Feature/ai code reviewer - #72
Conversation
- Use bun install --production to exclude dev dependencies - Use oven/bun:1-slim instead of oven/bun:1 (smaller base) - Use --no-install-recommends for apt packages - Clean up apt cache in same layer - Rename REPOS_PATH to GIT_REPOS_PATH for consistency
…cks from layouts blocks from layouts - Move glass-panel and custom-scrollbar styles to globals.css - Remove style block from admin/index.astro - Remove style block from AdminLayout.astro
- notification-preferences: remove checkbox style block - blob/[branch]/[...path]: remove shiki/scrollbar style block - blame/[branch]/[path]: remove shiki/scrollbar style block - ide/index: move inline styles to body attribute - globals.css: add shiki/scrollbar styles centrally
… globals.css - Remove <style is:global> from BaseLayout.astro - Add font-family, container, scroll-behavior to globals.css - Zero style blocks remain in any Astro files
Vite 8.x defaults to LightningCSS for CSS transformation, which conflicts with Tailwind CSS v3 directives (@tailwind, @apply, @layer). This caused 'Attempted to assign to readonly property' error during Docker build on src/styles/globals.css. Explicitly set css.transformer to 'postcss' in the Vite config to ensure compatibility with Tailwind CSS v3.
The Docker build uses Astro 4.x which depends on Vite 5.4.21. PostCSS 8.5.x introduced frozen/readonly AST node properties that Vite 5.4.21's compileCSS function tries to mutate, causing: 'Attempted to assign to readonly property' on globals.css Pin PostCSS to ~8.4.49 (both in devDependencies and overrides) to ensure compatibility until Astro upgrades to Vite 6+.
…ike design - Fixed Vite 5 / PostCSS 8.5.x frozen AST bug by removing @astrojs/tailwind integration and pinning postcss. - Moved CSS tools to dependencies and updated Dockerfile for multi-stage dependency installs. - Cleaned and modernized globals.css. - Merged duplicate class definitions (.glass-panel, .custom-scrollbar). - Overhauled light theme to reflect modern GitHub aesthetics. - Added missing Shadcn sidebar and chart tokens for all themes. - Updated scrollbar implementation to use standard `scrollbar-width` and `scrollbar-color` properties.
- Added getCsrfToken to new.astro to generate the token and cookie on the server. - Passed the token into a hidden input field. - Extracted the token and included it in the X-CSRF-Token header in the client-side fetch request.
- Extracted CSRF token generation to BaseLayout and AdminLayout. - Injected token via <meta name="csrf-token" /> tag. - Added global window.fetch interceptor to automatically append the 'x-csrf-token' header to all state-changing requests (POST, PUT, PATCH, DELETE). - Reverted manual CSRF handling in new.astro as it's now handled globally for all API requests (repo creation, profile updates, etc).
- Updated createSimpleGit and getGit to use getSanitizedGitEnv. - Passed INTERNAL_HOOK_SECRET to ensure pre-receive and post-receive hooks authenticate correctly for system-initiated pushes like repository initialization. - Added a fallback 'system' REMOTE_USER to bypass path protections when no specific user is authenticated.
- Updated installHooks to use port 4321 instead of 3000 as the fallback when SITE_URL is not set. - Fixes the issue where curl would fail to connect to the internal API during hook execution, resulting in an empty response body and a 'pre-receive hook declined' error.
- Updated installHooks to always point curl to 127.0.0.1 instead of SITE_URL. - This prevents connection timeouts when SITE_URL is an external IP that the host cannot route to itself. - Added -sS flag to curl to bubble up explicit connection errors rather than failing silently with an empty body.
…ngine & Docker Hub release workflow
…ity allowlist for CI security gates
…accepted vulnerability allowlist
- Darken --primary/--ring from hsl(212,100%,48%) to hsl(212,100%,37%)
to pass WCAG 2.1 AA contrast ratio (4.5:1 minimum)
- Replace broken axe-core disableRules() with options({ rules: {...} })
for reliable color-contrast rule disabling
- Replace flaky waitForTimeout() with deterministic waitForFunction()
in theme toggle E2E tests
|
Too many files changed for review. ( Bypass the limit by tagging |
|
Caution Review failedFailed to post review comments. We encountered an issue with GitHub. Use ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (5)
⏰ Context from checks skipped due to timeout. (2)
🧰 Additional context used🪛 ast-grep (0.45.0)playwright-report/index.html[error] 17-17: React's useState should not be directly called (usestate-direct-usage) [error] 56-56: React's useState should not be directly called (usestate-direct-usage) [error] 56-56: React's useState should not be directly called (usestate-direct-usage) [error] 57-57: React's useState should not be directly called (usestate-direct-usage) [error] 57-57: React's useState should not be directly called (usestate-direct-usage) [error] 57-57: React's useState should not be directly called (usestate-direct-usage) [error] 57-57: React's useState should not be directly called (usestate-direct-usage) [error] 57-57: React's useState should not be directly called (usestate-direct-usage) [warning] 57-57: Avoid assigning untrusted data to innerHTML/outerHTML or document.write (inner-outer-html) [warning] 57-57: Avoid assigning untrusted data to innerHTML/outerHTML or document.write (inner-outer-html) [warning] 17-17: Avoid using the initial state variable in setState (setstate-same-var) [warning] 57-57: Avoid using the initial state variable in setState (setstate-same-var) [warning] 57-57: Avoid using the initial state variable in setState (setstate-same-var) [warning] 64-64: Avoid hand-rolled HTML escaping (replacing characters with HTML entities); use a vetted encoder/sanitizer such as DOMPurify or sanitize-html. (manual-sanitization) [warning] 57-57: Detects non-literal values in regular expressions (detect-non-literal-regexp) 📝 WalkthroughWalkthroughThe light-theme primary and ring tokens now use lower lightness. Accessibility tests improve mobile setup and focus checks. Theme-toggle tests use explicit controls and condition-based persistence checks. ChangesTheme and end-to-end validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
1 participant
Summary by CodeRabbit
Style
Tests