chore: finish consistency audit cleanups - #490
Conversation
|
|
@happykawayigt is attempting to deploy a commit to the HRCD Projects Team on Vercel. A member of the Team first needs to authorize it. |
📝 WalkthroughWalkthroughThe PR updates adapter and framework integration workflow guidance for current documentation paths, changesets, verification, and scope validation. It also adds ESLint suppressions for two Nitro v3 helper functions that exceed the configured parameter limit. ChangesWorkflow guidance updates
Nitro plugin lint cleanup
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Thank you for following the naming conventions! 🙏 |
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.agents/skills/create-adapter/SKILL.md (1)
143-153: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winRun
pnpm run dev:preparebefore package validation after a clean install.The verification block starts in
packages/evlog, but the repository instructions require rootpnpm run dev:preparebefore lint and typecheck after a clean install. Without it, generated framework TypeScript configuration can be missing and validation can fail.Add
pnpm run dev:preparebeforecd packages/evlog, or document this prerequisite.The root
AGENTS.mdspecifies this preparation step for clean installs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.agents/skills/create-adapter/SKILL.md around lines 143 - 153, Update the Verification section to run the repository-root pnpm run dev:prepare before entering packages/evlog and running package validation. Preserve the existing lint, typecheck, test, and build commands, and note that preparation is required after a clean install.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/create-adapter/SKILL.md:
- Around line 28-32: Add an eighth touchpoint to the adapter checklist for
creating a minor `.changeset/*.md` entry describing the new adapter, and update
the completion requirement from seven to eight touchpoints. Keep the existing
seven checklist items unchanged.
In @.agents/skills/create-framework-integration/SKILL.md:
- Line 467: Update the instruction in SKILL.md to require inserting the new
framework scope alphabetically in both scope lists, preserving the repository’s
AGENTS.md sorting rule.
---
Outside diff comments:
In @.agents/skills/create-adapter/SKILL.md:
- Around line 143-153: Update the Verification section to run the
repository-root pnpm run dev:prepare before entering packages/evlog and running
package validation. Preserve the existing lint, typecheck, test, and build
commands, and note that preparation is required after a clean install.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: d8bb18c4-6e97-41ca-8289-e6b639983bae
📒 Files selected for processing (4)
.agents/skills/create-adapter/SKILL.md.agents/skills/create-framework-integration/SKILL.mdAGENTS.mdpackages/evlog/src/nitro-v3/plugin.ts
| ## Step 15 & 16: PR Scopes | ||
|
|
||
| Add the framework name as a valid scope in **both** files so PR title validation passes: | ||
| Add the framework name as a valid scope in **both** files for future PRs. The semantic PR check reads its scope list from the base branch, so the integration PR must either use an unscoped title (as recommended above) or follow a preceding PR that registers the scope. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Require alphabetical insertion in both scope lists.
This instruction says to add the framework scope to both files but does not say where to insert it. Add that the new scope must be inserted alphabetically in both lists.
The repository rule in AGENTS.md requires both scope lists to remain alphabetically sorted.
🧰 Tools
🪛 SkillSpector (2.4.4)
[warning] 498: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Remediation: Pin the version: npx @scope/server@1.2.3
(MCP Rug Pull (RP1))
[warning] 356: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/create-framework-integration/SKILL.md at line 467, Update the
instruction in SKILL.md to require inserting the new framework scope
alphabetically in both scope lists, preserving the repository’s AGENTS.md
sorting rule.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/create-adapter/SKILL.md:
- Around line 158-161: Update the verification commands in the generated
workspace types preparation block to invoke the repository-managed package
manager via corepack pnpm for every pnpm command, rather than bare pnpm; keep
the existing command sequence and checks unchanged.
In @.agents/skills/create-framework-integration/SKILL.md:
- Line 467: Clarify the guidance around registering the framework name in both
alphabetized scope lists: require the scope-registration PR to merge before
using feat({framework}): in the integration PR title, or instruct authors to use
an unscoped title until it merges.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b703654f-6603-4735-a0a7-ee743b64e1a5
📒 Files selected for processing (2)
.agents/skills/create-adapter/SKILL.md.agents/skills/create-framework-integration/SKILL.md
| After a clean install, prepare generated workspace types from the repo root before running the package checks: | ||
|
|
||
| ```bash | ||
| pnpm run dev:prepare |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win
Use the Corepack-managed pnpm executable.
The verification block invokes bare pnpm. This can select a different global version from the repository-managed version. Use corepack pnpm for each command, or enable Corepack explicitly before the block.
Based on learnings, this repository uses pnpm through Corepack.
🧰 Tools
🪛 SkillSpector (2.4.4)
[warning] 30: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
[warning] 134: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/create-adapter/SKILL.md around lines 158 - 161, Update the
verification commands in the generated workspace types preparation block to
invoke the repository-managed package manager via corepack pnpm for every pnpm
command, rather than bare pnpm; keep the existing command sequence and checks
unchanged.
Source: Learnings
| ## Step 15 & 16: PR Scopes | ||
|
|
||
| Add the framework name as a valid scope in **both** files so PR title validation passes: | ||
| Add the framework name as a valid scope in **both** files for future PRs, keeping both scope lists alphabetically sorted. The semantic PR check reads its scope list from the base branch, so the integration PR must either use an unscoped title (as recommended above) or follow a preceding PR that registers the scope. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Require the scope-registration PR to merge first.
The semantic check reads scopes from the base branch. “Follow a preceding PR” does not state that the registration PR must be merged before this integration PR uses feat({framework}):. If the registration PR is still open, validation can reject the scoped title.
Proposed wording
-Add the framework name as a valid scope in both files for future PRs, keeping both scope lists alphabetically sorted. The semantic PR check reads its scope list from the base branch, so the integration PR must either use an unscoped title (as recommended above) or follow a preceding PR that registers the scope.
+Add the framework name as a valid scope in both files for future PRs, keeping both scope lists alphabetically sorted. The semantic PR check reads its scope list from the base branch, so merge the scope-registration PR before using a scoped title. Otherwise, keep the integration PR title unscoped.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| Add the framework name as a valid scope in **both** files for future PRs, keeping both scope lists alphabetically sorted. The semantic PR check reads its scope list from the base branch, so the integration PR must either use an unscoped title (as recommended above) or follow a preceding PR that registers the scope. | |
| Add the framework name as a valid scope in both files for future PRs, keeping both scope lists alphabetically sorted. The semantic PR check reads its scope list from the base branch, so merge the scope-registration PR before using a scoped title. Otherwise, keep the integration PR title unscoped. |
🧰 Tools
🪛 SkillSpector (2.4.4)
[warning] 498: [RP1] null: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Remediation: Pin the version: npx @scope/server@1.2.3
(MCP Rug Pull (RP1))
[warning] 356: [AS3] Skill Enumeration: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Remediation: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
(Agent Snooping (AS3))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/create-framework-integration/SKILL.md at line 467, Clarify
the guidance around registering the framework name in both alphabetized scope
lists: require the scope-registration PR to merge before using
feat({framework}): in the integration PR title, or instruct authors to use an
unscoped title until it merges.
2 participants
Summary
max-paramswarnings using the existing local exemption patterncustom.mdrenumberingValidation
git diff --check4.adapters/custom.mdinstructions remainENOSPC; the incompletenode_modulesand pnpm cache were removed, so the complete lint/typecheck/test matrix is left to Draft PR CICloses #488
Summary by CodeRabbit
Documentation
Code Quality