feat(package): add Pi gallery preview - #3
Conversation
📝 WalkthroughWalkthroughAdds a reviewed WebP gallery asset, publishes it through npm and Pi metadata, and pins its exact path and SHA-256 digest in public-data auditing and related tests. ChangesGallery asset publication
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
⚔️ Resolve merge conflicts
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Around line 50-51: Update the package metadata image URL in package.json to
reference an immutable release commit SHA or package-hosted asset instead of the
mutable main branch, preserving the reviewed image bytes for published releases.
In `@PUBLIC_DATA_POLICY.md`:
- Around line 15-17: Update the public gallery media policy to require
documented provenance and redistribution rights before allowlisting, limiting
the exception to original, owned, or properly licensed media. Retain the
existing review and SHA-256 digest requirements for approved media.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 4de0bde3-275d-47f9-985f-0af0d19600ab
📒 Files selected for processing (6)
PUBLIC_DATA_POLICY.mddocs/assets/pi-steel-gallery.webppackage.jsonscripts/check-public-data.pytests/test_package_contents.pytests/test_public_data_policy.py
| ], | ||
| "image": "https://raw.githubusercontent.com/StructuPath/pi-steel/main/docs/assets/pi-steel-gallery.webp" |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Use an immutable image URL for released metadata.
The scanner pins the checked-in bytes, but this URL points at mutable main; an already-published package or catalog entry can therefore render a later asset. Point to the release commit SHA or another immutable/package-hosted URL so the reviewed image remains stable after release.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@package.json` around lines 50 - 51, Update the package metadata image URL in
package.json to reference an immutable release commit SHA or package-hosted
asset instead of the mutable main branch, preserving the reviewed image bytes
for published releases.
| - Public gallery media reviewed before publication and pinned in the scanner by | ||
| exact repository path and SHA-256 digest. Replacing it requires a new review and | ||
| digest. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Require provenance and redistribution rights for gallery media.
A SHA-256 pin authenticates the bytes but does not prove that the repository owns or may redistribute them. Limit this exception to original/owned or properly licensed media, with provenance and redistribution rights documented before allowlisting.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@PUBLIC_DATA_POLICY.md` around lines 15 - 17, Update the public gallery media
policy to require documented provenance and redistribution rights before
allowlisting, limiting the exception to original, owned, or properly licensed
media. Retain the existing review and SHA-256 digest requirements for approved
media.
1 participant
Summary
pi-steel can now replace Pi’s blank package placeholder with a purpose-built,
small-thumbnail-readable gallery cover after the next npm publication. The
package card also leads with the workflow’s actual value instead of a standards
name.
The gallery asset contains only generic product illustrations and is pinned by
path and SHA-256 in the public-data scanner. Any replacement fails closed until
it is reviewed and assigned a new digest.
Preview
Verification
npm run lintnpm test— 132 passed, 2 deselectednpm run privacy:checkpython3 scripts/check-public-data.py --range origin/main..HEADnpm run pack:checknpm pack --dry-runincludes both gallery assetsPost-Deploy Monitoring & Validation
No additional runtime monitoring is required because this changes package
gallery metadata and static media only. After the next approved npm release,
the release owner should verify the image and concise description on Pi’s
package catalog; a missing image or stale placeholder is the rollback trigger
for the metadata URL.
Summary by CodeRabbit
New Features
Documentation