CI and doc hardening: release lint, source-wide deprecated-API scan, VirusTotal links, brace-expansion floors, doc drift - #38
Conversation
…VirusTotal links, brace-expansion floors, doc drift Repo and CI gaps from the handoff, none blocking but all real. - release.yml: run npm run lint before build. CI lints every PR, but a tag can be pushed at a commit CI never covered, so the release could cut an unlinted build. Runs before build because check-submission scans sources. - release.yml: give the VirusTotal step an id and fold its analysis URLs into the release notes. The scan ran before the release was created and its links were only in the workflow log; they now land on the release itself. Passed via env, guarded on a non-empty CHANGELOG-derived notes file. - ci.yml: the deprecated-API scan now covers every source .ts, not the main.ts entry point alone, so a deprecated call in any other module is caught. Sources rather than the minified bundle, which rewrites getLeaf(true) to getLeaf(!0). - package.json: raise the brace-expansion override floors to 1.1.18 / 2.1.4, the versions patched for GHSA-rgw5-rvv9-x895. The old floors (1.1.13 / 2.0.3) sat below the patch, so the override permitted a vulnerable resolution even though the current tree is already patched. - README.md: document Clear orphaned stars and the once-per-note broken-marker warning, both shipped but absent from the feature list. - copilot-instructions.md: the marker format escapes the opener as well as the terminator, and check-submission also rejects regex lookbehind. Both landed in #30/#31 and the instructions still described the old behavior.
|
Warning Review limit reached
Next review available in: 50 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe PR updates marker-format and diagnostics documentation, pins CI and release actions, broadens deprecated API scanning, adds release linting and VirusTotal links, and raises ChangesMarker Guidance and Diagnostics
CI and Release Automation
Dependency Override Maintenance
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow
participant VirusTotal
participant ReleaseNotes
ReleaseWorkflow->>VirusTotal: Upload artifacts and receive analysis output
ReleaseWorkflow->>ReleaseNotes: Read extracted release notes
ReleaseWorkflow->>ReleaseNotes: Append VirusTotal links when notes contain non-whitespace content
Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Hardens the repo’s CI/release pipeline and documentation to close gaps called out in the handoff: ensuring releases run the same lint gates as PR CI, expanding the deprecated-Obsidian-API scan to all TypeScript sources, surfacing VirusTotal analysis links in release notes, tightening the brace-expansion override floors, and updating docs to reflect recent marker-format and lint-policy behavior.
Changes:
- Add
npm run lintto the release workflow and append VirusTotal analysis URLs into CHANGELOG-derived release notes. - Expand the deprecated Obsidian API scan in CI from
main.tsto all root*.tssources. - Raise
brace-expansionoverride floors and update README / Copilot instructions to reflect shipped features and format/tooling drift.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| README.md | Documents orphaned-star cleanup and the broken-marker warning behavior. |
| package.json | Raises brace-expansion override minimums to patched versions. |
| .github/workflows/release.yml | Runs lint in releases and appends VirusTotal links into release notes. |
| .github/workflows/ci.yml | Scans all .ts sources for deprecated Obsidian API usage (but needs a small grep fix). |
| .github/copilot-instructions.md | Updates instructions to reflect opener+terminator escaping and lookbehind lint rules. |
Suppressed comments (1)
.github/workflows/ci.yml:98
- Same issue as above:
\bis not a word-boundary in defaultgrep, so this check may miss.noticeElusage. Use an explicit boundary in an ERE (orgrep -P).
if grep -n "\.noticeEl\b" $SOURCES; then
|
|
||
| # workspace.activeLeaf — deprecated, use getActiveViewOfType() | ||
| if grep -n "\.activeLeaf\b" main.ts; then | ||
| if grep -n "\.activeLeaf\b" $SOURCES; then |
Every action in ci.yml and release.yml is pinned to a full commit SHA with the version kept as a trailing comment, so a moved tag cannot swap the action out from under a build (including inside the attestation-signing job). Closes the SHA-pin gap for annoteca. Annoteca only, on purpose: the standing rule is to leave every other plugin alone, so this is NOT rolled out to the template or the other plugins. A fleet pass (template + back-fill + a Dependabot github-actions config so the pins do not rot) is a separate task for when that freeze lifts.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 94: Update the release-note guard in the workflow to test for
non-whitespace content rather than file size, and apply the identical check in
the create-release branch that chooses between --notes-file and
--generate-notes. Preserve the existing behavior for genuinely empty or
whitespace-only release notes.
- Around line 23-27: Disable dependency caching in the release workflow’s “Use
Node.js” setup-node step by setting package-manager-cache to false, removing the
existing npm cache configuration as appropriate while preserving the Node.js
version and release behavior.
- Line 21: Disable checkout credential persistence by adding
persist-credentials: false to the checkout steps at
.github/workflows/release.yml:21, .github/workflows/ci.yml:21,
.github/workflows/ci.yml:124, and .github/workflows/ci.yml:140; no other
workflow behavior should change.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 247b26f3-ea66-489b-93b1-b7bc6d43b46f
📒 Files selected for processing (5)
.github/copilot-instructions.md.github/workflows/ci.yml.github/workflows/release.ymlREADME.mdpackage.json
- ci.yml: rewrite the deprecated-API scan as a shell function with recursive --include/--exclude, so it depends on neither a word-split file list (which breaks under zsh) nor \b (which grep without -P treats as a backspace). Explicit ERE boundaries instead. Verified locally: clean on the tree, and it still catches a planted usage. - Both workflows: persist-credentials: false on every checkout that does not run authenticated git later, so a compromised step cannot reuse the job token. - release.yml: drop the npm cache in the release job. It runs with contents, id-token, and attestations write plus VT_API_KEY, so it must not restore an untrusted dependency cache. CI keeps its cache. - release.yml: guard the release notes on non-whitespace content, not file size, in both the VirusTotal-append step and the create-release branch, so a lone blank line from awk is not mistaken for real notes.
|
@coderabbitai review |
✅ Action performedReview finished.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 25-30: Update the “Use Node.js” setup-node configuration to
explicitly set package-manager-cache to false, preserving the existing no-cache
intent and explanatory comment.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 56f9d5e7-4e1b-4ddb-b1da-670898e8c822
📒 Files selected for processing (2)
.github/workflows/ci.yml.github/workflows/release.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/ci.yml
setup-node auto-caches (package-manager-cache defaults true) when package.json declares npm, so omitting cache: npm was not enough to keep the privileged release job off an untrusted dependency cache. Addresses CodeRabbit on #38.
|
@coderabbitai review |
|
What
The "Repo and CI gaps" and doc-drift items from the handoff — none blocking, all real.
release.yml— lint on release. CI lints every PR, but a tag can be pushed at a commit CI never covered, so the release could cut an unlinted build. Addednpm run lintbefore build (before build becausecheck-submissionscans sources, andmain.jsdoesn't exist yet).release.yml— VirusTotal links surfaced. The scan ran before the release was created and had noid:, so its analysis URLs lived only in the workflow log. The step now hasid: virustotaland its URLs are folded into the release notes (passed viaenv, not inline${{ }}; guarded on a non-empty CHANGELOG-derived notes file so it can't turn a--generate-notesfallback into a notes-only-VirusTotal release).ci.yml— deprecated-API scan covers all sources. It grepped onlymain.ts, missing a deprecated call in any of the ~30 other modules. Now scans every source.ts. Sources rather than the built bundle, because the production bundle is minified and rewritesgetLeaf(true)togetLeaf(!0), which the boolean-argument pattern would miss.package.json— brace-expansion floors. Raised the override floors to^1.1.18/^2.1.4, the versions patched for GHSA-rgw5-rvv9-x895. The old floors (^1.1.13/^2.0.3) sat below the patch, so the override permitted a vulnerable resolution even though the current tree is already patched. Lockfile is consistent (npm ciclean).README.md— missing features. Documented "Clear orphaned stars" and the once-per-note broken-marker warning, both of which shipped (1.14.0) but were absent from the feature list..github/copilot-instructions.md— doc drift from #30/#31. The marker format escapes the opener (<!--→\<!--) as well as the terminator; andcheck-submissionalso rejects regex lookbehind. Both landed in #30/#31 and the instructions still described the old behavior.Not in this PR (flagged for a decision)
Pin actions by SHA (item 9): DONE for annoteca in this PR (every action pinned to a commit SHA). NOT rolled out to the template or other plugins, per the leave-other-plugins-alone freeze; a fleet pass + Dependabot is a separate task.main(item 12): a repo admin setting, not a code change.Review note
Codex pre-commit hit its usage limit and couldn't run; the changes are CI config + docs with simple, YAML-validated shell (the one shell-logic step passes the action output via
env). CodeRabbit is the merge gate.