Conversation
- Introduced a Contributor Covenant Code of Conduct to establish community standards for respectful and inclusive participation. - Added a CONTRIBUTING.md file outlining the development workflow, code standards, and guidelines for submitting pull requests. - Updated README.md to link to the new CODE_OF_CONDUCT and CONTRIBUTING documents for better visibility. - Enhanced SECURITY.md to clarify the project's status as a take-home project and provide reporting channels for vulnerabilities.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
3 issues found across 25 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/ci.yml">
<violation number="1" location=".github/workflows/ci.yml:102">
P2: Job summary always shows ✅ for every check even on failure — summary should reflect actual step outcomes rather than hardcoding success markers.</violation>
</file>
<file name=".github/ISSUE_TEMPLATE/config.yml">
<violation number="1" location=".github/ISSUE_TEMPLATE/config.yml:7">
P2: The documentation link references `main` as the branch, but this repo uses `master` as its default branch. Users clicking this link will hit a 404. Change `main` to `master` so the docs URL resolves correctly.</violation>
</file>
<file name=".github/workflows/deploy-production.yml">
<violation number="1" location=".github/workflows/deploy-production.yml:6">
P1: Production deploys can now be triggered manually without a `v*` tag, so the workflow no longer enforces the tag-gated release path described in this PR. That creates a bypass where an untagged ref can be promoted to production. Keeping production deploys tag-only (or adding an explicit ref/tag guard for manual runs) would preserve the intended release control.</violation>
</file>
You're on the cubic free plan with 16 free PR reviews remaining this month. Upgrade for unlimited reviews.
Re-trigger cubic
| concurrency: { group: production, cancel-in-progress: false } | ||
| push: | ||
| tags: ['v*'] | ||
| workflow_dispatch: |
There was a problem hiding this comment.
P1: Production deploys can now be triggered manually without a v* tag, so the workflow no longer enforces the tag-gated release path described in this PR. That creates a bypass where an untagged ref can be promoted to production. Keeping production deploys tag-only (or adding an explicit ref/tag guard for manual runs) would preserve the intended release control.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/deploy-production.yml, line 6:
<comment>Production deploys can now be triggered manually without a `v*` tag, so the workflow no longer enforces the tag-gated release path described in this PR. That creates a bypass where an untagged ref can be promoted to production. Keeping production deploys tag-only (or adding an explicit ref/tag guard for manual runs) would preserve the intended release control.</comment>
<file context>
@@ -1,21 +1,45 @@
-concurrency: { group: production, cancel-in-progress: false }
+ push:
+ tags: ['v*']
+ workflow_dispatch:
+
+concurrency:
</file context>
| echo "| --- | --- |" | ||
| echo "| Rules sync | ✅ |" | ||
| echo "| OpenAPI export | ✅ |" | ||
| echo "| Typecheck / lint / format | ✅ |" |
There was a problem hiding this comment.
P2: Job summary always shows ✅ for every check even on failure — summary should reflect actual step outcomes rather than hardcoding success markers.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/ci.yml, line 102:
<comment>Job summary always shows ✅ for every check even on failure — summary should reflect actual step outcomes rather than hardcoding success markers.</comment>
<file context>
@@ -1,24 +1,106 @@
+ echo "| --- | --- |"
+ echo "| Rules sync | ✅ |"
+ echo "| OpenAPI export | ✅ |"
+ echo "| Typecheck / lint / format | ✅ |"
+ echo "| Unit + contract tests | ✅ |"
+ echo "| Build + bundle budget | ✅ |"
</file context>
| url: https://github.com/humza-butt/oche/security/advisories/new | ||
| about: Report a vulnerability privately (see SECURITY.md) | ||
| - name: Documentation | ||
| url: https://github.com/humza-butt/oche/tree/main/docs |
There was a problem hiding this comment.
P2: The documentation link references main as the branch, but this repo uses master as its default branch. Users clicking this link will hit a 404. Change main to master so the docs URL resolves correctly.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/ISSUE_TEMPLATE/config.yml, line 7:
<comment>The documentation link references `main` as the branch, but this repo uses `master` as its default branch. Users clicking this link will hit a 404. Change `main` to `master` so the docs URL resolves correctly.</comment>
<file context>
@@ -0,0 +1,8 @@
+ url: https://github.com/humza-butt/oche/security/advisories/new
+ about: Report a vulnerability privately (see SECURITY.md)
+ - name: Documentation
+ url: https://github.com/humza-butt/oche/tree/main/docs
+ about: Architecture, deployment, and interview prep docs
</file context>
Suggested change
| url: https://github.com/humza-butt/oche/tree/main/docs | |
| url: https://github.com/humza-butt/oche/tree/master/docs |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by cubic
Adds community standards and repo hygiene, and retools CI/CD to run heavy checks on main with streamlined staging/production deploys. Improves docs, templates, and security guidance to make contributions clear and safe.
New Features
docs/GITHUB.md; deployment/env/runbook/checklists updated; clearer SECURITY reporting.CODEOWNERS, VS Code recommendations../.github/actions/setup.main(migrate + force RLS + deploy), production on tagsv*with environment gate; job summaries include URLs.Migration
main; runnpm run checklocally (full CI runs onmainonly).DATABASE_URL,MEDIA_SIGNING_SECRET,OCHE_JWT_SECRET,DATABASE_URL_STAGING,DATABASE_URL_PROD,CLOUDFLARE_*.main, require reviewers forproductionenvironment, enable Dependabot alerts.Written for commit e3ad848. Summary will update on new commits.