feat(skills): import governed Skills from GitHub - #197
Conversation
# Conflicts: # contracts/openapi.json
|
Warning Review limit reached
Next review available in: 6 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (6)
📒 Files selected for processing (16)
📝 WalkthroughWalkthroughAdds governed Skill import from public or approved private GitHub repositories. The change includes bounded archive processing, commit-pinned provenance, API endpoints, an authenticated import page, private-import configuration, tests, and documentation. ChangesGitHub Skill import
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 2📝 Generate docstrings 💡
🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
TegamiThis repository uses Tegami to manage releases. When your changes affect published packages, add a changelog file under Create a changelog → · Changelog format Release preview
Changelogs in this PR
Run Managed by Tegami. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 16
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
core/src/main/java/com/orgmemory/core/assetregistry/SkillPackageProfile.java (1)
11-22: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winDocument or add the missing Skill schema migration.
Skill new releases write
"2"throughSkillRegistryService.draft(), andSkillPackageProfilenow accepts both"1"and"2"by reading the existing Jackson model. Jackson accepts missing payload fields, so existingorigin-less v1 payloads parse withoriginasnull. Add or reference the migration needed forSkillPackageSpec.originbefore storing v2 payloads withddl-auto=validate.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@core/src/main/java/com/orgmemory/core/assetregistry/SkillPackageProfile.java` around lines 11 - 22, The Skill schema version is advanced to "2" without a migration for the new SkillPackageSpec.origin field. Update the migration configuration or migration implementation used by SkillRegistryService.draft() and SkillPackageProfile so v1 payloads receive the appropriate origin value before v2 storage, while preserving parsing of existing origin-less payloads and compatibility with ddl-auto=validate.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java`:
- Around line 120-130: Handle null or blank revision consistently before
GitHubSkillSourceAdapter.fetch() invokes commitUri: update
GitHubSkillSourceRequest.source() and the corresponding preview/import flow to
either reject omitted values or default them to the supported reference, such as
"main". Apply the same behavior to both request paths, including the code around
the second SourceRequest construction, while preserving explicit nonblank
revisions.
In
`@core/src/main/java/com/orgmemory/core/assetregistry/SkillGitHubImportService.java`:
- Around line 62-67: Update both RuntimeException catch blocks in
SkillGitHubImportService to emit a warn-level log before constructing the
invalid PreviewItem. Include the repository, revision, path, and caught
exception in the log, then preserve the existing failure-item behavior.
- Around line 37-44: Add the Skill-creation authorization check to the GitHub
read paths in SkillGitHubImportService: call assets.requireSkillCreate(actor,
request.knowledgeSpaceId()) in preview before source.fetch, and apply the
equivalent check in availableConnections using the relevant knowledge-space
identifier before source.availableConnections. Preserve the existing actor
validation and importSelected authorization behavior.
In `@core/src/main/java/com/orgmemory/core/assetregistry/SkillPackageSpec.java`:
- Line 16: Update SkillPackageProfile persistence handling for schema versions 1
and 2 to preserve compatibility with drafts and imports that omit origin or
store it as null. Add the appropriate schema-version boundary, normalize legacy
origin values to the required default (or explicitly permit null during legacy
reads), and align schema validation with this compatibility behavior while
keeping current non-nullable SkillPackageSpec handling for newer profiles.
In
`@core/src/main/java/com/orgmemory/core/knowledge/connector/SourceConnectionAdminService.java`:
- Around line 172-195: Extract the duplicated ConnectorConnectionConfiguration
construction from configuration and configurations into a single private mapping
method in SourceConnectionAdminService. Have both methods delegate to that
helper while preserving the existing Optional and list behavior, so future
view-component changes are centralized.
In
`@core/src/test/java/com/orgmemory/core/assetregistry/SkillGitHubImportServiceTests.java`:
- Around line 69-124: Add three focused tests for importSelected covering the
invalid revision guard returning skill.github-revision-invalid, a fetched commit
differing from the requested revision returning skill.github-revision-mismatch,
and a selected path absent from the fetched package returning
skill.github-path-not-found. Reuse the existing SkillGitHubImportService test
setup and assert each guarded result without invoking skills.importPackage for
rejected selections.
In
`@integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillArchiveReader.java`:
- Around line 45-49: Centralize the shared Skill limit in the core contract,
preferably as a constant on SkillGitHubSourcePort, and remove the duplicate
MAX_SKILLS declarations from GitHubSkillArchiveReader and
SkillGitHubImportService. Update both the manifest validation and selection
guard to reference the contract constant while preserving their existing
validation messages.
- Around line 120-130: Update the selectedPath calculation in the
archive-reading method so when subpath exactly equals the file path, it uses
that path directly instead of applying substring(subpath.length() + 1). Preserve
the existing relative-path behavior for nested entries, allowing file subpaths
to produce the file’s own path and letting the existing SKILL.md validation
handle the result.
In
`@integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillImportSettings.java`:
- Around line 52-54: Make private-repository access fail closed when no
repositories are explicitly approved: update GitHubSkillImportSettings.from to
reject allowPrivateSkillImports=true without repositoryIds, and ensure
allowsRepository does not treat an empty repositoryIds set as permitting every
repository. Preserve access for explicitly listed repository IDs.
In
`@integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapter.java`:
- Around line 220-222: Update the redirect handling around requireCodeload and
its callers so a missing Location header is converted into the existing
skill.github-redirect-invalid business error rather than reaching
Objects.requireNonNull and throwing NullPointerException. In requireCodeload,
preserve the original invalid parsing/cause exception when constructing or
propagating the business error, satisfying PreserveStackTrace while keeping
valid redirect processing unchanged.
- Around line 187-193: Update the repository access check in
GitHubSkillSourceAdapter to reject an empty or missing repositoryId before
calling settings.allowsRepository. Preserve the existing
BusinessNotFoundException and selected-repository validation for non-empty
identifiers, ensuring absent id metadata cannot grant access when repositoryIds
is empty or unset.
- Around line 100-104: Update the branch around
GitHubSkillSourceAdapter.isPrivateCandidate and privateAccess so anonymous
rate-limited responses are treated as unavailable. Inspect
publicRepository.headers for X-RateLimit-Remaining: 0, including rate-limit
statuses such as 403 or 429, and throw sourceFailure instead of resolving
credentials or recording private-repository credential usage. Preserve
privateAccess for genuine 403/404 private-repository responses that are not
rate-limited.
- Around line 252-275: The RestClient instances created by noRedirect lack
connection and read timeouts, allowing fetch operations to block indefinitely.
Configure both connectTimeout and readTimeout on the JdkClientHttpRequestFactory
used by noRedirect, while preserving exchange’s ResourceAccessException mapping
to skill.github-unreachable.
- Around line 166-193: Move the ALLOW credential-use audit in the GitHub adapter
to after the settings.allowsRepository(repositoryId) check, so unselected
repositories cannot produce an ALLOW record while preserving the existing
token-minting flow. Extract the repeated audit construction into
recordCredentialUse, then add coverage in GitHubSkillSourceAdapterTests
confirming denied repositories produce no ALLOW audit.
In
`@integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillArchiveReaderTests.java`:
- Around line 53-63: Add coverage in GitHubSkillArchiveReaderTests for the
reader limit branches: verify an archive without SKILL.md throws
BusinessValidationException with code skill.github-no-skills; verify an archive
containing more than 20 manifests throws with code skill.github-too-many-skills;
and verify a Skill whose files exceed 20 MiB returns a FetchedPackage with a
null archive and code skill.github-package-too-large.
In
`@integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapterTests.java`:
- Around line 85-146: Add refusal-path tests alongside
auditsPrivateCredentialUseAndStripsAuthorizationFromCodeload using
MockRestServiceServer: cover a redirect Location outside codeload.github.com, a
3xx response without Location, an archive exceeding MAX_ARCHIVE_BYTES, and a
connection configuration with allowPrivateSkillImports=false. Invoke
GitHubSkillSourceAdapter for each case and assert the corresponding errors
skill.github-redirect-invalid, skill.github-archive-too-large, or
skill.github-private-import-disabled.
---
Outside diff comments:
In
`@core/src/main/java/com/orgmemory/core/assetregistry/SkillPackageProfile.java`:
- Around line 11-22: The Skill schema version is advanced to "2" without a
migration for the new SkillPackageSpec.origin field. Update the migration
configuration or migration implementation used by SkillRegistryService.draft()
and SkillPackageProfile so v1 payloads receive the appropriate origin value
before v2 storage, while preserving parsing of existing origin-less payloads and
compatibility with ddl-auto=validate.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 1f1877b9-9770-49e9-aca7-23cac5df493a
⛔ Files ignored due to path filters (7)
apps/docs/generated/openapi.public.jsonis excluded by!**/generated/**apps/docs/public/images/product-guides/skill-github-import.pngis excluded by!**/*.pngcontracts/openapi.jsonis excluded by!contracts/openapi.jsondocs/increments/active/2026-08-01-browser-skill-authoring/design-qa.mdis excluded by!docs/**docs/increments/active/2026-08-01-browser-skill-authoring/plan.mdis excluded by!docs/**docs/specs/domains/asset-registry.mdis excluded by!docs/**docs/tests/domains/asset-registry.mdis excluded by!docs/**
📒 Files selected for processing (33)
apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.javaapps/docs/content/docs/product-guides/create-governed-skills.mdxapps/docs/content/docs/product-guides/create-governed-skills.vi.mdxapps/docs/content/docs/product-guides/meta.jsonapps/docs/content/docs/product-guides/meta.vi.jsonapps/docs/content/docs/reference/api-reference/assets.mdxapps/docs/public-content.manifest.jsonapps/web/src/components/ui/checkbox.tsxapps/web/src/features/admin/connector-forms.tsapps/web/src/features/admin/connector-github.test.tsapps/web/src/features/assets/components/skill-creation-page.tsxapps/web/src/features/assets/components/skill-github-import-page.tsxapps/web/src/routeTree.gen.tsapps/web/src/routes/_authenticated/assets/new.skill.github.tsxapps/web/test/e2e/asset-registry-golden-poc.spec.tscore/src/main/java/com/orgmemory/core/assetregistry/SkillGitHubImportService.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillGitHubSourcePort.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillPackageProfile.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillPackageSpec.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillRegistryService.javacore/src/main/java/com/orgmemory/core/knowledge/connector/ConnectorConnectionConfiguration.javacore/src/main/java/com/orgmemory/core/knowledge/connector/ConnectorConnectionDirectory.javacore/src/main/java/com/orgmemory/core/knowledge/connector/SourceConnectionAdminService.javacore/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.javacore/src/test/java/com/orgmemory/core/assetregistry/SkillGitHubImportServiceTests.javaintegrations/connectors/build.gradle.ktsintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfiguration.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillArchiveReader.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillImportSettings.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapter.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfigurationTests.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillArchiveReaderTests.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapterTests.java
📜 Review details
⏰ Context from checks skipped due to timeout. (3)
- GitHub Check: Backend · Java 25
- GitHub Check: Web · Node 24
- GitHub Check: Public docs · Node 24
🧰 Additional context used
📓 Path-based instructions (13)
apps/docs/content/docs/**/meta{,.vi}.json
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
Keep root-folder names and descriptions aligned between
meta.jsonandmeta.vi.json; these files define the sidebar documentation switcher.
Files:
apps/docs/content/docs/product-guides/meta.vi.jsonapps/docs/content/docs/product-guides/meta.json
**/*
📄 CodeRabbit inference engine (AGENTS.md)
**/*: Treat the repository and runtime evidence as the engineering system of record; do not treat chat or Northstar as authoritative.
Before changing a domain, read its specification, test-coverage document, and applicable decision filenames.
Material decisions about domain boundaries, authorization, persistence, publication, concurrency, cache isolation, parity scope, or deployment require an independent architecture challenge and documented alternatives before implementation.
Do not use completed increment documents as the source for current behavior; use them only for history or archaeology.
Before using unfamiliar Spring Boot, Spring Modulith, Spring AI, Gradle, React, Vite, Tailwind, TypeScript, Next.js, or Fumadocs APIs, consult current official documentation, Context7, and the relevant verification skill.
Readdocs/guidelines/agent-safety.mdbefore retrieval, AI, MCP, permission, upload, graph, or export work; never commit secrets or customer data.
Keepddl-auto=validateand pair every persisted-model change with a Flyway migration.
Use the testing harness; a terminating clean test is the JVM context gate, andbootRunis not verification.
Files:
apps/docs/content/docs/product-guides/meta.vi.jsonintegrations/connectors/build.gradle.ktsapps/web/src/components/ui/checkbox.tsxapps/docs/public-content.manifest.jsoncore/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.javaapps/docs/content/docs/product-guides/meta.jsonapps/web/src/routes/_authenticated/assets/new.skill.github.tsxcore/src/main/java/com/orgmemory/core/knowledge/connector/ConnectorConnectionConfiguration.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillPackageProfile.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillImportSettings.javacore/src/main/java/com/orgmemory/core/knowledge/connector/SourceConnectionAdminService.javaapps/docs/content/docs/reference/api-reference/assets.mdxintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillArchiveReader.javaapps/web/src/features/admin/connector-forms.tsapps/web/src/features/assets/components/skill-creation-page.tsxapps/web/src/routeTree.gen.tsapps/web/src/features/admin/connector-github.test.tscore/src/main/java/com/orgmemory/core/assetregistry/SkillRegistryService.javacore/src/main/java/com/orgmemory/core/knowledge/connector/ConnectorConnectionDirectory.javaapps/docs/content/docs/product-guides/create-governed-skills.mdxcore/src/main/java/com/orgmemory/core/assetregistry/SkillPackageSpec.javacore/src/test/java/com/orgmemory/core/assetregistry/SkillGitHubImportServiceTests.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillGitHubSourcePort.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfigurationTests.javaapps/web/test/e2e/asset-registry-golden-poc.spec.tsintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfiguration.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapterTests.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillGitHubImportService.javaapps/web/src/features/assets/components/skill-github-import-page.tsxintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillArchiveReaderTests.javaapps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.javaapps/docs/content/docs/product-guides/create-governed-skills.vi.mdxintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapter.java
apps/web/**/*.{ts,tsx}
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
apps/web/**/*.{ts,tsx}: Extend the established OrgMemory product shell, design tokens, shadcn/Radix primitives, and existing layout patterns; do not introduce a separate visual system in the web application.
Generate ordinary REST clients fromcontracts/openapi.jsonusing Hey API.
Use TanStack Query for server state, TanStack Router for navigation, and limit Zustand to durable or high-frequency UI state.
Preserve keyboard accessibility, light/dark theme support, loading and error states, and responsive behavior in the web application.
Files:
apps/web/src/components/ui/checkbox.tsxapps/web/src/routes/_authenticated/assets/new.skill.github.tsxapps/web/src/features/admin/connector-forms.tsapps/web/src/features/assets/components/skill-creation-page.tsxapps/web/src/routeTree.gen.tsapps/web/src/features/admin/connector-github.test.tsapps/web/test/e2e/asset-registry-golden-poc.spec.tsapps/web/src/features/assets/components/skill-github-import-page.tsx
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Frontend changes must pass lint, typecheck, tests, and a production build; perform browser verification when the flow warrants it.
Files:
apps/web/src/components/ui/checkbox.tsxapps/web/src/routes/_authenticated/assets/new.skill.github.tsxapps/web/src/features/admin/connector-forms.tsapps/web/src/features/assets/components/skill-creation-page.tsxapps/web/src/routeTree.gen.tsapps/web/src/features/admin/connector-github.test.tsapps/web/test/e2e/asset-registry-golden-poc.spec.tsapps/web/src/features/assets/components/skill-github-import-page.tsx
apps/web/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
apps/web/src/**/*.{ts,tsx}: OAuth access and refresh tokens must never enter browser JavaScript or
browser storage. Use the HttpOnly BFF session, CSRF-protected mutations,
generated Hey API data clients, accessible states, and both light and
dark themes. Handwritten transport is reserved for documented protocol
flows such as navigation redirects and streaming.
Files:
apps/web/src/components/ui/checkbox.tsxapps/web/src/routes/_authenticated/assets/new.skill.github.tsxapps/web/src/features/admin/connector-forms.tsapps/web/src/features/assets/components/skill-creation-page.tsxapps/web/src/routeTree.gen.tsapps/web/src/features/admin/connector-github.test.tsapps/web/src/features/assets/components/skill-github-import-page.tsx
apps/docs/public-content.manifest.json
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
Every documentation page must be listed in
public-content.manifest.jsonand carry the required typed frontmatter.
Files:
apps/docs/public-content.manifest.json
**/*.java
📄 CodeRabbit inference engine (AGENTS.md)
Apply IDE inspection only to edited backend Java files.
Files:
core/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.javacore/src/main/java/com/orgmemory/core/knowledge/connector/ConnectorConnectionConfiguration.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillPackageProfile.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillImportSettings.javacore/src/main/java/com/orgmemory/core/knowledge/connector/SourceConnectionAdminService.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillArchiveReader.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillRegistryService.javacore/src/main/java/com/orgmemory/core/knowledge/connector/ConnectorConnectionDirectory.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillPackageSpec.javacore/src/test/java/com/orgmemory/core/assetregistry/SkillGitHubImportServiceTests.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillGitHubSourcePort.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfigurationTests.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfiguration.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapterTests.javacore/src/main/java/com/orgmemory/core/assetregistry/SkillGitHubImportService.javaintegrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillArchiveReaderTests.javaapps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.javaintegrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapter.java
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java
⚙️ CodeRabbit configuration file
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java: Treat PostgreSQL ACL evidence as canonical and OpenFGA as the relationship
authorization decision point. Authorization must fail closed. Filtering
must happen before ranking, LIMIT, graph traversal, answer generation,
export, and citation rendering. Flag metadata or timing leak paths.
Files:
core/src/main/java/com/orgmemory/core/knowledge/connector/ConnectorConnectionConfiguration.javacore/src/main/java/com/orgmemory/core/knowledge/connector/SourceConnectionAdminService.javacore/src/main/java/com/orgmemory/core/knowledge/connector/ConnectorConnectionDirectory.java
apps/docs/content/docs/**/*.{md,mdx}
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
apps/docs/content/docs/**/*.{md,mdx}: Public prose must live only inapps/docs/content/docs; internal engineering documents are source evidence, not publication input.
sourceRefsis build-time traceability metadata and must never be rendered in published content.
Draft pages must remain excluded unlessDOCS_INCLUDE_DRAFTS=trueis set for a local or controlled preview.
Files:
apps/docs/content/docs/reference/api-reference/assets.mdxapps/docs/content/docs/product-guides/create-governed-skills.mdxapps/docs/content/docs/product-guides/create-governed-skills.vi.mdx
apps/docs/content/docs/**/*.mdx
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
Use
index.mdxfor a section root and<slug>.mdxfor a named English page; add Vietnamese pages individually as adjacentindex.vi.mdxor<slug>.vi.mdxfiles, using the/vi/docs/...route.
Files:
apps/docs/content/docs/reference/api-reference/assets.mdxapps/docs/content/docs/product-guides/create-governed-skills.mdxapps/docs/content/docs/product-guides/create-governed-skills.vi.mdx
apps/web/**/*.{test,spec}.{ts,tsx}
📄 CodeRabbit inference engine (apps/web/CLAUDE.md)
Preserve the existing browser test suite when changing the web application.
Files:
apps/web/src/features/admin/connector-github.test.tsapps/web/test/e2e/asset-registry-golden-poc.spec.ts
apps/api/src/main/java/**/*.java
⚙️ CodeRabbit configuration file
apps/api/src/main/java/**/*.java: Enforce the browser-BFF and resource-server boundaries. Authentication
must resolve an active internal actor through the explicit issuer and
subject binding. Reject identity, tenant, roles, or permissions supplied
by request payloads, JWT email, or untrusted JWT role claims.
Files:
apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java
apps/docs/content/docs/**/*.vi.mdx
📄 CodeRabbit inference engine (apps/docs/CLAUDE.md)
Vietnamese routes must visibly fall back to the reviewed English page until the matching
.vi.mdxexists; a fallback route is not a completed translation.
Files:
apps/docs/content/docs/product-guides/create-governed-skills.vi.mdx
🧠 Learnings (4)
📚 Learning: 2026-07-28T20:06:14.930Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 112
File: apps/docs/content/docs/developers/api-reference/administration.mdx:11-11
Timestamp: 2026-07-28T20:06:14.930Z
Learning: In OrgMemory public documentation MDX files, ensure any `lastReviewed` dates are set using the repository project timezone `Asia/Bangkok`, not the reviewer’s local timezone or the runtime/build timezone. When generating or updating API-reference pages, intentionally use the exact same `lastReviewed` date convention as the authored public documentation pages to keep timestamps consistent across both sources.
Applied to files:
apps/docs/content/docs/reference/api-reference/assets.mdxapps/docs/content/docs/product-guides/create-governed-skills.mdxapps/docs/content/docs/product-guides/create-governed-skills.vi.mdx
📚 Learning: 2026-07-28T20:06:15.064Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 112
File: apps/docs/content/docs/developers/api-reference/authentication.mdx:12-12
Timestamp: 2026-07-28T20:06:15.064Z
Learning: In OrgMemory docs/tests that describe date-based review checks, treat the project timezone as Asia/Bangkok for all “date” comparisons/validations. Do not assume UTC when interpreting or validating fields like `lastReviewed`. For example, `lastReviewed: '2026-07-29'` should be considered valid when the effective “current date” in Asia/Bangkok is July 29, 2026 (not merely when the UTC date matches).
Applied to files:
apps/docs/content/docs/reference/api-reference/assets.mdxapps/docs/content/docs/product-guides/create-governed-skills.mdxapps/docs/content/docs/product-guides/create-governed-skills.vi.mdx
📚 Learning: 2026-07-30T06:46:08.031Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 144
File: apps/docs/public-content.manifest.json:13-67
Timestamp: 2026-07-30T06:46:08.031Z
Learning: For the Fumadocs docs portal under apps/docs, follow the expected MDX filename conventions that drive section-root vs named-page routing. Use `index.mdx` for English section-root pages and `<slug>.mdx` for named pages. For Vietnamese, use adjacent locale-suffixed files: `index.vi.mdx` for section roots and `<slug>.vi.mdx` for named pages. Do not require or enforce a `page.mdx` filename; doing so would change/break the intended section-root route structure.
Applied to files:
apps/docs/content/docs/reference/api-reference/assets.mdxapps/docs/content/docs/product-guides/create-governed-skills.mdxapps/docs/content/docs/product-guides/create-governed-skills.vi.mdx
📚 Learning: 2026-07-26T05:46:47.443Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 61
File: apps/mcp/src/main/java/com/orgmemory/mcp/McpSecurityConfiguration.java:50-52
Timestamp: 2026-07-26T05:46:47.443Z
Learning: In OrgMemory, treat the `apps/mcp` and `apps/api` as independent protocol adapter modules. When adjusting OAuth/wire-level scopes, do not introduce a shared Java constant or create a code dependency from `apps/mcp` to `apps/api` solely to deduplicate scope values. Instead, keep OAuth/scope constants adapter-local (e.g., in the relevant adapter/security configuration classes) and ensure cross-adapter consistency via automated realm/OAuth/authorization tests, rather than via shared wiring-level constants or cross-module references.
Applied to files:
apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java
🪛 ast-grep (0.45.0)
integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapterTests.java
[warning] 62-62: Avoid building a URL host from untrusted input
Context: "https://codeload.github.com/acme/skills/tar.gz/" + SHA
Note: [CWE-20] Improper Input Validation.
(tainted-url-host)
[warning] 103-103: Avoid building a URL host from untrusted input
Context: "https://api.github.com/repos/acme/skills/commits/" + SHA
Note: [CWE-20] Improper Input Validation.
(tainted-url-host)
[warning] 106-106: Avoid building a URL host from untrusted input
Context: "https://api.github.com/repos/acme/skills/tarball/" + SHA
Note: [CWE-20] Improper Input Validation.
(tainted-url-host)
[warning] 110-110: Avoid building a URL host from untrusted input
Context: "https://codeload.github.com/acme/skills/legacy.tar.gz/" + SHA
Note: [CWE-20] Improper Input Validation.
(tainted-url-host)
[warning] 159-165: Use a randomly-generated IV
Context: byte[] manifest = """
---
name: triage
description: Triage support requests.
---
# Triage
""".getBytes(StandardCharsets.UTF_8);
Note: [CWE-329] Generation of Predictable IV with CBC Mode.
(random-iv)
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapter.java
[error] 254-267: Potential Server-Side Request Forgery (SSRF): an HTTP client request (RestTemplate, WebClient, java.net.http.HttpClient, or URI.create) is built directly from request-controlled input such as getParameter/getHeader/ getQueryString. An attacker can redirect the outbound request to internal services or cloud metadata endpoints. Validate the URL against an allowlist of permitted hosts and schemes before issuing the request.
Context: client.get()
.uri(uri)
.headers(headers -> {
headers.set(HttpHeaders.ACCEPT, "application/vnd.github+json");
headers.set("X-GitHub-Api-Version", GitHubInstallationTokenSource.API_VERSION);
if (!token.isBlank()) {
headers.setBearerAuth(token);
}
})
.exchange((request, response) -> new ApiResponse(
response.getStatusCode(),
response.getHeaders(),
readBounded(response.getBody(), maximumBytes)),
false)
Note: [CWE-918] Server-Side Request Forgery (SSRF).
(ssrf-http-client-tainted-url-java)
🪛 LanguageTool
apps/docs/content/docs/reference/api-reference/assets.mdx
[uncategorized] ~261-~261: The official name of this software platform is spelled with a capital “H”.
Context: ...od":"post"},{"path":"/api/assets/skills/github/preview","method":"post"},{"path":"/api...
(GITHUB)
[uncategorized] ~261-~261: The official name of this software platform is spelled with a capital “H”.
Context: ...od":"post"},{"path":"/api/assets/skills/github/import","method":"post"},{"path":"/api/...
(GITHUB)
[uncategorized] ~261-~261: The official name of this software platform is spelled with a capital “H”.
Context: ...hod":"get"},{"path":"/api/assets/skills/github/connections","method":"get"},{"path":"/...
(GITHUB)
🪛 PMD (7.26.0)
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapter.java
[Medium] 328-330: PreserveStackTrace (Best Practices): Thrown exception does not preserve the stack trace of exception 'invalid' on all code paths
(PreserveStackTrace (Best Practices))
🔇 Additional comments (32)
apps/docs/content/docs/product-guides/create-governed-skills.mdx (2)
17-104: LGTM!
1-15: 🗄️ Data Integrity & Integration | ⚡ Quick winQuote
lastReviewedas a string in both new pages. Both new pages setlastReviewed: 2026-08-01without quotes, while the existing generated pageapps/docs/content/docs/reference/api-reference/assets.mdxuses a quoted string,lastReviewed: '2026-07-29'. An unquoted YAML date literal parses as aDateobject, not a string, which breaks type consistency with the established convention and can fail JSON serialization if the frontmatter is passed through a build step that expects a string.
apps/docs/content/docs/product-guides/create-governed-skills.mdx#L1-L15: change line 14 tolastReviewed: '2026-08-01'.apps/docs/content/docs/product-guides/create-governed-skills.vi.mdx#L1-L15: change line 14 tolastReviewed: '2026-08-01'.Based on learnings, "intentionally use the exact same
lastRevieweddate convention as the authored public documentation pages to keep timestamps consistent across both sources."Source: Learnings
apps/docs/content/docs/product-guides/create-governed-skills.vi.mdx (1)
17-101: LGTM!apps/docs/content/docs/product-guides/meta.json (1)
7-10: LGTM!apps/docs/content/docs/product-guides/meta.vi.json (1)
7-10: LGTM!apps/docs/public-content.manifest.json (1)
100-115: LGTM!apps/docs/content/docs/reference/api-reference/assets.mdx (1)
88-93: LGTM!Also applies to: 118-120, 204-207, 225-226, 261-261
apps/api/src/main/java/com/orgmemory/api/assetregistry/AssetRegistryController.java (1)
16-23: LGTM!Also applies to: 58-70, 132-139, 223-250
apps/web/src/components/ui/checkbox.tsx (1)
1-29: LGTM!apps/web/src/features/admin/connector-forms.ts (1)
123-130: LGTM!apps/web/src/features/admin/connector-github.test.ts (1)
30-36: LGTM!apps/web/src/features/assets/components/skill-creation-page.tsx (1)
38-40: LGTM!apps/web/src/features/assets/components/skill-github-import-page.tsx (1)
1-414: LGTM!apps/web/src/routes/_authenticated/assets/new.skill.github.tsx (1)
1-8: LGTM!apps/web/src/routeTree.gen.ts (1)
39-39: LGTM!Also applies to: 186-191, 231-231, 260-260, 293-293, 326-326, 355-355, 387-387, 590-596, 615-624
apps/web/test/e2e/asset-registry-golden-poc.spec.ts (1)
293-296: LGTM!Also applies to: 449-509, 524-525, 575-631, 729-730
core/src/main/java/com/orgmemory/core/assetregistry/SkillGitHubSourcePort.java (1)
22-38: LGTM!Also applies to: 40-52, 54-79
core/src/main/java/com/orgmemory/core/knowledge/connector/ConnectorConnectionConfiguration.java (1)
4-13: LGTM!core/src/main/java/com/orgmemory/core/knowledge/connector/ConnectorConnectionDirectory.java (1)
40-46: LGTM!core/src/test/java/com/orgmemory/core/assetregistry/SkillDistributionServiceTests.java (1)
190-190: LGTM!integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapter.java (1)
81-99: LGTM!Also applies to: 201-208, 345-362, 364-372, 408-439
integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillSourceAdapterTests.java (1)
53-83: LGTM!Also applies to: 148-177
integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubSkillArchiveReaderTests.java (1)
21-51: LGTM!Also applies to: 65-98
core/src/main/java/com/orgmemory/core/assetregistry/SkillPackageSpec.java (1)
55-82: LGTM!core/src/main/java/com/orgmemory/core/assetregistry/SkillRegistryService.java (1)
65-82: LGTM!Also applies to: 101-101, 154-154, 177-192
core/src/main/java/com/orgmemory/core/assetregistry/SkillGitHubImportService.java (1)
73-103: LGTM!core/src/test/java/com/orgmemory/core/assetregistry/SkillGitHubImportServiceTests.java (1)
33-67: LGTM!integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillArchiveReader.java (1)
101-119: LGTM!Also applies to: 143-161, 172-190, 208-233
integrations/connectors/src/test/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfigurationTests.java (1)
8-15: LGTM!Also applies to: 52-52, 82-86
integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubConnectorAutoConfiguration.java (1)
42-48: 🗄️ Data Integrity & IntegrationNo change needed for
GitHubSkillSourceAdapterconstructors.The bean uses the existing three-argument constructor, and it delegates to the full seven-argument test constructor with default
ObjectMapperandClock.systemUTC()values.integrations/connectors/build.gradle.kts (1)
15-15: 🔒 Security & PrivacyNo change needed.
libs.commons.compressresolves to Commons Compress 1.28.0, which meets the release and API requirements for these usages.integrations/connectors/src/main/java/com/orgmemory/connectors/github/GitHubSkillImportSettings.java (1)
40-49: 🗄️ Data Integrity & IntegrationNo change needed. This Jackson 3 coercion behavior does not introduce a valid configuration rejection or malformed configuration acceptance path.
# Conflicts: # core/src/main/java/com/orgmemory/core/knowledge/connector/SourceConnectionAdminService.java
|
Review follow-up for the outside-diff schema note: no Flyway migration is required. Skill package metadata is serialized JSON in the existing Asset payload column, not a new relational column. The optional origin is intentionally absent/null for Scratch and Upload Drafts and populated only by GitHub import. Commit fd8b11c adds compatibility coverage for both the legacy schema-1 missing field and schema-2 null field. The same commit also quotes both authored docs lastReviewed values to keep frontmatter types consistent. |
1 participant
Summary
Security boundaries
Verification
./gradlew.bat --no-daemon clean test:core:test :integrations:connectors:test :apps:api:test --tests '*OpenApiContractTests*'pnpm check:webpnpm release:checkpnpm --filter @orgmemory/docs checkand production buildSummary by CodeRabbit
New Features
Documentation