Feature/gh 36 decision gate and full launch#39
Merged
Conversation
node:22-alpine ships with npm ≥ 10.9 which contains updated bundled packages (cross-spawn, glob, minimatch, node-tar) that fix all 11 npm- bundled CVEs previously suppressed in .trivyignore. Suppressions removed. Closes #21
npm in node:22-alpine bundles picomatch 4.0.3 which has a ReDoS (HIGH). Same class as the 11 suppressions removed in the previous commit: lives in usr/local/lib/node_modules/npm/, not reachable at runtime. Suppressed until node:22-alpine ships with npm bundling picomatch ≥ 4.0.4. Refs #21
- semgrep: restrict to pull_request events; CodeQL covers push-to-main SAST - secrets: use github.event.before/sha for correct TruffleHog diff range on push Decided by AgDR-0002 Closes #25 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
On a force-push to main, github.event.before may not be reachable in the commit graph, causing TruffleHog to silently widen to a full-history scan or fail with the same ref-resolution error. Added github.event.forced != true to the secrets job condition; also added comment explaining the ternary base/head expression. Updated AgDR-0002 Consequences section. Addresses blocking finding from code review. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Made-with: Cursor
Made-with: Cursor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (20)
📝 WalkthroughWalkthroughThis PR implements a comprehensive UI refactor execution framework with security workflow corrections, Node.js runtime upgrade, new telemetry instrumentation, and refactored dashboard navigation. It includes CI/CD security scanning fixes, updated Docker configuration, phased delivery planning documentation, and instrumented page/navigation components to emit telemetry events for core vs secondary workflows. Changes
Sequence Diagram(s)Navigation and telemetry flows are straightforward linear sequences (click → event → navigation) without branching multi-component interactions or complex orchestration, so no sequence diagram is warranted. Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
Possibly related PRs
Poem
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
Release Notes
New Features
Documentation
Chores