security: clear GitHub alerts and refresh tooling - #233
Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe PR updates CodeQL suppression guidance, upgrades Biome and the release workflow action, and reformats three parameterized tests without changing test behavior. ChangesMaintenance updates
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR updates developer/security tooling and repository guidance to reflect current CodeQL behavior, while keeping the Bun dependency graph reproducible.
Changes:
- Bump Biome from
2.5.2→2.5.6, updatingpackage.json,bun.lock, andbiome.jsonschema in lockstep. - Update
actions/setup-nodein the release workflow fromv6→v7. - Reword security guidance to explicitly discourage relying on inline
codeql[...]/lgtm[...]suppression comments, based on observed CodeQL behavior.
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
test/unit/explain-write.test.ts |
Formatting-only tweak to the test.each invocation (no logic change). |
test/unit/explain-args.test.ts |
Formatting-only tweaks to multi-line test.each cases (no logic change). |
package.json |
Bumps @biomejs/biome to 2.5.6. |
bun.lock |
Updates the lockfile to match the Biome bump and platform CLI package versions. |
biome.json |
Updates Biome schema URL to 2.5.6 to match the pinned Biome version. |
.github/workflows/release.yaml |
Updates actions/setup-node to v7 for the publish workflow. |
.github/instructions/github-security-quality.instructions.md |
Updates CodeQL guidance to reflect that inline suppressions should not be relied upon. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yaml:
- Line 104: Update the actions/setup-node step in the release workflow to
reference a full, immutable commit SHA instead of the mutable v7 tag, while
preserving the existing setup-node configuration and registry-credential flow.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 26032f2b-3131-4e3e-ba81-b0568a5da703
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (6)
.github/instructions/github-security-quality.instructions.md.github/workflows/release.yamlbiome.jsonpackage.jsontest/unit/explain-args.test.tstest/unit/explain-write.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (2)
- GitHub Check: copilot-pull-request-reviewer
- GitHub Check: CHR smoke (stable)
🧰 Additional context used
📓 Path-based instructions (4)
{docs/**,.github/instructions/**,.github/**/*.yml,.github/**/*.yaml,**/*.{md,txt,dict}}
📄 CodeRabbit inference engine (AGENTS.md)
Run
bun run lint:ciwhen changing documentation, instructions, security configuration, spelling dictionaries, or workflow files.
Files:
.github/workflows/release.yaml.github/instructions/github-security-quality.instructions.md
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx}: Transport or RouterOS-touching code is not done untilbun run test:integrationpasses.
Do not silently fall back to another protocol when the caller pinned--via.
Do not make generated output the hand-edited source of truth.
Do not disable validation to make a test pass; validation is part of the product.
Files:
test/unit/explain-write.test.tstest/unit/explain-args.test.ts
.github/instructions/*.instructions.md
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Store Copilot's path-specific durable instructions in
.github/instructions/*.instructions.mdfiles usingapplyTofront matterWhen an issue requires an instruction file, read that file directly; otherwise consult the instruction map to identify applicable path-scoped rules.
Files:
.github/instructions/github-security-quality.instructions.md
.github/instructions/github-security-quality.instructions.md
📄 CodeRabbit inference engine (AGENTS.md)
Follow
.github/instructions/github-security-quality.instructions.mdfor security-sensitive code and quality surfaces.
Files:
.github/instructions/github-security-quality.instructions.md
🪛 LanguageTool
.github/instructions/github-security-quality.instructions.md
[uncategorized] ~36-~36: The official name of this software platform is spelled with a capital “H”.
Context: ...us its written audit justification. A .github/codeql-config.yml query-filter is the ...
(GITHUB)
🪛 zizmor (1.29.0)
.github/workflows/release.yaml
[error] 104-104: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 104-104: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default
(cache-poisoning)
🔇 Additional comments (5)
biome.json (1)
2-2: LGTM!package.json (1)
15-15: LGTM!test/unit/explain-args.test.ts (1)
392-411: LGTM!Also applies to: 485-501
test/unit/explain-write.test.ts (1)
419-425: LGTM!.github/instructions/github-security-quality.instructions.md (1)
29-37: LGTM!
Summary
Why
The Security tab had five shared-parser clear-text logging over-taints plus one intentional maintainer-cache network-to-file finding. Each was reviewed through its SARIF flow and dismissed with an audit justification. A PR experiment then proved that both codeql and legacy lgtm inline comments were ignored even on exact sink lines, so the source stays stable to preserve the audited fingerprints and the repo guidance now records that evidence.
Separately, Dependabot PR #178 changed package.json without bun.lock or the matching Biome schema/formatter changes, while PR #229 could not receive a substantive CodeRabbit review because the repo intentionally ignores Dependabot-authored PRs. This human-authored replacement keeps the Bun dependency graph reproducible and allows the normal review gates to run.
Supersedes #178 and #229.
Validation
RouterOS transport behavior is unchanged; no new CHR integration evidence is required for this maintenance patch.
Summary by CodeRabbit
Documentation
Chores
Tests