docs: site updates and license attribution#524
Merged
Merged
Conversation
✅ Deploy Preview for devsydev ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Warning Review limit reached
More reviews will be available in 26 minutes and 27 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more credits in the billing tab to continue. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (23)
📝 WalkthroughWalkthroughThis PR introduces a Go-based ChangesThird-Party License Tooling
Documentation Restructure
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Deploy Preview for images-devsy-sh canceled.
|
skevetter
changed the title
skevetter
changed the title
skevetter
force-pushed
the
slippery-bear
branch
3 times, most recently
from
June 24, 2026 11:56
caa1d2a to
38c919b
Compare
skevetter
marked this pull request as ready for review
June 24, 2026 12:46
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-ci.yml:
- Around line 121-135: The new licenses job is not part of the final CI gate, so
its failure won’t block merges. Update the ci-success job in the workflow to
include licenses in its needs list and failure condition, using the existing job
names like licenses and ci-success so the final gate waits on this policy check
before succeeding.
- Around line 121-135: Harden the licenses job by removing the floating major
action references in the licenses workflow job and pinning the checkout and Go
setup steps to fixed versions, while also tightening the job’s security
defaults. In the licenses job, add a job-level permissions block with contents:
read, and update the actions/checkout step to disable credential persistence via
persist-credentials: false; keep the existing job structure and step names so
the changes are localized and easy to find.
In `@hack/licenses/main.go`:
- Around line 186-187: The module classification is being overwritten in the
license generation flow, which collapses the direct/indirect split. Update the
logic in the code that builds `modules` around `m.Indirect` so it preserves the
value already computed by the module metadata instead of forcing it to false.
Keep the existing direct vs indirect grouping behavior intact when populating
`modules[m.Path]` in the license processing path.
- Around line 124-129: The goModule struct used by the licenses processing flow
is missing the Version field, causing version data to be dropped from the JSON
stream and rendered as placeholders in THIRD_PARTY_LICENSES.md. Update goModule
to include Version and make sure the code path that unmarshals or emits goModule
values in the licenses pipeline preserves and propagates that field through the
existing module handling logic.
In `@sites/docs-devsy-sh/pages/quickstart/quickstart.mdx`:
- Around line 50-58: The quickstart SSH examples use two different workspace
placeholders, which is confusing for readers copying the command. Update the SSH
command text in the quickstart content to use one consistent placeholder
throughout, and make sure both the opening command and the later reference in
the Vim/Neovim section match the same symbol used in this document’s SSH
guidance.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: dd678d1a-b336-4489-b341-d634dc136575
📒 Files selected for processing (23)
.devcontainer/devcontainer.json.github/workflows/devcontainer.yml.github/workflows/pr-ci.yml.goreleaser.ymlTHIRD_PARTY_LICENSES.mdTaskfile.ymlhack/licenses/main.gohack/licenses/overrides.ndjsonhack/licenses/rules.jsonhack/licenses/third-party-licenses.md.tmplsites/docs-devsy-sh/pages/developing-in-workspaces/inactivity-timeout.mdxsites/docs-devsy-sh/pages/developing-in-workspaces/what-are-workspaces.mdxsites/docs-devsy-sh/pages/licenses/devsy.mdxsites/docs-devsy-sh/pages/quickstart/browser.mdxsites/docs-devsy-sh/pages/quickstart/devsy-cli.mdxsites/docs-devsy-sh/pages/quickstart/jetbrains.mdxsites/docs-devsy-sh/pages/quickstart/quickstart.mdxsites/docs-devsy-sh/pages/quickstart/ssh.mdxsites/docs-devsy-sh/pages/quickstart/vim.mdxsites/docs-devsy-sh/pages/quickstart/vscode.mdxsites/docs-devsy-sh/pages/what-is-devsy.mdxsites/docs-devsy-sh/sidebars.jssites/docs-devsy-sh/src/css/custom.css
💤 Files with no reviewable changes (7)
- sites/docs-devsy-sh/pages/quickstart/ssh.mdx
- sites/docs-devsy-sh/pages/licenses/devsy.mdx
- sites/docs-devsy-sh/pages/quickstart/vim.mdx
- sites/docs-devsy-sh/pages/quickstart/jetbrains.mdx
- sites/docs-devsy-sh/pages/quickstart/browser.mdx
- sites/docs-devsy-sh/pages/quickstart/devsy-cli.mdx
- sites/docs-devsy-sh/pages/quickstart/vscode.mdx
Refresh the docs voice toward organizations scaling engineering operations, collapse the six per-IDE Quick Start pages into a single guide, and fix sidebar section spacing so every category renders consistently. Signed-off-by: Samuel K <skevetter@pm.me>
Generate THIRD_PARTY_LICENSES.md from the modules actually compiled into the CLI (the union of build dependencies across every released OS/arch) via go-licence-detector, and bundle it into release archives so attribution ships with the binary. Deriving the set from the import graph rather than the full module graph keeps the output deterministic across machines, Go versions, and module-cache state. A PR check enforces the license allowlist and keeps the committed file in sync, and the ci-success gate depends on it. Replaces the hand-maintained docs licenses page. Run with 'task cli:licenses' / 'task cli:licenses:check'. Signed-off-by: Samuel K <skevetter@pm.me>
Switch the devcontainer feature to prek and update the devcontainer build smoke test to verify prek instead of pre-commit, matching the prek-action already used in pr-ci. Signed-off-by: Samuel K <skevetter@pm.me>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three related pieces of cleanup for the docs site and build tooling.
Docs repositioning & navigation
what-is-devsy,what-are-workspaces,inactivity-timeout).quickstart.mdxand flatten the sidebar entry.:nth-child(-n+7)rule skipped later sections); remove the now-orphaned separator styling.Automated third-party license attribution
hack/licensesGo tool (go run ./hack/licenses) generatesTHIRD_PARTY_LICENSES.mdfrom the module graph viago-licence-detector, enforcing a license allowlist..goreleaser.yml) so attribution ships with the binary — satisfying the MIT/BSD/Apache notice-retention requirement.licensesPR check (task cli:licenses:check) enforces the allowlist and keeps the committed file in sync; copyleft licenses (GPL/LGPL/AGPL) are excluded by design.prek migration
pre-committoprekand update the devcontainer build smoke test to match, consistent with theprek-actionalready used inpr-ci.Notes
go list -m allattributes test/tooling modules (e.g. staticcheck) that aren't linked into the shipped binary. This is intentional over-attribution; it can be narrowed to the binary's package graph later if desired.Summary by CodeRabbit
New Features
Bug Fixes
Documentation