docs: add public API discovery outputs - #112
Conversation
|
Warning Review limit reached
Next review available in: 52 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe docs application now generates a sanitized public OpenAPI contract and endpoint-reference pages, renders them through Fumadocs OpenAPI, registers their routes and metadata, and validates generated output, published routes, sitemap entries, and repository-content exclusions. ChangesPublic OpenAPI documentation
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant OpenAPIContract
participant GenerateOpenAPI
participant DocsRuntime
participant PublicRoute
participant PublicationAudit
OpenAPIContract->>GenerateOpenAPI: read and sanitize contract
GenerateOpenAPI->>DocsRuntime: write public schema and generated MDX
DocsRuntime->>PublicRoute: render API reference route
PublicationAudit->>PublicRoute: verify HTTP response and content
PublicationAudit->>DocsRuntime: verify sitemap and generated output
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 89-94: Add the patches/** pattern to the public_docs path filters
in the CI workflow so patch-only changes trigger public-docs validation, while
preserving the existing paths and job behavior.
In `@apps/docs/content/docs/developers/api-reference/administration.mdx`:
- Line 11: Correct the shared generator or authoritative metadata source for the
review date, then regenerate the outputs so they use the intended current date
instead of July 29, 2026. Update
apps/docs/content/docs/developers/api-reference/administration.mdx:11,
assets.mdx:11, assistant.mdx:10, knowledge-graph.mdx:11, platform.mdx:11,
search-catalog.mdx:10, and sources-connections.mdx:11; no direct manual edits
are needed beyond regeneration.
In `@apps/docs/content/docs/developers/api-reference/authentication.mdx`:
- Line 12: Replace the future lastReviewed metadata with the actual review date
in apps/docs/content/docs/developers/api-reference/authentication.mdx at lines
12-12 and apps/docs/content/docs/developers/api-reference/index.mdx at lines
10-10; both entries should use July 28, 2026 rather than July 29, 2026.
In `@apps/docs/scripts/check-build-output.mjs`:
- Around line 27-30: Update the file-audit loop around listFiles and
check-build-output so NUL-containing files are not skipped; decode each file and
run the forbidden-metadata checks against its text, or restrict skipping only to
an explicit allowlist of known binary extensions.
In `@apps/docs/scripts/generate-openapi.ts`:
- Around line 211-219: Update the generated page metadata returned by the
OpenAPI generation flow to ensure lastReviewed is not later than the current
date; change the future value in the metadata object near the description,
audience, status, and sourceRefs fields to the appropriate current or earlier
date so sitemap lastModified values are never future-dated.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 0026728d-5e74-469a-a43b-3006b41bf7e5
⛔ Files ignored due to path filters (4)
apps/docs/generated/openapi.public.jsonis excluded by!**/generated/**docs/increments/active/2026-07-28-public-docs-portal/plan.mdis excluded by!docs/**docs/increments/active/2026-07-28-public-docs-portal/verification.mdis excluded by!docs/**pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml,!**/pnpm-lock.yaml
📒 Files selected for processing (33)
.github/workflows/ci.ymlapps/docs/Dockerfileapps/docs/Dockerfile.dockerignoreapps/docs/content/docs/developers/api-reference/administration.mdxapps/docs/content/docs/developers/api-reference/assets.mdxapps/docs/content/docs/developers/api-reference/assistant.mdxapps/docs/content/docs/developers/api-reference/authentication.mdxapps/docs/content/docs/developers/api-reference/index.mdxapps/docs/content/docs/developers/api-reference/knowledge-graph.mdxapps/docs/content/docs/developers/api-reference/meta.jsonapps/docs/content/docs/developers/api-reference/platform.mdxapps/docs/content/docs/developers/api-reference/search-catalog.mdxapps/docs/content/docs/developers/api-reference/sources-connections.mdxapps/docs/content/docs/developers/meta.jsonapps/docs/generated-api.manifest.jsonapps/docs/package.jsonapps/docs/public-content.manifest.jsonapps/docs/scripts/check-build-output.mjsapps/docs/scripts/check-docs.mjsapps/docs/scripts/generate-openapi.tsapps/docs/src/app/docs/[[...slug]]/page.tsxapps/docs/src/app/global.cssapps/docs/src/app/layout.tsxapps/docs/src/app/robots.tsapps/docs/src/app/sitemap.tsapps/docs/src/components/mdx.tsxapps/docs/src/components/openapi-page.tsxapps/docs/src/lib/openapi.tsapps/docs/src/lib/source.tsapps/docs/test/e2e/navigation.spec.tspatches/@fumadocs__api-docs@0.2.1.patchpatches/fumadocs-openapi@11.2.2.patchpnpm-workspace.yaml
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: Deployment contracts
- GitHub Check: PostgreSQL GraphRAG
- GitHub Check: Public docs · Node 24
- GitHub Check: Web · Node 24
🧰 Additional context used
📓 Path-based instructions (6)
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
**/*: Always read the repository guidance and relevant sections ofARCHITECTURE.md; before changing a domain, read its specification, test-coverage document, and binding decision filenames.
Treat the repository as the engineering system of record; current repository and runtime evidence take precedence over chat or Northstar.
Readdocs/guidelines/agent-safety.mdbefore retrieval, AI, MCP, permission, upload, graph, or export work. Never commit secrets or customer data.
Files:
apps/docs/src/app/robots.tsapps/docs/Dockerfile.dockerignoreapps/docs/src/components/openapi-page.tsxapps/docs/src/app/docs/[[...slug]]/page.tsxpnpm-workspace.yamlapps/docs/content/docs/developers/meta.jsonapps/docs/Dockerfileapps/docs/generated-api.manifest.jsonapps/docs/content/docs/developers/api-reference/meta.jsonapps/docs/src/app/global.cssapps/docs/content/docs/developers/api-reference/index.mdxapps/docs/src/app/layout.tsxapps/docs/scripts/check-build-output.mjsapps/docs/src/lib/openapi.tsapps/docs/public-content.manifest.jsonpatches/@fumadocs__api-docs@0.2.1.patchapps/docs/content/docs/developers/api-reference/administration.mdxapps/docs/src/app/sitemap.tsapps/docs/src/components/mdx.tsxapps/docs/src/lib/source.tsapps/docs/content/docs/developers/api-reference/platform.mdxapps/docs/content/docs/developers/api-reference/assets.mdxapps/docs/content/docs/developers/api-reference/search-catalog.mdxapps/docs/content/docs/developers/api-reference/sources-connections.mdxapps/docs/content/docs/developers/api-reference/assistant.mdxapps/docs/scripts/check-docs.mjsapps/docs/test/e2e/navigation.spec.tsapps/docs/content/docs/developers/api-reference/knowledge-graph.mdxapps/docs/scripts/generate-openapi.tsapps/docs/package.jsonapps/docs/content/docs/developers/api-reference/authentication.mdxpatches/fumadocs-openapi@11.2.2.patch
**/*.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
**/*.{js,jsx,ts,tsx}: Frontend verification must include lint, typecheck, tests, production build, and browser verification when the flow matters.
Before using unfamiliar React, Vite, Tailwind, TypeScript, Next.js, or Fumadocs APIs, consult current official documentation, Context7, and the relevant project verification skill.
Files:
apps/docs/src/app/robots.tsapps/docs/src/components/openapi-page.tsxapps/docs/src/app/docs/[[...slug]]/page.tsxapps/docs/src/app/layout.tsxapps/docs/src/lib/openapi.tsapps/docs/src/app/sitemap.tsapps/docs/src/components/mdx.tsxapps/docs/src/lib/source.tsapps/docs/test/e2e/navigation.spec.tsapps/docs/scripts/generate-openapi.ts
apps/docs/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
Verify unfamiliar Next.js and Fumadocs APIs against current official documentation or the installed dependency types before using them.
Files:
apps/docs/src/app/robots.tsapps/docs/src/components/openapi-page.tsxapps/docs/src/app/docs/[[...slug]]/page.tsxapps/docs/src/app/layout.tsxapps/docs/src/lib/openapi.tsapps/docs/src/app/sitemap.tsapps/docs/src/components/mdx.tsxapps/docs/src/lib/source.tsapps/docs/test/e2e/navigation.spec.tsapps/docs/scripts/generate-openapi.ts
**/*.{java,gradle,gradle.kts,properties,yml,yaml}
📄 CodeRabbit inference engine (CLAUDE.md)
Before using unfamiliar Spring Boot 4, Spring Modulith 2, Spring AI 2, or Gradle APIs, consult current official documentation, Context7, and the relevant project verification skill.
Files:
pnpm-workspace.yaml
apps/docs/content/docs/**/*.{md,mdx}
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
apps/docs/content/docs/**/*.{md,mdx}: Public prose must live only inapps/docs/content/docs; internal engineering documents are source evidence and must not be used as publication input.
Every documentation page must be listed inpublic-content.manifest.jsonand include the required typed frontmatter.
sourceRefsis build-time traceability metadata and must never be rendered as user-facing content.
Draft documentation must remain excluded unlessDOCS_INCLUDE_DRAFTS=trueis set for a local or controlled preview.
Files:
apps/docs/content/docs/developers/api-reference/index.mdxapps/docs/content/docs/developers/api-reference/administration.mdxapps/docs/content/docs/developers/api-reference/platform.mdxapps/docs/content/docs/developers/api-reference/assets.mdxapps/docs/content/docs/developers/api-reference/search-catalog.mdxapps/docs/content/docs/developers/api-reference/sources-connections.mdxapps/docs/content/docs/developers/api-reference/assistant.mdxapps/docs/content/docs/developers/api-reference/knowledge-graph.mdxapps/docs/content/docs/developers/api-reference/authentication.mdx
.github/**/*.{yml,yaml}
⚙️ CodeRabbit configuration file
.github/**/*.{yml,yaml}: Require least-privilege permissions, explicit release tags for actions,
bounded job timeouts, concurrency cancellation, frozen lockfiles, and no
secrets in pull-request workflows. GitHub Actions are intentionally not
pinned to commit SHAs; Dependabot owns their scheduled version updates.
Files:
.github/workflows/ci.yml
🧠 Learnings (1)
📚 Learning: 2026-07-24T22:52:57.466Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 40
File: .github/workflows/ci.yml:126-126
Timestamp: 2026-07-24T22:52:57.466Z
Learning: In this repository’s GitHub Actions workflows, the `uses:` field may intentionally reference GitHub Actions by explicit release tags (not immutable commit SHAs) per the project’s OrgMemory policy. Do not flag tag-based `uses:` references as “unpinned” if they are release-tag-based (e.g., `owner/repovX.Y.Z`) and follow the repo’s Dependabot-owned scheduled updates approach.
Applied to files:
.github/workflows/ci.yml
🪛 ast-grep (0.45.0)
apps/docs/test/e2e/navigation.spec.ts
[warning] 6-6: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.resolve('public-content.manifest.json'), 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 9-9: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.resolve('generated-api.manifest.json'), 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
apps/docs/scripts/generate-openapi.ts
[warning] 188-188: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(filePath, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 194-194: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(contractPath, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 238-238: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(generatedManifestPath, 'utf8')
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 258-258: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(publicContractPath, publicContractText)
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 259-259: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(generatedManifestPath, manifestText)
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
[warning] 260-260: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.writeFileSync(path.join(contentRoot, file.path), ${file.content}\n)
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
(detect-non-literal-fs-filename-typescript)
🔇 Additional comments (23)
apps/docs/src/app/robots.ts (1)
1-12: LGTM!apps/docs/src/app/sitemap.ts (1)
1-20: LGTM!apps/docs/src/app/layout.tsx (1)
13-23: 🎯 Functional CorrectnessNo change needed.
The docs app already defines
metadataBase, and the docs pages overridealternates.canonicalandopenGraph.urlwith route-specific values.apps/docs/src/lib/source.ts (1)
6-6: LGTM!Also applies to: 16-16
apps/docs/content/docs/developers/api-reference/authentication.mdx (1)
1-11: LGTM!Also applies to: 13-49
apps/docs/content/docs/developers/api-reference/index.mdx (1)
1-9: LGTM!Also applies to: 11-39
apps/docs/content/docs/developers/api-reference/meta.json (1)
1-16: LGTM!apps/docs/content/docs/developers/meta.json (1)
6-7: LGTM!apps/docs/src/app/global.css (1)
4-4: LGTM!Also applies to: 21-26
apps/docs/generated-api.manifest.json (1)
1-61: LGTM!apps/docs/public-content.manifest.json (1)
68-83: LGTM!apps/docs/scripts/check-docs.mjs (1)
11-11: LGTM!Also applies to: 55-73, 265-276
apps/docs/src/components/openapi-page.tsx (1)
1-9: LGTM!apps/docs/src/components/mdx.tsx (1)
11-11: LGTM!Also applies to: 20-20
apps/docs/src/app/docs/[[...slug]]/page.tsx (2)
16-17: LGTM!Also applies to: 56-61
84-91: 🎯 Functional CorrectnessURL metadata already has a base URL.
apps/docs/content/docs/developers/api-reference/administration.mdx (1)
1-10: LGTM!Also applies to: 12-112
apps/docs/content/docs/developers/api-reference/assets.mdx (1)
1-10: LGTM!Also applies to: 12-229
apps/docs/content/docs/developers/api-reference/assistant.mdx (1)
1-9: LGTM!Also applies to: 11-115
apps/docs/content/docs/developers/api-reference/knowledge-graph.mdx (1)
1-10: LGTM!Also applies to: 12-68
apps/docs/content/docs/developers/api-reference/platform.mdx (1)
1-10: LGTM!Also applies to: 12-68
apps/docs/content/docs/developers/api-reference/search-catalog.mdx (1)
1-9: LGTM!Also applies to: 11-47
apps/docs/content/docs/developers/api-reference/sources-connections.mdx (1)
1-10: LGTM!Also applies to: 12-158
1 participant
Summary
Verification
Summary by CodeRabbit
New Features
Bug Fixes