chore: prepare repo for open-source publication - #103
Conversation
- Split internal passionfactory plugins and the local code-intelligence directory-source marketplace out of .claude/settings.json into a gitignored .claude/settings.local.json; committed settings.json now only lists public plugins (@pleaseai, @claude-plugins-official). - Add community health files: CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, .github/PULL_REQUEST_TEMPLATE.md, and .github/ISSUE_TEMPLATE/{bug_report.md,feature_request.md,config.yml}. - Add MIT license and repository fields to package.json.
📝 WalkthroughWalkthroughThis PR adds community documentation and GitHub templates, updates package repository metadata and publish commands, and changes generated README repository links plus release provenance settings. ChangesCommunity health documentation
Package publishing metadata
Estimated code review effort: 2 (Simple) | ~15 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request establishes repository standards and community guidelines by adding issue and pull request templates, a Code of Conduct, contributing instructions, and a security policy. It also cleans up enabled plugins in .claude/settings.json and adds license and repository metadata to package.json. The review feedback recommends further improving the package.json metadata by adding bugs and homepage fields to enhance the package's presentation on npm.
| "repository": { | ||
| "type": "git", | ||
| "url": "git+https://github.com/chatbot-pf/code-intelligence.git" | ||
| }, |
There was a problem hiding this comment.
[MEDIUM] package.json에 bugs 및 homepage 필드 추가 권장
Problem: 오픈소스 배포를 위해 package.json에 license와 repository 필드를 추가했으나, bugs와 homepage 필드가 누락되어 있습니다.
Rationale: npm에 패키지를 공개할 때 bugs 및 homepage 필드를 지정하면, npmjs.com 페이지에 버그 리포트 링크와 홈페이지 링크가 올바르게 표시되어 사용자 편의성이 향상됩니다.
Suggestion: package.json의 repository 필드 아래에 bugs와 homepage 필드를 추가하여 패키지 메타데이터를 보완해 주세요.
"repository": {
"type": "git",
"url": "git+https://github.com/chatbot-pf/code-intelligence.git"
},
"bugs": {
"url": "https://github.com/chatbot-pf/code-intelligence/issues"
},
"homepage": "https://github.com/chatbot-pf/code-intelligence#readme",
Greptile SummaryThis PR prepares the repository for open-source publication by cleaning internal plugin references from
Confidence Score: 5/5Safe to merge — changes are additive community/metadata files and CI hardening with no functional code impact. The diff is entirely configuration, documentation, and workflow changes. Plugin removals from settings.json are intentional OSS cleanup. Package repository URL corrections are accurate. SHA-pinning of Actions and enabling npm provenance are straightforward improvements. The only noteworthy item is that CODE_OF_CONDUCT.md and SECURITY.md list security@passionfactory.ai as the enforcement/fallback contact, which is inconsistent with the public pleaseai brand — but this has no runtime impact and is easy to follow up on. No files require special attention. The enforcement email in CODE_OF_CONDUCT.md and SECURITY.md could be revisited before the repo goes fully public. Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Push to main] --> B{release-please job}
B -- release_created=true --> C[publish job]
B -- no release --> Z[done]
C --> D[actions/checkout SHA-pinned]
D --> E[setup-bun SHA-pinned]
E --> F[setup-node SHA-pinned\nregistry-url=npmjs]
F --> G[actions/cache SHA-pinned]
G --> H[bun install]
H --> I[bun run build:npm]
I --> J["npm publish --provenance --access public\n(loop: npm/code-* + npm/code)"]
J --> K[Packages published with OIDC provenance]
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
A[Push to main] --> B{release-please job}
B -- release_created=true --> C[publish job]
B -- no release --> Z[done]
C --> D[actions/checkout SHA-pinned]
D --> E[setup-bun SHA-pinned]
E --> F[setup-node SHA-pinned\nregistry-url=npmjs]
F --> G[actions/cache SHA-pinned]
G --> H[bun install]
H --> I[bun run build:npm]
I --> J["npm publish --provenance --access public\n(loop: npm/code-* + npm/code)"]
J --> K[Packages published with OIDC provenance]
Reviews (4): Last reviewed commit: "Merge remote-tracking branch 'origin/mai..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CONTRIBUTING.md`:
- Around line 9-29: The bootstrap section still tells users to run mise install
even though this repo has no mise configuration and already relies on bun@1.3.5.
Update the setup instructions in CONTRIBUTING.md to remove the mise step and
keep only the bun-based install and run commands, so the workflow matches the
repo’s actual toolchain and scripts.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f8b8d226-8d29-413d-a763-a7185fc7a5cf
📒 Files selected for processing (9)
.claude/settings.json.github/ISSUE_TEMPLATE/bug_report.md.github/ISSUE_TEMPLATE/config.yml.github/ISSUE_TEMPLATE/feature_request.md.github/PULL_REQUEST_TEMPLATE.mdCODE_OF_CONDUCT.mdCONTRIBUTING.mdSECURITY.mdpackage.json
💤 Files with no reviewable changes (1)
- .claude/settings.json
| ```bash | ||
| git clone https://github.com/chatbot-pf/code-intelligence.git | ||
| cd code-intelligence | ||
| mise install # install pinned tool versions (if the repo uses mise) | ||
| bun install # install dependencies | ||
| ``` | ||
|
|
||
| If the repo does not use mise, follow the setup in its `README.md`. | ||
|
|
||
| ## Development workflow | ||
|
|
||
| 1. Create a branch from `main` (e.g. `feat/short-description` or `fix/issue-123`). | ||
| 2. Make focused changes — keep each pull request to one logical change. | ||
| 3. Run the checks below and make sure they pass. | ||
| 4. Open a pull request and fill out the template. | ||
|
|
||
| ```bash | ||
| bun run lint # lint and format | ||
| bun run test # run the test suite | ||
| bun run build # ensure it builds | ||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
python - <<'PY'
import json
from pathlib import Path
pkg = json.loads(Path("package.json").read_text())
print("packageManager:", pkg.get("packageManager"))
print("scripts:", sorted(pkg.get("scripts", {})))
PYRepository: pleaseai/code-intelligence
Length of output: 332
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- toolchain-related files ---\n'
git ls-files | grep -E '(^|/)(\.mise\.toml|mise\.toml|\.tool-versions|package\.json|README\.md|CONTRIBUTING\.md)$' || true
printf '\n--- CONTRIBUTING.md excerpt ---\n'
nl -ba CONTRIBUTING.md | sed -n '1,80p'
printf '\n--- toolchain config probes ---\n'
for f in .mise.toml mise.toml .tool-versions package.json; do
if [ -f "$f" ]; then
printf '\n[%s]\n' "$f"
nl -ba "$f" | sed -n '1,120p'
fi
done
printf '\n--- mentions of mise in repo ---\n'
rg -n '\bmise\b' -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' . || true
printf '\n--- mentions of bun in repo ---\n'
rg -n '\bbun\b' -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' . || trueRepository: pleaseai/code-intelligence
Length of output: 255
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'package.json scripts and packageManager:\n'
python3 - <<'PY'
import json
from pathlib import Path
pkg = json.loads(Path("package.json").read_text())
print("packageManager =", pkg.get("packageManager"))
print("scripts =", sorted(pkg.get("scripts", {})))
PYRepository: pleaseai/code-intelligence
Length of output: 375
🏁 Script executed:
#!/bin/bash
set -euo pipefail
if [ -f README.md ]; then
printf '--- README.md mentions of setup commands ---\n'
rg -n 'bun install|mise install|packageManager|test|lint|build' README.md || true
fiRepository: pleaseai/code-intelligence
Length of output: 255
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
import re
text = Path("CONTRIBUTING.md").read_text()
for needle in ["mise install", "bun install", "bun run lint", "bun run test", "bun run build"]:
print(needle, "=>", bool(re.search(re.escape(needle), text)))
PYRepository: pleaseai/code-intelligence
Length of output: 269
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo '--- toolchain-related files ---'
git ls-files | grep -E '(^|/)(\.mise\.toml|mise\.toml|\.tool-versions|package\.json|README\.md|CONTRIBUTING\.md)$' || true
echo
echo '--- CONTRIBUTING.md excerpt ---'
nl -ba CONTRIBUTING.md | sed -n '1,80p'
echo
echo '--- toolchain config probes ---'
for f in .mise.toml mise.toml .tool-versions package.json; do
if [ -f "$f" ]; then
echo
echo "[$f]"
nl -ba "$f" | sed -n '1,160p'
fi
done
echo
echo '--- mentions of mise in repo ---'
rg -n '\bmise\b' -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' . || true
echo
echo '--- mentions of bun install in repo ---'
rg -n 'bun install|bun run lint|bun run test|bun run build' -g '!**/node_modules/**' -g '!**/dist/**' -g '!**/build/**' . || true
echo
echo '--- README.md mentions of setup commands ---'
if [ -f README.md ]; then
rg -n 'bun install|mise install|packageManager|test|lint|build' README.md || true
fiRepository: pleaseai/code-intelligence
Length of output: 1558
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
for name in [".mise.toml", "mise.toml", ".tool-versions"]:
p = Path(name)
print(name, "exists =", p.exists())
if p.exists():
print(p.read_text()[:2000])
PYRepository: pleaseai/code-intelligence
Length of output: 245
Remove the mise install step. This repo is pinned to bun@1.3.5 and exposes the expected bun run lint/test/build scripts, but it doesn’t declare any mise config, so the bootstrap instructions are misleading.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CONTRIBUTING.md` around lines 9 - 29, The bootstrap section still tells users
to run mise install even though this repo has no mise configuration and already
relies on bun@1.3.5. Update the setup instructions in CONTRIBUTING.md to remove
the mise step and keep only the bun-based install and run commands, so the
workflow matches the repo’s actual toolchain and scripts.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
2 issues found across 9 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="CONTRIBUTING.md">
<violation number="1" location="CONTRIBUTING.md:10">
P2: The clone URL uses `chatbot-pf/code-intelligence` but the canonical public org for this repository appears to be `pleaseai`. Contributors following these instructions will clone from the wrong location. Update to match the authoritative GitHub org.</violation>
</file>
Architecture diagram
sequenceDiagram
participant Dev as Developer
participant Claude as Claude Code
participant SettingsJson as settings.json (committed)
participant SettingsLocal as settings.local.json (gitignored)
participant PluginAPI as Plugin Registry / Marketplace
Note over Dev,PluginAPI: Runtime interaction after open-source separation
Dev->>Dev: git clone – gets public settings.json only
Dev->>Dev: manually creates .claude/settings.local.json (internal)
Claude->>SettingsJson: reads enabledPlugins (now only public)
SettingsJson-->>Claude: [@pleaseai, @claude-plugins-official, etc.]
Claude->>SettingsLocal: reads extra known marketplaces & internal plugins
alt local file present
SettingsLocal-->>Claude: [passionfactory, code-intelligence directory]
end
Claude->>PluginAPI: fetch plugin definitions from all sources
PluginAPI-->>Claude: plugin capabilities & MCP tools
Note over Claude: Internal plugins no longer exposed in committed code
Note over SettingsJson: This file is now safe for public publication
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| ## Getting started | ||
|
|
||
| ```bash | ||
| git clone https://github.com/chatbot-pf/code-intelligence.git |
There was a problem hiding this comment.
P2: The clone URL uses chatbot-pf/code-intelligence but the canonical public org for this repository appears to be pleaseai. Contributors following these instructions will clone from the wrong location. Update to match the authoritative GitHub org.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At CONTRIBUTING.md, line 10:
<comment>The clone URL uses `chatbot-pf/code-intelligence` but the canonical public org for this repository appears to be `pleaseai`. Contributors following these instructions will clone from the wrong location. Update to match the authoritative GitHub org.</comment>
<file context>
@@ -0,0 +1,44 @@
+## Getting started
+
+```bash
+git clone https://github.com/chatbot-pf/code-intelligence.git
+cd code-intelligence
+mise install # install pinned tool versions (if the repo uses mise)
</file context>
| git clone https://github.com/chatbot-pf/code-intelligence.git | |
| git clone https://github.com/pleaseai/code-intelligence.git |
Enable npm provenance in the release-please publish job (npm publish --provenance --access public) and drop NPM_CONFIG_PROVENANCE: false. Provenance binds the attestation to the repo CI builds from, so the published package's repository.url must match. Point every package's repository at the canonical pleaseai/code-intelligence (was stale: pleaseai/code, chatbot-pf/code-please, chatbot-pf/code-intelligence redirect) — generate-packages.ts copies packages/code's repository into the published npm/code* artifacts. Also switch the local publish:npm script from bun publish to npm publish (bun publish does not support npm provenance) and fix the stale anthropics/code URL in the generated binary README.
There was a problem hiding this comment.
🧹 Nitpick comments (1)
package.json (1)
29-29: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low valueLost idempotency safeguard on re-run.
Switching from
bun publish --tolerate-republishtonpm publishdrops tolerance for republishing an already-published version. If this script fails partway through thenpm/code-*loop and is re-run, earlier packages that already succeeded will now hard-fail instead of being skipped.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` at line 29, The publish:npm script no longer tolerates republishing, so reruns can fail on packages already published. Update the publish flow in package.json to preserve idempotency by using the same republish-safe behavior as before for the npm/code-* loop and the npm/code publish step, so partial failures can be retried without hard-failing on earlier successful publishes.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@package.json`:
- Line 29: The publish:npm script no longer tolerates republishing, so reruns
can fail on packages already published. Update the publish flow in package.json
to preserve idempotency by using the same republish-safe behavior as before for
the npm/code-* loop and the npm/code publish step, so partial failures can be
retried without hard-failing on earlier successful publishes.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: c6d737ee-f8d4-4728-951c-813a1d2263e1
📒 Files selected for processing (9)
.github/workflows/release-please.ymlpackage.jsonpackages/binaries/package.jsonpackages/code/package.jsonpackages/dora/package.jsonpackages/format/package.jsonpackages/logger/package.jsonpackages/lsp/package.jsonscripts/generate-packages.ts
✅ Files skipped from review due to trivial changes (7)
- packages/dora/package.json
- packages/code/package.json
- packages/binaries/package.json
- packages/lsp/package.json
- packages/logger/package.json
- scripts/generate-packages.ts
- packages/format/package.json
Pin all third-party GitHub Actions to full 40-char commit SHAs (with version comments) per the OSS supply-chain standard — a moving tag can be repointed at malicious code after review. create-github-app-token v1.12.0 release-please-action v4.4.1 checkout v4.3.1 setup-bun v2.2.0 setup-node v4.4.0 cache v4.3.0
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/release-please.yml (2)
59-61: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick winPin Bun for reproducible release artifacts.
bun-version: latestleaves the publish build dependent on the version resolved at release time. Prefer a fixed version orbun-version-filefrom the repo’s toolchain metadata; the pinned setup action supports both forms. (raw.githubusercontent.com)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-please.yml around lines 59 - 61, The release workflow currently uses setup-bun with a floating bun-version, which makes release builds non-reproducible. Update the bun setup step in the release-please workflow to use a fixed Bun version or a bun-version-file from the repository’s toolchain metadata, keeping the existing setup-bun action reference intact. Use the bun setup step itself as the target for the change so the publish job always resolves the same Bun version.
36-40: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winScope the GitHub App token to release-please’s minimum permissions (
.github/workflows/release-please.yml:36-40).
actions/create-github-app-tokeninherits the app installation’s full permissions unlesspermission-*inputs are set, so pin this token to the scopes release-please needs (contents,pull-requests,issues) instead of using the broader default token.🔒 Proposed hardening
- uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 id: app-token with: app-id: ${{ secrets.PF_BOT_APP_ID }} private-key: ${{ secrets.PF_BOT_PRIVATE_KEY }} + permission-contents: write + permission-pull-requests: write + permission-issues: write🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/release-please.yml around lines 36 - 40, Scope the GitHub App token used by the release-please workflow to the minimum required permissions. In the release-please job that uses actions/create-github-app-token and the app-token step, add the permission inputs for the exact release-please scopes needed (contents, pull-requests, issues) so the generated token is not granted the app installation’s broader default access.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release-please.yml:
- Line 57: The publish job’s checkout step is still persisting repository
credentials, which is unnecessary for the install/build/publish flow. Update the
actions/checkout usage in the release-please workflow to explicitly disable
credential persistence by setting persist-credentials to false. Keep the change
scoped to the checkout step so later npm-related steps continue to work without
exposing the token.
---
Nitpick comments:
In @.github/workflows/release-please.yml:
- Around line 59-61: The release workflow currently uses setup-bun with a
floating bun-version, which makes release builds non-reproducible. Update the
bun setup step in the release-please workflow to use a fixed Bun version or a
bun-version-file from the repository’s toolchain metadata, keeping the existing
setup-bun action reference intact. Use the bun setup step itself as the target
for the change so the publish job always resolves the same Bun version.
- Around line 36-40: Scope the GitHub App token used by the release-please
workflow to the minimum required permissions. In the release-please job that
uses actions/create-github-app-token and the app-token step, add the permission
inputs for the exact release-please scopes needed (contents, pull-requests,
issues) so the generated token is not granted the app installation’s broader
default access.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 3b6d73fd-ca07-44f6-81fd-8b631ee723aa
📒 Files selected for processing (1)
.github/workflows/release-please.yml
| id-token: write | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win
Disable credential persistence on checkout in the publish job. The later steps only install, build, and publish npm packages, so the checkout token is unnecessary; set persist-credentials: false to keep repo credentials out of build scripts.
🔒 Proposed hardening
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 57-57: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release-please.yml at line 57, The publish job’s checkout
step is still persisting repository credentials, which is unnecessary for the
install/build/publish flow. Update the actions/checkout usage in the
release-please workflow to explicitly disable credential persistence by setting
persist-credentials to false. Keep the change scoped to the checkout step so
later npm-related steps continue to work without exposing the token.
There was a problem hiding this comment.
1 issue found across 1 file (changes from recent commits).
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/release-please.yml">
<violation number="1" location=".github/workflows/release-please.yml:57">
P2: Set `persist-credentials: false` on this checkout step. The publish job only needs source files for install/build/publish — it doesn't push commits. Leaving credentials persisted (the default) means the token is stored in `.git/config` where it could be read by npm lifecycle scripts during install or build, expanding the attack surface for supply-chain exploits.</violation>
</file>
Tip: Review your code locally with the cubic CLI to iterate faster.
Re-trigger cubic
| id-token: write | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 |
There was a problem hiding this comment.
P2: Set persist-credentials: false on this checkout step. The publish job only needs source files for install/build/publish — it doesn't push commits. Leaving credentials persisted (the default) means the token is stored in .git/config where it could be read by npm lifecycle scripts during install or build, expanding the attack surface for supply-chain exploits.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/release-please.yml, line 57:
<comment>Set `persist-credentials: false` on this checkout step. The publish job only needs source files for install/build/publish — it doesn't push commits. Leaving credentials persisted (the default) means the token is stored in `.git/config` where it could be read by npm lifecycle scripts during install or build, expanding the attack surface for supply-chain exploits.</comment>
<file context>
@@ -54,18 +54,18 @@ jobs:
id-token: write
steps:
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
- - uses: oven-sh/setup-bun@v2
</file context>
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| persist-credentials: false |
Pin all third-party GitHub Actions in the CI workflow to full 40-char commit SHAs (with version comments) per the OSS supply-chain standard. checkout v4.3.1 setup-bun v2.2.0 cache v4.3.0 codecov-action v5.5.5
# Conflicts: # .github/workflows/release-please.yml
|
1 participant
Summary
Two changes to prepare this repository for open-source publication:
passionfactorymarketplace plugins and the localcode-intelligencedirectory-source marketplace out of the committed.claude/settings.jsoninto a gitignored.claude/settings.local.json(untracked, not part of this PR). The committedsettings.jsonnow only lists public plugins (@pleaseai,@claude-plugins-official).CONTRIBUTING.md,CODE_OF_CONDUCT.md,SECURITY.md,.github/PULL_REQUEST_TEMPLATE.md, and.github/ISSUE_TEMPLATE/{bug_report.md,feature_request.md,config.yml}; addedlicense: "MIT"andrepositoryfields topackage.json.Changes
.claude/settings.json— remove internal-only plugin entries andextraKnownMarketplacespackage.json— addlicenseandrepositoryCONTRIBUTING.md,CODE_OF_CONDUCT.md,SECURITY.md(new).github/PULL_REQUEST_TEMPLATE.md(new).github/ISSUE_TEMPLATE/bug_report.md,feature_request.md,config.yml(new)Remaining OSS checklist (follow-ups)
bun publishtonpm publish --provenanceTest Plan
.claude/settings.local.jsonremains untracked/gitignored and was not included in this PR.claude/settings.jsonandpackage.jsondiffs contain only the intended changesSummary by cubic
Prepares the repo for open source: removes internal Claude Code settings, adds community docs and templates, unifies package repository URLs to
pleaseai/code-intelligence, and enables verifiable npm releases with provenance. CI now pins all third‑party GitHub Actions (includingcodecov) to SHAs.Refactors
.claude/settings.json: removed internal plugins and the local marketplace; kept only public plugins (@pleaseai,@claude-plugins-official).license: "MIT"andrepositoryto rootpackage.json; updated all packages’repository.urltohttps://github.com/pleaseai/code-intelligence; fixed generated binary README link.release-pleasepublishes withnpm publish --provenance; localpublish:npmusesnpm; pinned Actions (actions/checkout,oven-sh/setup-bun,actions/setup-node,actions/cache,googleapis/release-please-action,actions/create-github-app-token,codecov/codecov-action) to commit SHAs.New Features
CONTRIBUTING.md,CODE_OF_CONDUCT.md,SECURITY.md.Written for commit 7d5b031. Summary will update on new commits.
Summary by CodeRabbit