit