Palash DebnathandClaude Opus 4.8
8162f52c08
* ci(security): add scanning workflow + CodeRabbit config + sweep design PR 0 of the v0.3.0 stabilization sweep — establishes the automated review + security gate every subsequent plan PR flows through. - .github/workflows/security.yml: gitleaks (gating secret scan), CodeQL (Python + JS/TS), bandit (SARIF), pip-audit + bun audit. Only the secret scan gates; dep/SAST findings are reporting-only to stay consistent with the no-ceremony, continuous-to-main cadence. - .coderabbit.yaml: path filters + constitution constraints encoded as review instructions (local-first, cross-platform parity, alembic, no secret/home-path leakage). Drafts excluded from auto-review. - SECURITY.md: document the automated scanning + bot review. - docs/specs: program design for the full sweep (plan-01..05 + PR triage). CodeRabbit and Greptile apps are already installed and will review on PR open. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(security): install bandit[sarif] extra; pin JS actions to Node 24 The bandit SARIF formatter ships in the `bandit[sarif]` extra; plain `bandit` rejects `-f sarif` (exit 2), so no SARIF was written and the upload step failed. Install via `pipx run --spec 'bandit[sarif]'`. Also add FORCE_JAVASCRIPT_ACTIONS_TO_NODE24 (mirrors ci.yml) to silence the Node 20 deprecation warning on checkout/setup-python/upload-sarif. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(security): harden per bot review — persist-credentials, upload guard, bun pin Addresses CodeRabbit + Greptile findings on #135: - persist-credentials: false on all checkout steps (don't leave GITHUB_TOKEN in git config; none of these jobs need authed git after clone). [CodeRabbit] - continue-on-error on the bandit SARIF upload so a missing SARIF can't fail this reporting-only job. [Greptile P1] - pin bun-version "1.2" — `bun audit` only exists in bun >=1.2.x. [Greptile P2] Declined: full-SHA action pinning. Meets the major-tag bar set in .coderabbit.yaml and matches ci.yml/release.yml convention; SHA pinning belongs in a repo-wide hardening pass with Dependabot, not one file. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
66 lines
2.5 KiB
YAML
66 lines
2.5 KiB
YAML
# CodeRabbit configuration — https://docs.coderabbit.ai/guides/configure-coderabbit
|
|
# The CodeRabbit GitHub App is already installed on this repo and reviews every
|
|
# PR on creation. This file only tunes that behavior; it is not required for the
|
|
# bot to run.
|
|
#
|
|
# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
|
|
language: "en-US"
|
|
early_access: false
|
|
|
|
reviews:
|
|
# "chill" keeps the bot from blocking merges — it comments, it does not gate.
|
|
# Hard gating lives in CI (security.yml) and the constitution's human bar.
|
|
profile: chill
|
|
request_changes_workflow: false
|
|
high_level_summary: true
|
|
review_status: true
|
|
poem: false
|
|
|
|
auto_review:
|
|
enabled: true
|
|
# Match the constitution: drafts are work-in-progress, don't burn review
|
|
# cycles on them. PRs flip to ready → CodeRabbit reviews.
|
|
drafts: false
|
|
base_branches:
|
|
- main
|
|
|
|
# Skip generated / vendored / binary paths so the review stays high-signal.
|
|
path_filters:
|
|
- "!**/*.lock"
|
|
- "!**/bun.lock"
|
|
- "!**/uv.lock"
|
|
- "!**/dist/**"
|
|
- "!**/build/**"
|
|
- "!frontend/src-tauri/target/**"
|
|
- "!**/*.min.js"
|
|
- "!**/*.svg"
|
|
- "!**/*.png"
|
|
- "!**/*.wav"
|
|
- "!**/*.onnx"
|
|
- "!tests/fixtures/**"
|
|
|
|
# Encode the project's hard constraints so the bot reviews against them.
|
|
path_instructions:
|
|
- path: "**/*.{py,rs,js,jsx,ts,tsx}"
|
|
instructions: >-
|
|
OmniVoice is fully-local (no cloud, no API keys, no telemetry). Flag any
|
|
new outbound network call that is not to github.com issues, a HuggingFace
|
|
model download, or an explicitly opt-in endpoint. Flag any code that
|
|
persists or logs values matching *TOKEN*/*KEY*/*SECRET* or absolute user
|
|
home paths (/Users/<name>/, C:\\Users\\<name>\\).
|
|
- path: "backend/**/*.py"
|
|
instructions: >-
|
|
Default features must behave identically on macOS, Windows and Linux.
|
|
Platform-specific implementation is allowed, but a divergent user-visible
|
|
default is a P0 bug — flag it and suggest an opt-in (Settings/env/flag).
|
|
Any DB schema change must go through an alembic migration with an upgrade
|
|
path; flag direct schema edits. Engine code must stay backward-compatible
|
|
with already-installed on-disk model state (no forced reinstall).
|
|
- path: ".github/workflows/**"
|
|
instructions: >-
|
|
Pin actions to a major version tag at minimum. Flag any workflow that
|
|
grants write permissions it does not need.
|
|
|
|
chat:
|
|
auto_reply: true
|