docs: publish demo and public project guide - #2
Merged
Conversation
📝 WalkthroughWalkthroughThe change documents audited public demo media, permits the exact hash-pinned binary in public-data scans, includes the demo GIF in npm packages, updates package tests, and rewrites the README around workflows, safety, development, and licensing. ChangesPublic demo media
Estimated code review effort: 2 (Simple) | ~10 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
tests/test_public_data_policy.py (1)
82-94: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd an integration regression for mismatched allowlisted content.
This test only exercises
is_audited_public_binary; it would still pass ifscan_pathsor_scan_bytesaccidentally accepted altered UTF-8 content at the audited path. Add assertions that exact bytes produce no findings while modified bytes produce a hash-mismatch finding through both worktree and staged/history scanning paths.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@tests/test_public_data_policy.py` around lines 82 - 94, Add an integration regression around scan_paths and _scan_bytes using the audited binary path: assert exact allowlisted bytes produce no findings, then assert modified bytes produce a hash-mismatch finding through both worktree scanning and staged/history scanning paths. Retain the existing is_audited_public_binary assertions and use the repository’s established scanning setup and finding assertions.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@README.md`:
- Around line 76-81: Clarify the company-profile setup instructions around the
example copy command: either replace the repo-relative source with the shipped
example path for installed-package users, or explicitly label the command as
source-checkout-only. Update the README text surrounding the company profile
example while preserving the destination .pi-steel/company-profile.json.
In `@scripts/check-public-data.py`:
- Around line 141-145: Make both scanner entry points in
scripts/check-public-data.py fail closed on audited-path SHA-256 mismatches:
update the file-system scan around is_audited_public_binary and the
staged/historical blob scan to return the mismatch finding before UTF-8 decoding
or content scanning. Add regression coverage in tests/test_public_data_policy.py
for altered UTF-8 bytes through both scanner paths, confirming each reports the
digest mismatch.
---
Nitpick comments:
In `@tests/test_public_data_policy.py`:
- Around line 82-94: Add an integration regression around scan_paths and
_scan_bytes using the audited binary path: assert exact allowlisted bytes
produce no findings, then assert modified bytes produce a hash-mismatch finding
through both worktree scanning and staged/history scanning paths. Retain the
existing is_audited_public_binary assertions and use the repository’s
established scanning setup and finding assertions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: c441ecd1-6c9a-436c-9001-ed7a36b3d367
⛔ Files ignored due to path filters (1)
docs/assets/pi-steel-demo.gifis excluded by!**/*.gif
📒 Files selected for processing (6)
PUBLIC_DATA_POLICY.mdREADME.mdpackage.jsonscripts/check-public-data.pytests/test_package_contents.pytests/test_public_data_policy.py
Comment on lines
+76
to
+81
| Copy the example company profile to a private project location: | ||
|
|
||
| Each command publishes an isolated run under the requested output root and updates | ||
| `latest-run.json`. Exit `0` is geometry-verified, `2` requires review, and `3` is | ||
| blocked. No named CAM compatibility is claimed. | ||
| ```bash | ||
| mkdir -p .pi-steel | ||
| cp skills/steel-rfq/assets/company-profile.example.json \ | ||
| .pi-steel/company-profile.json |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Map the relevant files and inspect the README section around the cited lines.
git ls-files README.md package.json skills/steel-rfq/assets/company-profile.example.json
printf '\n--- README excerpt ---\n'
sed -n '60,95p' README.md
printf '\n--- package.json excerpt ---\n'
sed -n '1,220p' package.json
printf '\n--- example profile file ---\n'
cat -n skills/steel-rfq/assets/company-profile.example.jsonRepository: StructuPath/pi-steel
Length of output: 4396
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check whether the npm package definition would include the example profile asset
# and whether the README describes repo checkout vs package install.
rg -n '"files"|assets|company-profile.example.json|npm:`@structupath/pi-steel`|npm install|npx' -S README.md package.json .npmignore .gitignoreRepository: StructuPath/pi-steel
Length of output: 513
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Look for any packaging or release metadata that would ship the assets folder.
fd -a 'package*.json' .
fd -a '.npmignore' .
fd -a '.gitignore' .
rg -n '"files"|publish|prepack|postpack|assets/' -S .Repository: StructuPath/pi-steel
Length of output: 20834
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the install/setup context around the README and the RFQ skill docs.
sed -n '1,40p' README.md
printf '\n--- skills/steel-rfq/SKILL.md excerpt ---\n'
sed -n '1,120p' skills/steel-rfq/SKILL.mdRepository: StructuPath/pi-steel
Length of output: 5566
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect package-related tests to see what is expected to ship and how users consume it.
sed -n '1,120p' tests/test_package_contents.py
printf '\n--- installed script test excerpt ---\n'
sed -n '1,220p' tests/test_installed_scripts.pyRepository: StructuPath/pi-steel
Length of output: 6644
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Check whether README or scripts reference the example profile from an installed package path.
rg -n "company-profile\.example\.json|company-profile\.json|skills/steel-rfq/assets" README.md skills tests scripts -SRepository: StructuPath/pi-steel
Length of output: 1466
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Determine whether the README's example command is intended to work from a package checkout
# or from an installed package copy by inspecting nearby setup language.
sed -n '1,120p' README.mdRepository: StructuPath/pi-steel
Length of output: 4686
Clarify the company profile copy path. The command uses a repo-relative source path, so it only works from a source checkout. If this is meant for installed-package users, point to the shipped example path; otherwise mark it as source-only.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 76 - 81, Clarify the company-profile setup
instructions around the example copy command: either replace the repo-relative
source with the shipped example path for installed-package users, or explicitly
label the command as source-checkout-only. Update the README text surrounding
the company profile example while preserving the destination
.pi-steel/company-profile.json.
Comment on lines
+141
to
+145
| content = path.read_bytes() | ||
| if is_audited_public_binary(relative, content): | ||
| continue | ||
| try: | ||
| text = path.read_bytes().decode("utf-8") | ||
| text = content.decode("utf-8") |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Fail closed on hash mismatch at the audited path.
Both scanner entry points treat a digest mismatch as ordinary content; benign UTF-8 replacements can therefore pass with zero findings, despite the policy requiring an exact path and SHA-256 digest.
scripts/check-public-data.py#L141-L145: reject mismatched allowlisted files instead of decoding them.scripts/check-public-data.py#L179-L182: apply the same rejection to staged and historical blobs.tests/test_public_data_policy.py#L82-L94: add regression coverage for altered UTF-8 bytes through these scanner paths.
Proposed fail-closed handling
content = path.read_bytes()
- if is_audited_public_binary(relative, content):
- continue
+ if relative in AUDITED_PUBLIC_BINARY_SHA256:
+ if is_audited_public_binary(relative, content):
+ continue
+ findings.append(f"{relative}: audited public binary hash mismatch")
+ continueApply the equivalent logic in _scan_bytes, returning the mismatch finding instead of falling through.
📍 Affects 2 files
scripts/check-public-data.py#L141-L145(this comment)scripts/check-public-data.py#L179-L182tests/test_public_data_policy.py#L82-L94
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@scripts/check-public-data.py` around lines 141 - 145, Make both scanner entry
points in scripts/check-public-data.py fail closed on audited-path SHA-256
mismatches: update the file-system scan around is_audited_public_binary and the
staged/historical blob scan to return the mismatch finding before UTF-8 decoding
or content scanning. Add regression coverage in tests/test_public_data_policy.py
for altered UTF-8 bytes through both scanner paths, confirming each reports the
digest mismatch.
Steel-tech
added a commit
that referenced
this pull request
Jul 28, 2026
Co-authored-by: Victor Garcia <211279486+Steel-tech@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Documentation
Bug Fixes