Skip to content

Redesign documentation styling and reorganize manual structure#1089

Merged
spoorcc merged 30 commits intomainfrom
claude/redesign-docs-styling-W71w3
Mar 29, 2026
Merged

Redesign documentation styling and reorganize manual structure#1089
spoorcc merged 30 commits intomainfrom
claude/redesign-docs-styling-W71w3

Conversation

@spoorcc
Copy link
Copy Markdown
Contributor

@spoorcc spoorcc commented Mar 29, 2026

Summary

This PR comprehensively redesigns the documentation's visual appearance and reorganizes the manual to follow the Diataxis framework. The changes include a complete CSS overhaul with a modern design system, improved typography, and better visual hierarchy across all documentation pages.

Key Changes

Design System & Styling (doc/static/css/custom.css)

  • Complete CSS rewrite (44 → 400+ lines): Replaced Roboto font stack with Inter + JetBrains Mono
  • Design tokens: Introduced CSS custom properties for colors, spacing, shadows, and transitions that mirror the landing page palette
    • Primary amber (#c2620a), accent blue (#4e7fa0), semantic colors for tutorials/how-tos/reference/explanation
    • Background tints, borders, and gradients
  • Enhanced components:
    • Code blocks with improved styling, syntax highlighting, and monospace fonts
    • Admonitions with color-coded left borders and semantic backgrounds
    • Cards with hover effects and shadow depth
    • Tables with striped rows and proper typography
    • Full-bleed color bands (.band-tint, .band-mint) for visual emphasis
    • Sidebar navigation with active link styling
  • Typography improvements: Better line-height, letter-spacing, and font weights across headings and body text
  • Visual effects: Subtle dot-grid background, radial gradients, smooth transitions, and rounded corners

Documentation Structure (doc/manual.rst)

  • Reorganized into Diataxis sections:
    • Foundational: init, import, add, check, update (core workflow)
    • Patching: diff, update-patch, format-patch (patch management)
    • CI/CD Integration: reporting, report, list, SBOM (automation)
  • Improved introductions: Clearer descriptions of command purposes and groupings
  • Added PlantUML diagram (commands.puml): Visual mind map of command hierarchy
  • Better command documentation: Moved from flat list to hierarchical, grouped structure

Feature Documentation

  • Split interactive add scenarios: Moved interactive-specific test scenarios to dedicated features/interactive-add.feature file
  • Updated non-interactive add: Clarified that --interactive flag is separate from basic CLI options

Supporting Files

  • Design guide (doc/contributing.rst): Added comprehensive design token documentation with color swatches and typography samples
  • Diataxis classification (doc/static/js/diataxis.js): New JavaScript module for automatic page classification and sidebar coloring
  • PlantUML diagrams: Updated check.puml and update.puml with consistent styling
  • Sphinx configuration (doc/conf.py): Added sphinx_design extension and diataxis.js script
  • Content updates: Enhanced docstrings in command modules (report.py, import_.py, etc.) with clearer descriptions
  • Metadata: Updated index.rst and README.md with improved descriptions emphasizing supply-chain readiness

Notable Implementation Details

  • Design tokens use CSS custom properties (:root) for easy theming and consistency
  • Sidebar navigation uses nth-of-type selectors for Diataxis color-coding without requiring explicit classes
  • Full-bleed bands use calc() and viewport-relative widths for responsive edge-to-edge backgrounds
  • Admonition styling includes semantic color variants (warning/caution/danger/tip/hint)
  • PlantUML diagrams styled to match documentation palette with custom skinparams
  • Asciinema player theme customized with project-specific terminal colors

https://claude.ai/code/session_0183Tzu6McYvSDwoXDoRjEyN

Summary by CodeRabbit

  • Documentation
    • Major documentation overhaul: reorganized manuals, reference, how‑tos and tutorials; added vendoring, migration, SBOM, patching, troubleshooting, contributing and CLI cheatsheet guides with demos.
  • New Features
    • Interactive add wizard restored with guided prompts; SBOM export (CycloneDX 1.6 JSON) including optional SHA‑256 integrity hashes and automated license detection.
  • Style
    • New docs design system: vendored fonts, color/typography tokens, component styles, printable/fullscreen cheatsheet and Diataxis section badges/behavior.

claude added 12 commits March 29, 2026 11:37
- Replace Roboto with Inter + JetBrains Mono to match landing page typography
- Port landing page design tokens (colors, shadows, radii) into docs CSS
- Add subtle dot-grid background, amber glow, and terminal theme overrides
- Style code blocks, admonitions, tables, sidebar, and links coherently
- Add h1 accent underline and dashed hr matching landing page motifs
- Reorganise index.rst toctrees into four Diataxis sections:
    Tutorials    → installation, getting_started
    How-to Guides → troubleshooting, contributing
    Reference    → manifest, manual, changelog, legal
    Explanation  → vendoring, alternatives, internal
- Add sphinx_design extension to conf.py (already used by landing page)

https://claude.ai/code/session_0183Tzu6McYvSDwoXDoRjEyN
- features/add-project-through-cli.feature now contains only the four
  non-interactive scenarios (plain add, auto-rename, dst guessing, overrides)
- features/interactive-add.feature is a new file with all eight interactive
  scenarios (guided wizard, tag, src, ignore, update, abort, empty-src,
  pre-filled fields)
- doc/manual.rst Add section now has two subsections:
    Non-interactive: add.cast + scenario-include for add-project-through-cli.feature
    Interactive:     interactive-add.cast + scenario-include for interactive-add.feature

https://claude.ai/code/session_0183Tzu6McYvSDwoXDoRjEyN
- Replace plain prose sections with sphinx_design grids and cards:
    • Benefits   → 2×2 icon-card grid in band-tint section
    • Costs      → 2×2 icon-card grid in band-mint section
    • Languages  → 3-column grid of language cards
    • Conclusion → tinted full-width card
    • Best practices → 9 full-width cards each with a Material icon title
    • Real-world projects → two band grids with linked cards
    • Further Reading  → icon-prefixed bullet list
- Add band-tint / band-mint CSS, sd-card / stat-card / card-tinted /
  sd-bg-dark rules, and sd-text-primary colour to docs custom.css
  (mirrors the landing page component library)

https://claude.ai/code/session_0183Tzu6McYvSDwoXDoRjEyN
README.md:
- Tagline: "DFetch can manage dependencies" → "Vendor dependencies without the pain."
- Opening paragraph: internal rationale → user-facing pitch matching landing page
  ("copies source code directly...no Git submodules, no lock-in")
- "What Dfetch Does" bullets: add supply-chain, SBOM, patch stack, dfetch import;
  drop vague items; lead with the strongest differentiators
- "DFetch" → "Dfetch" throughout
- "Github" → "GitHub"

doc/index.rst:
- OG/Twitter title: "Dfetch - a source-only no-hassle project-dependency aggregator"
  → "Dfetch — Vendor dependencies without the pain" (em-dash, landing page tagline)
- OG/Twitter description: aligned to landing page wording
  ("No submodules, no lock-in, supply-chain ready.")
- Sphinx meta description: aligned to landing page wording
- Keywords: add "supply chain, sbom, license compliance"; drop "fetch tool,
  package manager, multi-project, monorepo"
- H1 subtitle: aligned to landing page tagline
- Intro paragraph: replaced internal backstory with user-facing pitch +
  supply-chain and patch-stack highlights

https://claude.ai/code/session_0183Tzu6McYvSDwoXDoRjEyN
check.puml / update.puml:
- Remove monochrome true and Frutiger font
- Activity nodes: white fill, amber (#c2620a) border, 1.5px, rounded corners
- Decision diamonds: mint tint (#eff6fa) fill, accent blue (#4e7fa0) border,
  accent-dark text (#3a6682)
- Arrows / labels: muted grey (#78716c)
- Start circle: amber; end circle: charcoal
- Partitions (update.puml): warm tint fill (#fef8f0), muted border (#e7e0d8),
  small bold uppercase label in muted grey
- Font: Arial (closest available to Inter in PlantUML)
- Background: transparent so body dot-grid shows through

custom.css:
- img[src*="plantweb"] rule: white card with border, rounded corners,
  box-shadow, and generous padding — matches the sd-card / admonition style

https://claude.ai/code/session_0183Tzu6McYvSDwoXDoRjEyN
Commands are now organised from basic to advanced:

  Foundational  — Init, Import, Add, Check, Update
    The complete everyday workflow: create/migrate a manifest,
    register dependencies, check versions, fetch them.

  Patching      — Diff, Update patch, Format patch
    First-class patch workflow: capture, reapply, and export
    local changes while staying syncable with upstream.

  CI/CD Integration — Reporting (Jenkins/SARIF/Code Climate), Report/SBOM
    Machine-readable output for automated pipelines, security
    toolchains, and compliance audits.
    The Check Reporting sub-sections are moved out of Check and
    into this group so they sit next to Report/SBOM where readers
    looking for integration topics expect them.

  Utilities     — Freeze, Environment, Validate
    Supporting commands: pin versions, verify setup, validate manifest.

Other changes:
- Remove the "Introduction" heading; intro prose stays under the page title
- Separate groups with horizontal rules for visual breathing room
- Add a one-paragraph section description for each group
- Rewrite CLI Cheatsheet using the same four-group structure with
  labelled bold headings instead of a flat list
- Update cheatsheet copy to match landing-page messaging

https://claude.ai/code/session_0183Tzu6McYvSDwoXDoRjEyN
manual.rst — CLI Cheatsheet section:
- Replace flat bulleted list with a raw HTML 2×2 grid
- Four cards matching the manual's four groups:
    Foundational   → amber header  (--primary)
    Patching       → slate-blue header (--accent)
    CI/CD          → warm-charcoal header (#1e1610, dark card style)
    Utilities      → warm-tint header (--bg-tint, softer)
- Each card has a title + tagline in the header
- Commands rendered as a two-column table: syntax (JetBrains Mono,
  amber) | description (Inter, muted); optional args shown lighter
- Alternating row tint on even rows

custom.css — new .cheatsheet / .cs-* rules:
- CSS grid, 2-col on ≥700 px, 1-col on narrow viewports
- .cs-cmd code resets the inline-code badge style (no bg, no border)
- .cs-cmd em for optional args shown in --text-muted
- .cs-table overrides general table.docutils rules (no shadow, no radius)
- @media print: force background colours (print-color-adjust: exact),
  drop shadows, keep 2-col layout, suppress link-URL decoration

https://claude.ai/code/session_0183Tzu6McYvSDwoXDoRjEyN
HTML (manual.rst):
- Replace 4-separate-white-cards with a single dark terminal card
- Masthead: "df" amber badge logo + title + tagline +
  syntax-legend pills (subcommand / --flag / <arg>)
- Two-column body (col 1: Foundational + Utilities,
                   col 2: Patching + CI/CD) split by a hairline
- Section labels: coloured dot + ALL-CAPS name + muted tagline,
  underlined in the section colour
  (amber / blue / purple / green for the four groups)
- Every command hand-tagged with token spans:
    .cs-kw  dfetch         → dim cream (de-emphasised)
    .cs-sc  subcommand     → bright amber (hero colour)
    .cs-fl  --flag / -f    → accent blue
    .cs-ag  <arg> / [opt]  → muted grey
- Footer bar: docs + GitHub URL in small muted text

CSS (custom.css):
- Dark gradient background matching the landing-page dark card
- Masthead with amber-tinted background band
- Syntax legend token pills
- Section label colour variants: cs-l-primary / cs-l-accent /
  cs-l-ci / cs-l-utility
- Row separators: 4% white hairlines
- Responsive: single-column below 720 px
- Print: force colour-adjust, drop shadow, suppress link URLs

https://claude.ai/code/session_0183Tzu6McYvSDwoXDoRjEyN
- New commands.puml: mindmap with 4 colour-coded groups (Foundational
  amber, Patching blue, CI/CD purple, Utilities green) matching design
  tokens, placed right after the --help output in manual.rst
- Wire check.puml and update.puml into their respective sections
- Widen plantweb card max-width to 780px to give the mindmap room

https://claude.ai/code/session_0183Tzu6McYvSDwoXDoRjEyN
- Remove duplicate diagram directives from manual.rst (check.puml and
  update.puml are already embedded in their module docstrings)
- Expand thin module docstrings: init, report, environment, validate
  now explain what the command does, its output, and next steps
- Fix validate.py circular self-reference ("Note that you can validate
  using validate") — rewrite as a proper command description
- Fix typo in update.py: "don't what recommendations" → "want"
- Improve --no-recommendations help on check and update: explain sub-
  manifest recursion instead of vague "ignore recommendations"
- Clarify --force on update: warn that local changes will be overwritten
- Fix reporter --help strings: consistent capitalisation (SARIF, GitHub,
  GitLab), clearer verb ("Write a … report to <outfile>")
- Expand diff --revs and project help: show format, mention output file
- Expand format-patch -o help: document default and output filename
- Add SVN externals migration steps to import_.py matching the depth
  of the Git submodules section; include nested-externals caveat

https://claude.ai/code/session_0183Tzu6McYvSDwoXDoRjEyN
New "Design Guide" section under "Creating documentation" covers:
- Colour palette: 8 swatches with token name, hex, role, and usage
  (primary amber, accent blue, near-black text, warm-gray muted,
   primary-dark, accent-dark, bg-tint cream, bg-mint cool)
- Typography: two side-by-side specimens — Inter at all 6 weights
  and JetBrains Mono at 400/500 with usage guidance
- CSS token reference table: all --primary/--accent/--text/--bg/
  --border/--r/--shad tokens with colour dots and use descriptions
- PlantUML skinparam guide: list-table mapping each diagram element
  (activity, diamond, arrow, partition, start node) to the correct
  token value so new diagrams stay visually consistent

New CSS classes: .dg-palette, .dg-swatch*, .dg-type-grid/card/header/
body/specimen/weights, .dg-tokens (table overrides), .dg-dot

https://claude.ai/code/session_0183Tzu6McYvSDwoXDoRjEyN
New file: doc/static/js/diataxis.js
- Classifies each page into Tutorial / How-to / Reference / Explanation
  via a PAGE_SECTIONS map (keyed by filename without .html)
- Adds dxt-<section> class to <body> → CSS paints coloured top strip
- Injects a floating kind badge ("Tutorial", "How-to Guide", etc.) at
  the top of div.body
- Finds sidebar p.caption elements by caption text, adds
  dxt-caption-<section> and dxt-section-<section> classes

CSS additions (custom.css):
- Four new tokens: --dxt-tutorial (#c2620a), --dxt-howto (#4e7fa0),
  --dxt-reference (#4a7a62 sage), --dxt-explanation (#7a5a9a purple)
- 4px coloured top border on div.body per section
- .dxt-badge pills: subtle tinted background + border in section colour
- Sidebar caption: coloured left border + tinted background + dot pip
  + caption text colour per section
- Sidebar links: section-coloured hover and bold active link

Design Guide updated with a 4-swatch row documenting each section
colour and a note on how to register new pages.

https://claude.ai/code/session_0183Tzu6McYvSDwoXDoRjEyN
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Mar 29, 2026

Walkthrough

Large-scale documentation and design-system update: README rewrite, expanded and reorganized Sphinx docs (new how‑tos, reference pages, Diataxis structure), updated command docstrings/help text, new design CSS/JS and PlantUML assets, feature-test reorganization (split interactive add scenarios), and added font vendoring entries plus generated metadata files.

Changes

Cohort / File(s) Summary
Top-level docs & README
README.md, doc/index.rst, doc/landing-page/index.rst
Rewrote top-level pitch/introduction, adjusted header/navigation targets and landing-page CTA target.
CLI command docs & help strings
dfetch/commands/...
dfetch/commands/add.py, dfetch/commands/check.py, dfetch/commands/diff.py, dfetch/commands/environment.py, dfetch/commands/format_patch.py, dfetch/commands/import_.py, dfetch/commands/init.py, dfetch/commands/report.py, dfetch/commands/update.py, dfetch/commands/validate.py
Replaced long inline docstrings with shorter descriptions and scenario includes, clarified argparse help text for multiple flags (--no-recommendations, --revs, --force, report SBOM/output), and reorganized command documentation. No runtime/API changes.
Sphinx structure & new pages
doc/reference/commands.rst, doc/manual.rst, doc/vendoring.rst, doc/explanation/vendoring.rst, doc/howto/*.rst, doc/tutorials/installation.rst, doc/reference/cli_cheatsheet.rst, doc/contributing.rst
Added many how‑to/explanation/reference pages, reorganized TOC into Diataxis sections, added CLI cheatsheet and migration/sbom/patching/howto content.
Sphinx config & directive
doc/conf.py, doc/_ext/scenario_directive.py
Enabled sphinx_design, added html_js_files entry, adjusted suppress_warnings, and changed scenario directive to resolve feature paths relative to the rst document.
Design tokens, styles, fonts
doc/static/css/custom.css, doc/static/fonts/*
Replaced remote Roboto with vendored Inter and JetBrains Mono; introduced extensive CSS tokens, typography, component styles, full redesign of docs UI and print/cheatsheet rules.
Diataxis JS & DOM hooks
doc/static/js/diataxis.js
New self-invoking script mapping pages to Diataxis sections, adding dxt-<section> body classes, injecting floating badges and annotating sidebar captions (DOM operations guarded).
PlantUML assets
doc/static/uml/check.puml, doc/static/uml/update.puml, doc/static/uml/commands.puml
Updated PlantUML skinparam styling across diagrams and added a new commands mindmap.
Feature tests (Gherkin)
features/add-project-through-cli.feature, features/interactive-add.feature
Moved interactive scenarios into a new interactive-add.feature; non-interactive feature file now contains only non-interactive scenarios.
Vendored font manifests & generated metadata
dfetch.yaml, doc/static/fonts/inter/.dfetch_data.yaml, doc/static/fonts/inter/LICENSE.txt, doc/static/fonts/jetbrains-mono/.dfetch_data.yaml
Added manifest entries to fetch Inter and JetBrains Mono zips; added generated .dfetch_data.yaml files and included Inter LICENSE.
Design/doc guide assets
doc/static/uml/*.puml, doc/static/js/diataxis.js, doc/static/css/custom.css
New/updated assets and guide content to enforce visual conventions and Diataxis-driven theming (grouped due to tight coupling).

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~40 minutes

Possibly related PRs

Suggested labels

documentation

Suggested reviewers

  • ben-edna
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately and specifically summarizes the main changes: redesigning documentation styling (extensive CSS rewrite and component system) and reorganizing the manual structure around Diataxis framework.
Docstring Coverage ✅ Passed Docstring coverage is 90.00% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch claude/redesign-docs-styling-W71w3

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 6

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
features/add-project-through-cli.feature (1)

3-9: ⚠️ Potential issue | 🟡 Minor

Feature intro still implies confirmation for non-interactive add.

The description says entries are appended “after confirmation,” but this file now documents non-interactive behavior, which adds directly. Please align the intro wording to avoid user confusion.

✏️ Suggested wording update
-    fills in sensible defaults (name, destination, default branch), shows a
-    preview, and appends the entry to ``dfetch.yaml`` after confirmation.
+    fills in sensible defaults (name, destination, default branch), shows a
+    preview, and appends the entry to ``dfetch.yaml`` directly.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@features/add-project-through-cli.feature` around lines 3 - 9, Update the
feature intro to remove the implication of mandatory confirmation when using the
non-interactive add command; locate the line describing "dfetch add <url>" and
change the phrase "shows a preview, and appends the entry to ``dfetch.yaml``
after confirmation" to indicate that the command shows a preview and appends the
entry (or appends immediately in non-interactive mode / when flags are
provided), and keep the mention of flags (--name, --dst, --version, --src,
--ignore) for pre-filling fields so the behavior matches the documented
non-interactive flow.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@dfetch/commands/format_patch.py`:
- Around line 76-80: The help string for the output directory is incorrect: it
states the output will be named formatted-<project>.patch while the
implementation actually uses pathlib.Path(patch_file).name to preserve the
original patch filename. Update the help text (the help= argument in
format_patch.py where the directory argument is defined) to accurately describe
that the formatted patch will be written to the specified directory using the
original patch's basename (from pathlib.Path(patch_file).name), or alternatively
change the implementation to generate formatted-<project>.patch; pick one and
make the help text and the code (pathlib.Path(patch_file).name usage)
consistent.

In `@doc/static/css/custom.css`:
- Line 1: Remove the external Google Fonts `@import` from
doc/static/css/custom.css and update typography to use either system font stacks
or self-hosted font files: delete the `@import` line and change body font-family
to a system stack like -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif
and change code/monospace font-family to a stack like "Fira Code", Consolas,
monospace; if you prefer self-hosting, add `@font-face` rules that point to files
under _static/fonts/ for Inter and JetBrains Mono and reference those family
names in the existing body and code selectors instead of the Google Fonts
import.
- Around line 300-304: In the .sd-bg-dark rule swap the property order so
border-color comes before border-top-color (both with !important) to prevent the
shorthand from overriding the top-border accent; locate the .sd-bg-dark CSS
block and move the border-top-color declaration to appear after border-color so
the intended top border contrast is preserved.
- Around line 593-597: The CSS uses an undefined variable --shad-xl in the
.cheatsheet rule so the box-shadow is dropped; fix by defining --shad-xl in
:root (or update .cheatsheet to use an existing variable like --shad-lg or
provide a fallback such as var(--shad-xl, var(--shad-lg))). Update the :root
declaration to include --shad-xl with the intended shadow value or change the
.cheatsheet box-shadow to var(--shad-lg) so the cheatsheet card renders with the
expected shadow.
- Around line 128-140: The CSS currently sets overflow: hidden on div.highlight
which clips long code samples on narrow viewports; change the rule for
div.highlight to allow scrolling (e.g., remove overflow: hidden and/or set
overflow-x: auto) and ensure div.highlight pre has horizontal scrolling enabled
(e.g., overflow-x: auto and white-space: pre or pre-wrap as appropriate) so long
lines can be scrolled instead of clipped; update the selectors div.highlight and
div.highlight pre accordingly.

In `@doc/vendoring.rst`:
- Around line 332-334: The Sphinx cross-reference :ref:`Patch` in the text is
unresolved; fix it by either adding an explicit label for the patch section
(e.g. add a section anchor like ``.. _Patch:`` immediately before the
documentation section that describes the patch attribute/workflow) or by
changing the reference to point to the correct existing label (replace
``:ref:`Patch``` with ``:ref:`<existing-label>` where <existing-label> is the
actual target for the patch attribute/workflow); ensure the label you add or
reference matches the unique identifier used elsewhere and keep the surrounding
text referencing ``dfetch diff`` and the ``Check`` CI check unchanged.

---

Outside diff comments:
In `@features/add-project-through-cli.feature`:
- Around line 3-9: Update the feature intro to remove the implication of
mandatory confirmation when using the non-interactive add command; locate the
line describing "dfetch add <url>" and change the phrase "shows a preview, and
appends the entry to ``dfetch.yaml`` after confirmation" to indicate that the
command shows a preview and appends the entry (or appends immediately in
non-interactive mode / when flags are provided), and keep the mention of flags
(--name, --dst, --version, --src, --ignore) for pre-filling fields so the
behavior matches the documented non-interactive flow.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 1c06af86-0a98-4e53-a51c-1d6e3e067507

📥 Commits

Reviewing files that changed from the base of the PR and between 9b6b631 and 1d2544e.

📒 Files selected for processing (23)
  • README.md
  • dfetch/commands/add.py
  • dfetch/commands/check.py
  • dfetch/commands/diff.py
  • dfetch/commands/environment.py
  • dfetch/commands/format_patch.py
  • dfetch/commands/import_.py
  • dfetch/commands/init.py
  • dfetch/commands/report.py
  • dfetch/commands/update.py
  • dfetch/commands/validate.py
  • doc/conf.py
  • doc/contributing.rst
  • doc/index.rst
  • doc/manual.rst
  • doc/static/css/custom.css
  • doc/static/js/diataxis.js
  • doc/static/uml/check.puml
  • doc/static/uml/commands.puml
  • doc/static/uml/update.puml
  • doc/vendoring.rst
  • features/add-project-through-cli.feature
  • features/interactive-add.feature

Comment on lines +76 to +80
help=(
"Directory to write formatted patches to "
"(default: current working directory). "
"The output file is named formatted-<project>.patch."
),
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Incorrect output filename pattern in help text.

The help text claims the output file is named formatted-<project>.patch, but the actual implementation at lines 130-132 uses pathlib.Path(patch_file).name, which preserves the original patch filename rather than following a formatted-<project>.patch pattern.

📝 Proposed fix for the help text
             help=(
                 "Directory to write formatted patches to "
                 "(default: current working directory). "
-                "The output file is named formatted-<project>.patch."
+                "The output filename is preserved from the input patch file."
             ),
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
help=(
"Directory to write formatted patches to "
"(default: current working directory). "
"The output file is named formatted-<project>.patch."
),
help=(
"Directory to write formatted patches to "
"(default: current working directory). "
"The output filename is preserved from the input patch file."
),
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@dfetch/commands/format_patch.py` around lines 76 - 80, The help string for
the output directory is incorrect: it states the output will be named
formatted-<project>.patch while the implementation actually uses
pathlib.Path(patch_file).name to preserve the original patch filename. Update
the help text (the help= argument in format_patch.py where the directory
argument is defined) to accurately describe that the formatted patch will be
written to the specified directory using the original patch's basename (from
pathlib.Path(patch_file).name), or alternatively change the implementation to
generate formatted-<project>.patch; pick one and make the help text and the code
(pathlib.Path(patch_file).name usage) consistent.

Comment on lines +128 to +140
div.highlight {
border-radius: var(--r-sm) !important;
overflow: hidden !important;
box-shadow: var(--shad-sm) !important;
border: 1px solid var(--border) !important;
}

div.highlight pre {
font-family: "JetBrains Mono", "Fira Code", "Cascadia Code", Consolas, monospace !important;
font-size: 0.875rem !important;
line-height: 1.7 !important;
padding: 1.25rem 1.5rem !important;
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

find . -name "custom.css" -type f

Repository: dfetch-org/dfetch

Length of output: 129


🏁 Script executed:

wc -l ./doc/static/css/custom.css

Repository: dfetch-org/dfetch

Length of output: 93


🏁 Script executed:

sed -n '128,140p' ./doc/static/css/custom.css

Repository: dfetch-org/dfetch

Length of output: 458


🏁 Script executed:

grep -n "div.highlight\|\.highlight" ./doc/static/css/custom.css | head -30

Repository: dfetch-org/dfetch

Length of output: 104


🏁 Script executed:

grep -r "overflow.*hidden\|div\.highlight" ./doc --include="*.css" --include="*.html" --include="*.md"

Repository: dfetch-org/dfetch

Length of output: 1425


🏁 Script executed:

sed -n '1,150p' ./doc/static/css/custom.css | tail -50

Repository: dfetch-org/dfetch

Length of output: 1217


🏁 Script executed:

grep -n "overflow" ./doc/static/css/custom.css | grep -A 2 -B 2 "div.highlight"

Repository: dfetch-org/dfetch

Length of output: 43


🏁 Script executed:

sed -n '125,200p' ./doc/static/css/custom.css

Repository: dfetch-org/dfetch

Length of output: 2359


Don't allow long code samples to be clipped on narrow viewports.

div.highlight uses overflow: hidden, which clips content instead of allowing horizontal scroll. This prevents readers from seeing full commands and YAML blocks on narrower screens.

Suggested fix
 div.highlight {
   border-radius: var(--r-sm) !important;
-  overflow: hidden !important;
+  overflow-x: auto !important;
+  overflow-y: hidden !important;
   box-shadow: var(--shad-sm) !important;
   border: 1px solid var(--border) !important;
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
div.highlight {
border-radius: var(--r-sm) !important;
overflow: hidden !important;
box-shadow: var(--shad-sm) !important;
border: 1px solid var(--border) !important;
}
div.highlight pre {
font-family: "JetBrains Mono", "Fira Code", "Cascadia Code", Consolas, monospace !important;
font-size: 0.875rem !important;
line-height: 1.7 !important;
padding: 1.25rem 1.5rem !important;
}
div.highlight {
border-radius: var(--r-sm) !important;
overflow-x: auto !important;
overflow-y: hidden !important;
box-shadow: var(--shad-sm) !important;
border: 1px solid var(--border) !important;
}
div.highlight pre {
font-family: "JetBrains Mono", "Fira Code", "Cascadia Code", Consolas, monospace !important;
font-size: 0.875rem !important;
line-height: 1.7 !important;
padding: 1.25rem 1.5rem !important;
}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@doc/static/css/custom.css` around lines 128 - 140, The CSS currently sets
overflow: hidden on div.highlight which clips long code samples on narrow
viewports; change the rule for div.highlight to allow scrolling (e.g., remove
overflow: hidden and/or set overflow-x: auto) and ensure div.highlight pre has
horizontal scrolling enabled (e.g., overflow-x: auto and white-space: pre or
pre-wrap as appropriate) so long lines can be scrolled instead of clipped;
update the selectors div.highlight and div.highlight pre accordingly.

Comment on lines +300 to +304
.sd-bg-dark {
background: linear-gradient(150deg, #1e1610 0%, #2d2018 100%) !important;
border-top-color: rgba(255, 255, 255, 0.12) !important;
border-color: rgba(255, 255, 255, 0.07) !important;
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# Check if the file exists and read the relevant lines
cat -n doc/static/css/custom.css | sed -n '295,310p'

Repository: dfetch-org/dfetch

Length of output: 728


Move border-top-color after border-color to preserve the top-border accent.

The border-color shorthand sets all four borders, and since it comes after border-top-color in the cascade, it overrides the custom top border color. Reordering these properties will ensure the top border retains its intended contrast:

Fix
 .sd-bg-dark {
   background: linear-gradient(150deg, `#1e1610` 0%, `#2d2018` 100%) !important;
-  border-top-color: rgba(255, 255, 255, 0.12) !important;
   border-color: rgba(255, 255, 255, 0.07) !important;
+  border-top-color: rgba(255, 255, 255, 0.12) !important;
 }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
.sd-bg-dark {
background: linear-gradient(150deg, #1e1610 0%, #2d2018 100%) !important;
border-top-color: rgba(255, 255, 255, 0.12) !important;
border-color: rgba(255, 255, 255, 0.07) !important;
}
.sd-bg-dark {
background: linear-gradient(150deg, `#1e1610` 0%, `#2d2018` 100%) !important;
border-color: rgba(255, 255, 255, 0.07) !important;
border-top-color: rgba(255, 255, 255, 0.12) !important;
}
🧰 Tools
🪛 Stylelint (17.5.0)

[error] 303-303: Unexpected shorthand "border-color" after "border-top-color" (declaration-block-no-shorthand-property-overrides)

(declaration-block-no-shorthand-property-overrides)

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@doc/static/css/custom.css` around lines 300 - 304, In the .sd-bg-dark rule
swap the property order so border-color comes before border-top-color (both with
!important) to prevent the shorthand from overriding the top-border accent;
locate the .sd-bg-dark CSS block and move the border-top-color declaration to
appear after border-color so the intended top border contrast is preserved.

Comment on lines +593 to +597
.cheatsheet {
background: linear-gradient(150deg, #1c1410 0%, #281a0f 100%);
border-radius: var(--r-lg);
box-shadow: var(--shad-xl);
overflow: hidden;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# First, locate the CSS file
find . -name "custom.css" -type f

Repository: dfetch-org/dfetch

Length of output: 129


🏁 Script executed:

# Check the file size first
wc -l ./doc/static/css/custom.css

# Then read lines 593-597
sed -n '593,597p' ./doc/static/css/custom.css

Repository: dfetch-org/dfetch

Length of output: 252


🏁 Script executed:

# Search for :root definition and shadow variables
rg -n "\-\-shad-" ./doc/static/css/custom.css | head -30

Repository: dfetch-org/dfetch

Length of output: 748


🏁 Script executed:

# Search for --shad-xl anywhere in the repository
rg --type css "\-\-shad-xl"

# Also check the landing page CSS file to see its definitions
sed -n '1,50p' ./doc/landing-page/static/css/custom.css | rg -n "\-\-shad-"

Repository: dfetch-org/dfetch

Length of output: 665


--shad-xl is used but never defined in this file.

:root only defines --shad-sm, --shad-md, and --shad-lg. With no fallback, this box-shadow declaration is dropped entirely, so the cheatsheet card renders flat.

🎯 Suggested fix
 .cheatsheet {
   background: linear-gradient(150deg, `#1c1410` 0%, `#281a0f` 100%);
   border-radius: var(--r-lg);
-  box-shadow: var(--shad-xl);
+  box-shadow: var(--shad-lg);
   overflow: hidden;
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@doc/static/css/custom.css` around lines 593 - 597, The CSS uses an undefined
variable --shad-xl in the .cheatsheet rule so the box-shadow is dropped; fix by
defining --shad-xl in :root (or update .cheatsheet to use an existing variable
like --shad-lg or provide a fallback such as var(--shad-xl, var(--shad-lg))).
Update the :root declaration to include --shad-xl with the intended shadow value
or change the .cheatsheet box-shadow to var(--shad-lg) so the cheatsheet card
renders with the expected shadow.

Comment on lines +332 to +334
*Dfetch* addresses this by providing a ``dfetch diff`` (:ref:`Diff`) command and a
``patch`` (:ref:`Patch`) attribute in the manifest. It also has a CI check to detect
local changes using :ref:`Check`.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# First, let's look at the specific lines mentioned (332-334) and surrounding context
head -340 doc/vendoring.rst | tail -20

Repository: dfetch-org/dfetch

Length of output: 889


🏁 Script executed:

# Search for any :ref: references to 'Patch' in the file
rg ':\s*ref:\s*`Patch`' doc/vendoring.rst -A 2 -B 2

Repository: dfetch-org/dfetch

Length of output: 273


🏁 Script executed:

# Search for Patch label definitions (.. _Patch:) in all doc files
rg '\.\.\s+_Patch:' doc/ -A 2 -B 2

Repository: dfetch-org/dfetch

Length of output: 43


🏁 Script executed:

# Search for "Patch" as a section header in the doc directory
rg '^Patch\s*$' doc/ -A 2 -B 2

Repository: dfetch-org/dfetch

Length of output: 43


🏁 Script executed:

# Check if there are any Patch references or definitions in the entire docs
rg 'Patch' doc/vendoring.rst -n | head -20

Repository: dfetch-org/dfetch

Length of output: 216


🏁 Script executed:

# Search for all label definitions (.. _label:) in the doc directory
rg '\.\.\s+_' doc/ | grep -i patch

Repository: dfetch-org/dfetch

Length of output: 209


🏁 Script executed:

# Search for "patch" related sections/labels (case-insensitive)
rg -i '\.\.\s+_.*patch' doc/

Repository: dfetch-org/dfetch

Length of output: 209


🏁 Script executed:

# Check the manifest documentation structure to understand where patch attribute is documented
rg -i 'patch.*attribute|attribute.*patch' doc/ -B 3 -A 3

Repository: dfetch-org/dfetch

Length of output: 50374


🏁 Script executed:

# List all cross-reference labels in doc/vendoring.rst to see the pattern
rg '\.\.\s+_[A-Z]' doc/vendoring.rst

Repository: dfetch-org/dfetch

Length of output: 43


Fix the unresolved Patch reference.

The :ref:\Patch`cross-reference at line 333 has no matching target in the documentation. This will cause Sphinx to emit a warning and fail the docs build if warnings are treated as errors. Either point it at the actual section where the patch attribute/workflow is documented, or add an explicit.. _Patch:` label.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@doc/vendoring.rst` around lines 332 - 334, The Sphinx cross-reference
:ref:`Patch` in the text is unresolved; fix it by either adding an explicit
label for the patch section (e.g. add a section anchor like ``.. _Patch:``
immediately before the documentation section that describes the patch
attribute/workflow) or by changing the reference to point to the correct
existing label (replace ``:ref:`Patch``` with ``:ref:`<existing-label>` where
<existing-label> is the actual target for the patch attribute/workflow); ensure
the label you add or reference matches the unique identifier used elsewhere and
keep the surrounding text referencing ``dfetch diff`` and the ``Check`` CI check
unchanged.

- doc/_ext/patches/001-autoformat-sphinxcontrib.asciinema.patch
- doc/_ext/patches/002-fix-options-sphinxcontrib.asciinema.patch

- name: inter-font

Check warning

Code scanning / DFetch

Project was locally changed Warning

inter-font : inter-font has local changes, please create a patch file or upstream the changes.
- Inter*Italic*
- Inter-Black*

- name: jetbrains-mono-font

Check warning

Code scanning / DFetch

Project was locally changed Warning

jetbrains-mono-font : jetbrains-mono-font has local changes, please create a patch file or upstream the changes.
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

♻️ Duplicate comments (3)
doc/static/css/custom.css (3)

327-331: ⚠️ Potential issue | 🟡 Minor

border-color shorthand overrides border-top-color.

The border-color shorthand on line 330 sets all four borders, overriding the border-top-color on line 329. Swap the order so the top border retains its intended contrast.

Fix
 .sd-bg-dark {
   background: linear-gradient(150deg, `#1e1610` 0%, `#2d2018` 100%) !important;
-  border-top-color: rgba(255, 255, 255, 0.12) !important;
   border-color: rgba(255, 255, 255, 0.07) !important;
+  border-top-color: rgba(255, 255, 255, 0.12) !important;
 }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@doc/static/css/custom.css` around lines 327 - 331, In .sd-bg-dark the
border-color shorthand overrides the earlier border-top-color; to preserve the
intended top-border contrast, declare border-color: rgba(255, 255, 255, 0.07)
!important; before declaring border-top-color: rgba(255, 255, 255, 0.12)
!important; (keep the existing !important flags) so the specific
border-top-color in the .sd-bg-dark rule takes precedence.

640-644: ⚠️ Potential issue | 🟡 Minor

--shad-xl is undefined; cheatsheet card renders without shadow.

:root defines --shad-sm, --shad-md, and --shad-lg (lines 34-36), but --shad-xl is never defined. Without a fallback, the box-shadow declaration is dropped entirely.

Fix — use existing token or define --shad-xl

Option A: Use an existing shadow:

 .cheatsheet {
   background: linear-gradient(150deg, `#1c1410` 0%, `#281a0f` 100%);
   border-radius: var(--r-lg);
-  box-shadow: var(--shad-xl);
+  box-shadow: var(--shad-lg);

Option B: Define --shad-xl in :root:

   --shad-lg:      0 10px 15px -3px rgba(0,0,0,.10), 0 4px 6px -4px rgba(0,0,0,.10);
+  --shad-xl:      0 20px 25px -5px rgba(0,0,0,.10), 0 8px 10px -6px rgba(0,0,0,.10);
   --r:            12px;
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@doc/static/css/custom.css` around lines 640 - 644, The .cheatsheet rule
references an undefined CSS custom property --shad-xl causing the box-shadow to
be dropped; fix by either replacing --shad-xl with an existing token (e.g.,
--shad-lg) in the .cheatsheet selector or add a new --shad-xl definition inside
:root (matching the project's shadow scale) so the box-shadow declaration
resolves correctly. Ensure you update either the .cheatsheet rule or the :root
block accordingly and run a quick style check to confirm the shadow renders.

143-148: ⚠️ Potential issue | 🟡 Minor

Long code samples may be clipped on narrow viewports.

div.highlight uses overflow: hidden !important, which clips content instead of allowing horizontal scroll. This prevents readers from seeing full commands and YAML blocks on narrower screens.

Suggested fix
 div.highlight {
   border-radius: var(--r-sm) !important;
-  overflow: hidden !important;
+  overflow-x: auto !important;
+  overflow-y: hidden !important;
   box-shadow: var(--shad-sm) !important;
   border: 1px solid var(--border) !important;
 }
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@doc/static/css/custom.css` around lines 143 - 148, The CSS for div.highlight
currently uses overflow: hidden !important which clips long code samples; change
this to allow horizontal scrolling by replacing that rule with overflow-x: auto
!important (and optionally overflow-y: visible or hidden as desired) so long
lines and YAML blocks can be scrolled on narrow viewports; update the
div.highlight rule in doc/static/css/custom.css to use overflow-x: auto
!important instead of overflow: hidden !important.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@doc/howto/check-ci.rst`:
- Around line 153-157: The GitHub Action reference in the Dfetch SARIF Check
block uses a moving branch "uses: dfetch-org/dfetch@main"; change this to an
immutable release tag or commit SHA (for example replace with "uses:
dfetch-org/dfetch@v0.12.1" or a full commit SHA) so the example is reproducible
and supply-chain safe, and update the surrounding wording if necessary to
recommend pinning to tags/SHAs rather than branches.

In `@doc/howto/sbom.rst`:
- Line 4: Replace the title "Generate a SBoM" with the standardized
capitalization "Generate an SBOM" to match industry convention and other docs;
update the heading text in the doc (the line containing "Generate a SBoM") so it
reads "Generate an SBOM".

In `@doc/reference/cli_cheatsheet.rst`:
- Around line 177-183: The current click handler attached via
btn.addEventListener uses (document.exitFullscreen ||
document.webkitExitFullscreen).call(document) and (cs.requestFullscreen ||
cs.webkitRequestFullscreen).call(cs) without verifying the chosen function
exists, which can throw if both are undefined; update the handler around the
isFull() branch to first resolve the fullscreen function (e.g., choose
document.exitFullscreen || document.webkitExitFullscreen and
cs.requestFullscreen || cs.webkitRequestFullscreen), check that the resolved
function is truthy before calling it (or use safe optional chaining), and fall
back to a no-op or an informative console.warn if no fullscreen API is
available; locate this logic in the click callback that references isFull(),
document.exitFullscreen, document.webkitExitFullscreen, cs.requestFullscreen,
and cs.webkitRequestFullscreen.

---

Duplicate comments:
In `@doc/static/css/custom.css`:
- Around line 327-331: In .sd-bg-dark the border-color shorthand overrides the
earlier border-top-color; to preserve the intended top-border contrast, declare
border-color: rgba(255, 255, 255, 0.07) !important; before declaring
border-top-color: rgba(255, 255, 255, 0.12) !important; (keep the existing
!important flags) so the specific border-top-color in the .sd-bg-dark rule takes
precedence.
- Around line 640-644: The .cheatsheet rule references an undefined CSS custom
property --shad-xl causing the box-shadow to be dropped; fix by either replacing
--shad-xl with an existing token (e.g., --shad-lg) in the .cheatsheet selector
or add a new --shad-xl definition inside :root (matching the project's shadow
scale) so the box-shadow declaration resolves correctly. Ensure you update
either the .cheatsheet rule or the :root block accordingly and run a quick style
check to confirm the shadow renders.
- Around line 143-148: The CSS for div.highlight currently uses overflow: hidden
!important which clips long code samples; change this to allow horizontal
scrolling by replacing that rule with overflow-x: auto !important (and
optionally overflow-y: visible or hidden as desired) so long lines and YAML
blocks can be scrolled on narrow viewports; update the div.highlight rule in
doc/static/css/custom.css to use overflow-x: auto !important instead of
overflow: hidden !important.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: fa8c02aa-042b-40e6-bc83-537dff135c0e

📥 Commits

Reviewing files that changed from the base of the PR and between 1d2544e and 63bbfe5.

⛔ Files ignored due to path filters (10)
  • doc/static/fonts/inter/Inter-Bold.woff2 is excluded by !**/*.woff2
  • doc/static/fonts/inter/Inter-ExtraBold.woff2 is excluded by !**/*.woff2
  • doc/static/fonts/inter/Inter-ExtraLight.woff2 is excluded by !**/*.woff2
  • doc/static/fonts/inter/Inter-Light.woff2 is excluded by !**/*.woff2
  • doc/static/fonts/inter/Inter-Medium.woff2 is excluded by !**/*.woff2
  • doc/static/fonts/inter/Inter-Regular.woff2 is excluded by !**/*.woff2
  • doc/static/fonts/inter/Inter-SemiBold.woff2 is excluded by !**/*.woff2
  • doc/static/fonts/inter/Inter-Thin.woff2 is excluded by !**/*.woff2
  • doc/static/fonts/jetbrains-mono/JetBrainsMono-Medium.woff2 is excluded by !**/*.woff2
  • doc/static/fonts/jetbrains-mono/JetBrainsMono-Regular.woff2 is excluded by !**/*.woff2
📒 Files selected for processing (33)
  • README.md
  • dfetch.yaml
  • dfetch/commands/add.py
  • dfetch/commands/import_.py
  • dfetch/commands/update.py
  • doc/_ext/scenario_directive.py
  • doc/conf.py
  • doc/explanation/alternatives.rst
  • doc/explanation/internal.rst
  • doc/explanation/vendoring.rst
  • doc/howto/adding-a-project.rst
  • doc/howto/check-ci.rst
  • doc/howto/contributing.rst
  • doc/howto/migration.rst
  • doc/howto/patching.rst
  • doc/howto/sbom.rst
  • doc/howto/troubleshooting.rst
  • doc/howto/updating-projects.rst
  • doc/index.rst
  • doc/landing-page/index.rst
  • doc/reference/changelog.rst
  • doc/reference/cli_cheatsheet.rst
  • doc/reference/commands.rst
  • doc/reference/legal.rst
  • doc/reference/manifest.rst
  • doc/static/css/custom.css
  • doc/static/fonts/inter/.dfetch_data.yaml
  • doc/static/fonts/inter/LICENSE.txt
  • doc/static/fonts/jetbrains-mono/.dfetch_data.yaml
  • doc/static/js/diataxis.js
  • doc/tutorials/getting_started.rst
  • doc/tutorials/installation.rst
  • features/add-project-through-cli.feature

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@doc/howto/sbom.rst`:
- Around line 18-20: The doc claim that licenses are stored in
``.dfetch_data.yaml`` is incorrect; update the text to explain that license data
is not persisted by Metadata.dump and instead is discovered at report time by
_determine_licenses which scans the fetched project directory, so SBOM/license
entries only appear if the project has been fetched and its source tree is
present during report generation. Mention the actual metadata file name
(``.dfetch_data.yaml``) and the two functions (_determine_licenses and
Metadata.dump) so readers know where the behavior originates and that missing
fetched directories yield empty license lists.
- Around line 23-25: The docs incorrectly state only SHA-256 is included; update
doc/howto/sbom.rst so the text mentions all supported algorithms (SHA-256,
SHA-384, and SHA-512) instead of just "SHA-256". Reference the actual supported
set by aligning the wording with the code mappings (DFETCH_TO_CDX_HASH_ALGORITHM
in sbom_reporter.py and SUPPORTED_HASH_ALGORITHMS in integrity_hash.py) and
adjust the phrasing around the ``integrity.hash:`` field to list these three
algorithms for component hash/supply-chain integrity verification.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 389f7d52-150e-4c73-a2b4-5fe6ceaeb21e

📥 Commits

Reviewing files that changed from the base of the PR and between 63bbfe5 and 3632eb1.

📒 Files selected for processing (1)
  • doc/howto/sbom.rst

Comment on lines +18 to +20
*Dfetch* parses each project's license at fetch time and stores it in the
``.dfetch_data.yaml`` metadata file, so reports stay accurate without
re-fetching.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify that Metadata class does not persist license information

# Check Metadata class definition and dump method
rg -n -A 10 'def dump\(self\)' dfetch/project/metadata.py

# Check if license field exists anywhere in metadata handling
rg -n '\blicense' dfetch/project/metadata.py

# Verify _determine_licenses scans directory, not metadata
rg -n -B 3 -A 10 'def _determine_licenses' dfetch/commands/report.py

Repository: dfetch-org/dfetch

Length of output: 1273


Documentation incorrectly describes license persistence.

The documentation claims licenses are "stored in the .dfetch_data.yaml metadata file," but verification confirms this is false:

  1. Metadata.dump() (metadata.py:184-203) persists only: remote_url, branch, revision, last_fetch, tag, hash, patch, and dependencies — no license field.

  2. _determine_licenses() (report.py:103+) scans the fetched project directory at report-generation time, not from metadata. If never fetched, it returns an empty list.

SBOM generation requires the fetched source code to be present; reports will be incomplete if project directories are unavailable.

Suggested fix:

*Dfetch* auto-detects each project's license by scanning the fetched source
directory during report generation. The project must be fetched for license
information to appear in the SBOM.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@doc/howto/sbom.rst` around lines 18 - 20, The doc claim that licenses are
stored in ``.dfetch_data.yaml`` is incorrect; update the text to explain that
license data is not persisted by Metadata.dump and instead is discovered at
report time by _determine_licenses which scans the fetched project directory, so
SBOM/license entries only appear if the project has been fetched and its source
tree is present during report generation. Mention the actual metadata file name
(``.dfetch_data.yaml``) and the two functions (_determine_licenses and
Metadata.dump) so readers know where the behavior originates and that missing
fetched directories yield empty license lists.

Comment on lines +23 to +25
``distribution`` external reference. When an ``integrity.hash:`` field is set
in the manifest the SBOM includes a ``SHA-256`` component hash for
supply-chain integrity verification.
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify which hash algorithms are supported for integrity hashes

# Find the DFETCH_TO_CDX_HASH_ALGORITHM mapping
rg -n -B 2 -A 10 'DFETCH_TO_CDX_HASH_ALGORITHM' dfetch/reporting/sbom_reporter.py

# Check IntegrityHash implementation for supported algorithms
rg -n -B 3 -A 10 'class IntegrityHash' dfetch/

Repository: dfetch-org/dfetch

Length of output: 1897


Update documentation to reflect all supported hash algorithms.

The documentation states the SBOM includes a SHA-256 component hash, but the code supports multiple hash algorithms. The DFETCH_TO_CDX_HASH_ALGORITHM mapping (sbom_reporter.py:128-132) and SUPPORTED_HASH_ALGORITHMS in integrity_hash.py both confirm support for SHA-256, SHA-384, and SHA-512.

Suggested fix
-Archive dependencies (``tar.gz``, ``zip``, …) are recorded with a
-``distribution`` external reference.  When an ``integrity.hash:`` field is set
-in the manifest the SBOM includes a ``SHA-256`` component hash for
-supply-chain integrity verification.
+Archive dependencies (``tar.gz``, ``zip``, …) are recorded with a
+``distribution`` external reference.  When an ``integrity.hash:`` field is set
+in the manifest the SBOM includes a component hash (SHA-256, SHA-384, or
+SHA-512) for supply-chain integrity verification.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@doc/howto/sbom.rst` around lines 23 - 25, The docs incorrectly state only
SHA-256 is included; update doc/howto/sbom.rst so the text mentions all
supported algorithms (SHA-256, SHA-384, and SHA-512) instead of just "SHA-256".
Reference the actual supported set by aligning the wording with the code
mappings (DFETCH_TO_CDX_HASH_ALGORITHM in sbom_reporter.py and
SUPPORTED_HASH_ALGORITHMS in integrity_hash.py) and adjust the phrasing around
the ``integrity.hash:`` field to list these three algorithms for component
hash/supply-chain integrity verification.

@spoorcc
Copy link
Copy Markdown
Contributor Author

spoorcc commented Mar 29, 2026

@coderabbitai fix both issues as suggested and push to this branch

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Mar 29, 2026

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

I need to look up what specific issues were flagged in the PR review before I can plan the fixes.


🏁 Script executed:

#!/bin/bash
# Get all review comments made by coderabbitai on PR `#1089`
gh pr view 1089 --repo dfetch-org/dfetch --json reviews,comments
gh api repos/dfetch-org/dfetch/pulls/1089/comments --jq '.[] | select(.user.login == "coderabbitai") | {id: .id, path: .path, line: .line, body: .body}'

Length of output: 60645


Let me read the relevant files to plan the fixes.


🏁 Script executed:

#!/bin/bash
cat doc/howto/sbom.rst
echo "---"
# Find hash algorithm mappings
rg -n "DFETCH_TO_CDX_HASH_ALGORITHM\|SUPPORTED_HASH_ALGORITHMS\|SHA.256\|SHA.384\|SHA.512" --type py -C2
echo "---"
rg -n "license\|_determine_licenses\|Metadata.dump\|dump" dfetch/commands/report.py -C2 2>/dev/null || true

Length of output: 2628


🏁 Script executed:

#!/bin/bash
# Find hash algorithm definitions
rg -n "SHA.256\|SHA.384\|SHA.512\|SUPPORTED_HASH\|DFETCH_TO_CDX\|hash_algorithm" --type py -C2
echo "==="
# Find _determine_licenses
rg -n "_determine_licenses\|determine_license\|license" --type py -C3 -l
echo "==="
rg -n "_determine_licenses" --type py -C5
echo "==="
# Check what Metadata.dump persists
rg -n "dump\|license" dfetch/metadata.py -C3 2>/dev/null || true
rg -n "class Metadata\|\.license\b" --type py -C3

Length of output: 1587


🏁 Script executed:

#!/bin/bash
# Find the sbom reporter and integrity hash files
fd -e py | xargs grep -l "SHA\|hash_algorithm\|HASH" 2>/dev/null
echo "==="
rg -n "SHA.256\|SHA.384\|SHA.512\|sha_256\|sha_384\|sha_512\|HASH" --type py --iglob "*sbom*" -C2
echo "==="
rg -n "SHA.256\|SHA.384\|SHA.512\|sha_256\|sha_384\|sha_512\|HASH" --type py --iglob "*integrity*" -C2
echo "==="
# Broad search for hash algorithms
rg -n "256\|384\|512" --type py -C2 | grep -i "sha\|hash\|cdx" | head -40

Length of output: 335


🏁 Script executed:

#!/bin/bash
cat dfetch/reporting/sbom_reporter.py
echo "==="
cat dfetch/vcs/integrity_hash.py

Length of output: 15985


I've confirmed both issues. Here are the exact fixes needed for doc/howto/sbom.rst:

  • Fix line 18-20: Replace the incorrect claim that licenses are stored in .dfetch_data.yaml at fetch time — the code shows _determine_licenses scans the fetched source tree at report time
  • Fix line 23-25: Replace the mention of only SHA-256 with all three supported algorithms (SHA-256, SHA-384, SHA-512) as defined in DFETCH_TO_CDX_HASH_ALGORITHM and SUPPORTED_HASH_ALGORITHMS

Failed to handle agent chat message. Please try again.

@spoorcc spoorcc merged commit d0876d2 into main Mar 29, 2026
37 checks passed
@spoorcc spoorcc deleted the claude/redesign-docs-styling-W71w3 branch March 29, 2026 21:02
@coderabbitai coderabbitai bot mentioned this pull request Mar 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants