Skip to content

release: dev → staging (symlink fix + audit features)#230

Merged
himerus merged 11 commits intostagingfrom
dev
Mar 27, 2026
Merged

release: dev → staging (symlink fix + audit features)#230
himerus merged 11 commits intostagingfrom
dev

Conversation

@himerus
Copy link
Copy Markdown
Contributor

@himerus himerus commented Mar 27, 2026

Summary

  • Critical fix: Remove self-referential build and node_modules symlinks from git tracking (root cause of ALL CI failures on staging since PR fix: wire scaffold_component and extend_component into MCP server #207)
  • Harden .gitignore: Changed build/ and node_modules/ to build and node_modules (matches both files and symlinks)
  • Audit features: Security patches (dep overrides, error path redaction, CODEOWNERS), SBOM generation, CODE_OF_CONDUCT.md, npm files cleanup
  • Formatting: Fixed prettier inconsistencies across 24 agent-committed files
  • Lint fixes: Removed unused imports, fixed scaffold.ts variable name typo

Test plan

  • CI passes on this PR (the symlink fix should unblock all checks)
  • pnpm audit --audit-level=high shows reduced vulnerabilities
  • pnpm run build && pnpm test pass clean

🤖 Generated with Claude Code

himerus and others added 11 commits March 26, 2026 19:37
Add scaffold_component and extend_component to the expected coreTools
list. These tools were wired into the MCP server in PR #207 but the
test assertion was never updated, causing CI failures on all subsequent PRs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…-count-badge-in-readme

fix: correct tool count badge in README (73 → actual count)
Generates sbom.json during each publish run using @cyclonedx/cyclonedx-npm,
uploads it as a GitHub Actions artifact for enterprise compliance audits.
Adds sbom.json to .gitignore and documents availability in README.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…ration-to-publish

ci: add SBOM generation to publish workflow
…ute-file-paths-from-mcp

sec: redact absolute file paths from MCP error messages
packages/core/src was included in the files array but all exports already
point to compiled build/ paths, making source inclusion redundant. Removing
it reduces unpacked package size by ~94% (806 kB → 54 kB). src/skills is
retained as it ships the update-helixir Claude Code skill to end users.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
…-tighten-packagejson

chore: review and tighten package.json files field for npm publish
…config)

The handleScaffoldCall function parameter is named _config but the catch
block referenced config without underscore prefix, causing TS2552.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove build and node_modules symlinks from git tracking (committed
  by scaffold_component agent in 4c91c99, root cause of all ELOOP errors)
- Change .gitignore from build/ and node_modules/ (directory-only) to
  build and node_modules (matches both files and directories)
- Fix prettier formatting across 24 agent-committed files
- Fix unused imports in mixin-resolver.test.ts, source-accessibility.test.ts
- Fix scaffold.ts error handler variable name (_config not config)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Mar 27, 2026

Important

Review skipped

Ignore keyword(s) in the title.

⛔ Ignored keywords (4)
  • AUDIT
  • audit
  • Deep Audit
  • deep-audit

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 58cf7d7e-0929-4191-b9ee-784de2d33ec7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dev

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@himerus himerus merged commit 96cdef4 into staging Mar 27, 2026
9 of 20 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant