Conversation
📝 WalkthroughWalkthroughThis PR introduces a new CodeQL security analysis GitHub Actions workflow, updates build infrastructure by refactoring the Makefile's clean and deptry targets, tracks the workflow file in project history, and adjusts corresponding test expectations to match the updated Makefile behavior. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (4)
.github/workflows/rhiza_codeql.yml.rhiza/historyMakefiletests/test_rhiza/test_makefile.py
🔇 Additional comments (7)
.rhiza/history (1)
11-11: LGTM!The new CodeQL workflow is correctly tracked in the template history file.
tests/test_rhiza/test_makefile.py (1)
133-139: LGTM!The test correctly validates the updated
deptrytarget behavior, which now runsdeptry .when nosrcdirectory exists (as is the case in the test's temporary environment)..github/workflows/rhiza_codeql.yml (3)
88-97: Manual build placeholder is correctly configured.The manual build step exits with an error code, which is intentional. This step only executes when
build-mode: 'manual'is set in the matrix. Since the current matrix entries usebuild-mode: none, this placeholder will not be triggered and serves as a reminder for future customization.
31-31: The repository is confirmed to be public. The workflow condition is correctly configured and CodeQL analysis will run as expected.
61-61: The workflow already uses current, secure versions. actions/checkout@v6 is the latest stable version, and github/codeql-action@v4 is the latest stable major version (latest patch: v4.31.7). No security advisories identified. No changes required.Makefile (2)
142-147: LGTM! Directory-aware deptry invocation is more flexible.The updated
deptrytarget intelligently checks for the existence of asrcdirectory and adjusts its invocation accordingly. This is more permissive than the previous implementation and aligns well with the corresponding test expectations.
172-177: LGTM! Enhanced help formatting improves usability.The improved
helptarget provides clearer structure with usage instructions and formatted target listings, making the Makefile more user-friendly.
| clean: ## Clean project artifacts and stale local branches | ||
| @printf "%bCleaning project...%b\n" "$(BLUE)" "$(RESET)" | ||
|
|
||
| # Remove ignored files/directories, but keep .env files | ||
| @git clean -d -X -f \ | ||
| -e .env \ | ||
| -e '.env.*' | ||
|
|
||
| # Remove build & test artifacts | ||
| @rm -rf \ | ||
| dist \ | ||
| build \ | ||
| *.egg-info \ | ||
| .coverage \ | ||
| .pytest_cache | ||
|
|
||
| @printf "%bRemoving local branches with no remote counterpart...%b\n" "$(BLUE)" "$(RESET)" | ||
|
|
||
| @git fetch --prune | ||
| @git branch -vv \ | ||
| | grep ': gone]' \ | ||
| | awk '{print $1}' \ | ||
| | xargs -r git branch -D 2>/dev/null || true | ||
|
|
||
| @git branch -vv | awk '/: gone]/{print $$1}' | xargs -r git branch -D |
There was a problem hiding this comment.
Address portability issue with xargs -r flag.
The clean target enhancements improve artifact cleanup and formatting. However, Line 131 uses xargs -r, which is a GNU extension not available on BSD/macOS systems. This will cause the target to fail on macOS.
🔎 Portable alternative for branch cleanup
- @git branch -vv | awk '/: gone]/{print $$1}' | xargs -r git branch -D
+ @git branch -vv | awk '/: gone]/{print $$1}' | xargs git branch -D 2>/dev/null || trueOr use a more explicit approach:
- @git branch -vv | awk '/: gone]/{print $$1}' | xargs -r git branch -D
+ @branches=$$(git branch -vv | awk '/: gone]/{print $$1}'); \
+ if [ -n "$$branches" ]; then \
+ echo "$$branches" | xargs git branch -D; \
+ fi📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| clean: ## Clean project artifacts and stale local branches | |
| @printf "%bCleaning project...%b\n" "$(BLUE)" "$(RESET)" | |
| # Remove ignored files/directories, but keep .env files | |
| @git clean -d -X -f \ | |
| -e .env \ | |
| -e '.env.*' | |
| # Remove build & test artifacts | |
| @rm -rf \ | |
| dist \ | |
| build \ | |
| *.egg-info \ | |
| .coverage \ | |
| .pytest_cache | |
| @printf "%bRemoving local branches with no remote counterpart...%b\n" "$(BLUE)" "$(RESET)" | |
| @git fetch --prune | |
| @git branch -vv \ | |
| | grep ': gone]' \ | |
| | awk '{print $1}' \ | |
| | xargs -r git branch -D 2>/dev/null || true | |
| @git branch -vv | awk '/: gone]/{print $$1}' | xargs -r git branch -D | |
| clean: ## Clean project artifacts and stale local branches | |
| @printf "%bCleaning project...%b\n" "$(BLUE)" "$(RESET)" | |
| # Remove ignored files/directories, but keep .env files | |
| @git clean -d -X -f \ | |
| -e .env \ | |
| -e '.env.*' | |
| # Remove build & test artifacts | |
| @rm -rf \ | |
| dist \ | |
| build \ | |
| *.egg-info \ | |
| .coverage \ | |
| .pytest_cache | |
| @printf "%bRemoving local branches with no remote counterpart...%b\n" "$(BLUE)" "$(RESET)" | |
| @git fetch --prune | |
| @git branch -vv | awk '/: gone]/{print $$1}' | xargs git branch -D 2>/dev/null || true |
🤖 Prompt for AI Agents
In Makefile around lines 111 to 131, the clean target uses the non-portable
GNU-specific xargs -r flag on line 131 which fails on BSD/macOS; remove the
dependency on -r by changing the branch-deletion step to a portable loop or
xargs invocation — e.g., pipe the awk output into a POSIX-safe loop (while read
-r branch; do git branch -D "$branch"; done) or use xargs -n1 git branch -D so
empty input is handled safely without relying on -r; update the Makefile
accordingly.
2 participants
This pull request synchronizes the repository with its template.
Changes were generated automatically using rhiza.
Summary by CodeRabbit
Release Notes
Chores
Documentation
✏️ Tip: You can customize this high-level summary in your review settings.