chore(standards): synced file(s) with hallelx2/dev-standards - #5
Open
hallelx2 wants to merge 10 commits into
Open
chore(standards): synced file(s) with hallelx2/dev-standards#5hallelx2 wants to merge 10 commits into
hallelx2 wants to merge 10 commits into
Conversation
📝 WalkthroughWalkthroughAdded shared review standards, specialized agent configurations, automated security scanning workflows, conditional pull-request security reviews, and updated Dependabot schedules. ChangesReview and security automation
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideAdds shared AI agent standards, review rubrics, and reusable security/Jules review GitHub workflows by syncing them from hallelx2/dev-standards, enabling consistent automated reviews and security scanning across the repo. Sequence diagram for automated Jules PR security review workflowsequenceDiagram
actor Developer
participant GitHub
participant jules_review_workflow as jules-review.yml
participant Guard_step as Guard_only_run_when_a_Jules_key_is_configured
participant Jules_action as sanjay3290/jules-pr-reviewer@main
Developer->>GitHub: open/synchronize/ready_for_review PR
GitHub->>jules_review_workflow: trigger pull_request event
jules_review_workflow->>Guard_step: run guard step
alt JULES_API_KEY present
Guard_step-->>jules_review_workflow: enabled=true
jules_review_workflow->>Jules_action: run Jules security review
Jules_action-->>GitHub: post security-focused PR review
else JULES_API_KEY missing
Guard_step-->>GitHub: log skipping message
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- In
.github/workflows/security.reusable.yml, consider pinningsecurego/gosec@masterto a specific release tag or SHA to avoid unexpected behavior when themasterbranch changes. - Similarly, in
.github/workflows/jules-review.yml, usingsanjay3290/jules-pr-reviewer@maincould introduce breaking changes over time; pinning to a version or commit SHA would make the workflow more stable and auditable.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In `.github/workflows/security.reusable.yml`, consider pinning `securego/gosec@master` to a specific release tag or SHA to avoid unexpected behavior when the `master` branch changes.
- Similarly, in `.github/workflows/jules-review.yml`, using `sanjay3290/jules-pr-reviewer@main` could introduce breaking changes over time; pinning to a version or commit SHA would make the workflow more stable and auditable.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
There was a problem hiding this comment.
Pull request overview
This PR syncs shared engineering standards and GitHub automation from hallelx2/dev-standards into this repository, establishing consistent AI-agent guidance and baseline security/review workflows.
Changes:
- Adds repo-level agent/review standards (
AGENTS.md) and Copilot review baseline instructions. - Introduces path-scoped review rubrics and specialized agent profiles under
.github/instructions/and.github/agents/. - Adds security scanning and optional “Jules” automated review workflows under
.github/workflows/.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
| AGENTS.md | Adds shared engineering/review standards for human + AI agents. |
| .github/copilot-instructions.md | Adds baseline Copilot PR review rubric and priorities. |
| .github/instructions/backend.instructions.md | Adds Go-specific review checklist for .go files. |
| .github/instructions/frontend.instructions.md | Adds TypeScript/Next/CSS review checklist for frontend files. |
| .github/instructions/security.instructions.md | Adds universal security review checklist applied to all files. |
| .github/agents/backend-reviewer.agent.md | Defines a specialized backend reviewer agent profile. |
| .github/agents/frontend-reviewer.agent.md | Defines a specialized frontend reviewer agent profile. |
| .github/agents/security-reviewer.agent.md | Defines an adversarial security reviewer agent profile. |
| .github/agents/test-reliability-reviewer.agent.md | Defines a test/reliability reviewer agent profile. |
| .github/workflows/security.yml | Adds a caller workflow that runs the shared security reusable workflow on PRs and main pushes. |
| .github/workflows/security.reusable.yml | Adds reusable security scanners (gitleaks, Trivy, gosec) for consistent cross-repo scanning. |
| .github/workflows/jules-review.yml | Adds optional automated Jules security review workflow gated on JULES_API_KEY. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+21
to
+22
| uses: ./.github/workflows/security.reusable.yml | ||
| secrets: inherit |
Comment on lines
+23
to
+26
| - name: gitleaks | ||
| uses: gitleaks/gitleaks-action@v2 | ||
| env: | ||
| GITHUB_TOKEN: ${{ github.token }} |
Comment on lines
+33
to
+35
| - name: Trivy filesystem scan | ||
| uses: aquasecurity/[email protected] | ||
| with: |
Comment on lines
+52
to
+56
| - name: gosec | ||
| if: steps.detect.outputs.is_go == 'true' | ||
| uses: securego/gosec@master | ||
| with: | ||
| args: -no-fail -fmt text ./... |
Comment on lines
+30
to
+35
| - name: Jules security review | ||
| if: steps.guard.outputs.enabled == 'true' | ||
| uses: sanjay3290/jules-pr-reviewer@main | ||
| with: | ||
| jules-api-key: ${{ secrets.JULES_API_KEY }} | ||
| github-token: ${{ github.token }} |
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
2 times, most recently
from
June 13, 2026 02:20
fc89bdd to
21ae366
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
5 times, most recently
from
June 15, 2026 11:50
6f0b3aa to
0f70703
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
2 times, most recently
from
June 29, 2026 10:27
3c981ce to
29107cc
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
July 6, 2026 07:30
29107cc to
a84e2cf
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Install Trivy (latest binary — avoids the action's broken setup-trivy pin) | ||
| run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin |
| # Local reference — the reusable file is synced into THIS repo too, so each repo | ||
| # is self-contained and this works whether dev-standards is public or private. | ||
| uses: ./.github/workflows/security.reusable.yml | ||
| secrets: inherit |
Comment on lines
+6
to
+10
| - package-ecosystem: github-actions | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| labels: [dependencies, security] |
Comment on lines
+19
to
+24
| - package-ecosystem: npm | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 5 | ||
| commit-message: | ||
| prefix: "ci" | ||
| include: scope | ||
| labels: [dependencies, security] |
| name: Secrets (gitleaks) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| name: Node/TS deps (npm audit) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| id: detect | ||
| run: | | ||
| if [ -f package.json ]; then echo "is_node=true" >> "$GITHUB_OUTPUT"; else echo "is_node=false" >> "$GITHUB_OUTPUT"; fi | ||
| - uses: actions/setup-node@v4 |
| name: Python deps + SAST (pip-audit + bandit) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| id: detect | ||
| run: | | ||
| if ls requirements*.txt pyproject.toml setup.py >/dev/null 2>&1; then echo "is_py=true" >> "$GITHUB_OUTPUT"; else echo "is_py=false" >> "$GITHUB_OUTPUT"; fi | ||
| - uses: actions/setup-python@v5 |
| name: Vulns + misconfig (Trivy) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
3 times, most recently
from
July 13, 2026 08:54
5039b38 to
4cd357d
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
July 20, 2026 08:44
4cd357d to
24d8294
Compare
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
July 27, 2026 09:36
24d8294 to
9510c62
Compare
added 3 commits
August 3, 2026 09:30
Synced AI-review standards from hallelx2/dev-standards.
…m remote '.github/copilot-instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…b/agents/' Synced AI-review standards from hallelx2/dev-standards.
added 7 commits
August 3, 2026 09:30
…tions.md' from remote '.github/instructions/backend.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…ctions.md' from remote '.github/instructions/frontend.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…ctions.md' from remote '.github/instructions/security.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
… remote '.github/workflows/security.yml' Synced AI-review standards from hallelx2/dev-standards.
…yml' from remote '.github/workflows/security.reusable.yml' Synced AI-review standards from hallelx2/dev-standards.
…from remote '.github/workflows/jules-review.yml' Synced AI-review standards from hallelx2/dev-standards.
….github/dependabot.yml' Synced AI-review standards from hallelx2/dev-standards.
hallelx2
force-pushed
the
repo-sync/dev-standards/default
branch
from
August 3, 2026 09:31
9510c62 to
ec38521
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/security.reusable.yml:
- Around line 37-52: Make the security workflow fail when scanners detect
vulnerabilities or cannot complete: in .github/workflows/security.reusable.yml
lines 37-52 remove Semgrep’s || true while retaining if: always() and stop
suppressing SARIF upload failures; remove || true at lines 67-71 for
govulncheck, remove -no-fail at lines 82-86 for gosec, propagate
dependency-resolution and npm audit failures at lines 101-105, propagate
pip-audit and Bandit failures at lines 120-125, and configure Trivy at lines
134-135 with a non-zero exit code for findings meeting the severity threshold.
- Around line 32-33: Update the container image in the workflow’s container
configuration from the mutable semgrep/semgrep reference to a maintained Semgrep
release pinned by its immutable SHA-256 digest; preserve the existing
container-based workflow behavior.
In `@AGENTS.md`:
- Line 12: Update the “Done” guidance in AGENTS.md to include the repository’s
actual lint command and replace the Go test example with the required go test
-race command, while retaining the build and test requirements. Create and track
a Linear issue before merge, and require all build, race-test, and lint checks
to pass before considering the work complete.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 7bc303ee-cac8-4432-aee4-5fd609b06d47
📒 Files selected for processing (13)
.github/agents/backend-reviewer.agent.md.github/agents/frontend-reviewer.agent.md.github/agents/security-reviewer.agent.md.github/agents/test-reliability-reviewer.agent.md.github/copilot-instructions.md.github/dependabot.yml.github/instructions/backend.instructions.md.github/instructions/frontend.instructions.md.github/instructions/security.instructions.md.github/workflows/jules-review.yml.github/workflows/security.reusable.yml.github/workflows/security.ymlAGENTS.md
Comment on lines
+32
to
+33
| container: | ||
| image: semgrep/semgrep |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Files matching workflow name:\n'
fd -a 'security\.reusable\.yml$' . || true
printf '\nRelevant workflow excerpt:\n'
if [ -f .github/workflows/security.reusable.yml ]; then
nl -ba .github/workflows/security.reusable.yml | sed -n '1,80p'
else
echo '.github/workflows/security.reusable.yml not found'
fi
printf '\nSearch for semgrep image pins and GitHub Actions reusable workflow refs:\n'
rg -n "semgrep/semgrep|uses: .*@|container:|image:" .github/workflows -S || true
printf '\nGit diff stat:\n'
git diff --stat HEAD~1..HEAD 2>/dev/null || git diff --stat || trueRepository: hallelx2/llmgate
Length of output: 252
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Repository root files (top-level):\n'
find . -maxdepth 2 -type f | sort | sed 's#^\./##' | head -150
printf '\nWorkflow file presence:\n'
if [ -f .github/workflows/security.reusable.yml ]; then
echo "FOUND .github/workflows/security.reusable.yml"
else
echo "MISSING .github/workflows/security.reusable.yml"
fi
printf '\nWorkflow excerpt:\n'
if [ -f .github/workflows/security.reusable.yml ]; then
awk '{printf "%5d\t%s\n", NR, $0}' .github/workflows/security.reusable.yml | sed -n '1,120p'
fi
printf '\nSearch for semgrep/semgrep and container image refs:\n'
rg -n 'semgrep/semgrep|uses: .*@|container:|image:' .github/workflows . 2>/dev/null || true
printf '\nChanged workflow files (if available):\n'
git diff --name-only HEAD~1..HEAD 2>/dev/null || trueRepository: hallelx2/llmgate
Length of output: 8010
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Semgrep image ref from workflow:\n'
python3 - <<'PY'
path=".github/workflows/security.reusable.yml"
for i, line in enumerate(open(path), 1):
if "image:" in line:
print(f"{i}: {line.strip()}")
s=line.strip().split("image:",1)[1].strip().split("#",1)[0].strip()
print("ref:", s)
print("has_tag:", ":" in s and "@" not in s.split(":",1)[1])
print("has_digest:", "@" in s)
PY
printf '\nSimilar Docker image refs in .github/workflows:\n'
python3 - <<'PY'
import pathlib,re
for p in pathlib.Path(".github/workflows").glob("*.yml"):
text=p.read_text()
for i,line in enumerate(text.splitlines(),1):
if re.search(r"\bimage:\s*[^#]+#",line) or re.search(r"\bimage:\s*[^#]+$",line):
print(f"{p}:{i}: {line.strip()}")
PYRepository: hallelx2/llmgate
Length of output: 384
🌐 Web query:
semgrep/semgrep Docker image tags latest semgrep version
💡 Result:
The semgrep/semgrep Docker image provides the latest version of Semgrep under the:latest tag [1][2]. To use the latest version, you can pull and run the image using the following commands: docker pull semgrep/semgrep:latest docker run --rm -v "${PWD}:/src" semgrep/semgrep semgrep --version The:latest tag is the standard way to ensure you are running the most recent stable release [2][3]. If you need to pin your configuration to a specific version instead of using:latest, you can use the semantic version tags directly, such as semgrep/semgrep:1.170.0 [4]. For detailed information on image tags, you can view the official Docker Hub repository [1][5]. Additionally, the Semgrep documentation provides guidance on running specific versions in various CI/CD environments if you need to maintain consistency across deployments [4][6].
Citations:
- 1: https://hub.docker.com/r/semgrep/semgrep/tags
- 2: https://docs.semgrep.dev/update
- 3: https://docs.semgrep.dev/getting-started/quickstart
- 4: https://docs.semgrep.dev/kb/semgrep-code/run-specific-version
- 5: https://hub.docker.com/r/semgrep/semgrep
- 6: https://semgrep.dev/docs/deployment/oss-deployment
Pin the Semgrep container to an immutable digest.
semgrep/semgrep without a tag resolves to the mutable latest image from Docker Hub. Use a maintained Semgrep release and pin it with a SHA-256 digest before this step runs with workflow permissions.
Proposed fix
- image: semgrep/semgrep
+ image: semgrep/semgrep:<version>`@sha256`:<verified-manifest-digest>🧰 Tools
🪛 zizmor (1.28.0)
[error] 33-33: unpinned image references (unpinned-images): container image is unpinned
(unpinned-images)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.reusable.yml around lines 32 - 33, Update the
container image in the workflow’s container configuration from the mutable
semgrep/semgrep reference to a maintained Semgrep release pinned by its
immutable SHA-256 digest; preserve the existing container-based workflow
behavior.
Sources: Coding guidelines, Linters/SAST tools
Comment on lines
+37
to
+52
| run: | | ||
| semgrep scan \ | ||
| --config p/owasp-top-ten \ | ||
| --config p/cwe-top-25 \ | ||
| --config p/secrets \ | ||
| --config p/javascript \ | ||
| --config p/typescript \ | ||
| --config p/python \ | ||
| --config p/github-actions \ | ||
| --sarif --output semgrep.sarif || true | ||
| - name: Upload Semgrep SARIF | ||
| if: always() | ||
| uses: github/codeql-action/upload-sarif@v3 | ||
| with: | ||
| sarif_file: semgrep.sarif | ||
| continue-on-error: true |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Make detected vulnerabilities fail the workflow.
All scanners suppress their failure status. The workflow remains green when a scanner detects a vulnerability or cannot complete. This prevents the new security workflow from enforcing its results.
.github/workflows/security.reusable.yml#L37-L52: Remove|| truefrom Semgrep. Keepif: always()for SARIF upload, but do not suppress upload failure..github/workflows/security.reusable.yml#L67-L71: Remove|| truefromgovulncheck..github/workflows/security.reusable.yml#L82-L86: Remove-no-failfrom gosec..github/workflows/security.reusable.yml#L101-L105: Do not ignore failed dependency resolution ornpm audit..github/workflows/security.reusable.yml#L120-L125: Do not ignorepip-auditor Bandit failures..github/workflows/security.reusable.yml#L134-L135: Use a non-zero Trivy exit code when findings meet the configured severity threshold.
As per coding guidelines, “Review changes for correctness, error handling, behavior-proving tests, simplicity, and absence of dead code or over-engineering.”
🧰 Tools
🪛 GitHub Check: Semgrep OSS
[warning] 49-49: Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
📍 Affects 1 file
.github/workflows/security.reusable.yml#L37-L52(this comment).github/workflows/security.reusable.yml#L67-L71.github/workflows/security.reusable.yml#L82-L86.github/workflows/security.reusable.yml#L101-L105.github/workflows/security.reusable.yml#L120-L125.github/workflows/security.reusable.yml#L134-L135
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.reusable.yml around lines 37 - 52, Make the
security workflow fail when scanners detect vulnerabilities or cannot complete:
in .github/workflows/security.reusable.yml lines 37-52 remove Semgrep’s || true
while retaining if: always() and stop suppressing SARIF upload failures; remove
|| true at lines 67-71 for govulncheck, remove -no-fail at lines 82-86 for
gosec, propagate dependency-resolution and npm audit failures at lines 101-105,
propagate pip-audit and Bandit failures at lines 120-125, and configure Trivy at
lines 134-135 with a non-zero exit code for findings meeting the severity
threshold.
Source: Coding guidelines
| - **One issue → one branch → one PR → one outcome.** Use the Linear branch name (`halleluyaholudele/hal-<n>-<title>`). Never commit to `main` directly. | ||
| - Put **`Closes HAL-<n>`** in the **PR description** so Linear links + auto-closes on merge. | ||
| - **No AI attribution** in commits, PRs, or any artifact. Author as the user alone. | ||
| - "Done" = real build + tests + lint pass (run them — `go build ./... && go test ./...`, `bun run build` / `npm run build`), not just typecheck. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- AGENTS.md around lines 1-40 ---\n'
if [ -f AGENTS.md ]; then
cat -n AGENTS.md | sed -n '1,45p'
else
printf 'AGENTS.md not found\n'
fi
printf '\n--- backend.instructions.md around lines 1-15 ---\n'
if [ -f .github/instructions/backend.instructions.md ]; then
cat -n .github/instructions/backend.instructions.md | sed -n '1,15p'
else
printf '.github/instructions/backend.instructions.md not found\n'
fi
printf '\n--- lint-related files and scripts ---\n'
git ls-files | rg '(^AGENTS\.md$|(^\.github/instructions/)|(^package\.json$|(^go\.mod$|(^Makefile$|(^Taskfile\.)|(^lefthook|(^pre-commit|(^.golangci\.|(^biome|(^eslint|(^ox|(^oxlint|(^revive|(^staticcheck|(^golangci|(^vitest|(^jest|(^tslint$))' || true
printf '\n--- package.json scripts if present ---\n'
if [ -f package.json ]; then
cat package.json | jq '.scripts // {}'
fi
printf '\n--- go.mod module path ---\n'
if [ -f go.mod ]; then sed -n '1,10p' go.mod; fiRepository: hallelx2/llmgate
Length of output: 245
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- AGENTS.md around lines 1-40 ---'
if [ -f AGENTS.md ]; then
cat -n AGENTS.md | sed -n '1,45p'
else
echo 'AGENTS.md not found'
fi
printf '\n%s\n' '--- backend.instructions.md around lines 1-15 ---'
if [ -f .github/instructions/backend.instructions.md ]; then
cat -n .github/instructions/backend.instructions.md | sed -n '1,15p'
else
echo '.github/instructions/backend.instructions.md not found'
fi
printf '\n%s\n' '--- lint-related tracked files ---'
git ls-files | rg '(^AGENTS\.md$|(^\.github/instructions/)|(^package\.json$|(^go\.mod$|(^Makefile$|(^Taskfile\.|(^lefthook|(^pre-commit|(^\.golangci\.|(^biome|(^eslint|(^ox|(^oxlint|(^revive|(^staticcheck|(^golangci|(^vitest|(^jest|(^tslint$))' || true
printf '\n%s\n' '--- package.json scripts if present ---'
if [ -f package.json ]; then
jq '.scripts // {}' package.json
fi
printf '\n%s\n' '--- go.mod module path ---'
if [ -f go.mod ]; then
sed -n '1,10p' go.mod
fi
printf '\n%s\n' '--- exact command occurrences ---'
rg -n "go build .*/\.\.\.|go test|go test -race|bun run build|npm run build|lint|task|golangci|biome|oxlint|revive|staticcheck" -S --glob '!node_modules' --glob '!dist' --glob '!build' . || trueRepository: hallelx2/llmgate
Length of output: 5352
Make the completion commands enforce the stated quality bar.
AGENTS.md:12 requires lint and the command examples omit any linter. AGENTS.md:24 also requires go test -race, which this command does not run. Add the repository’s actual lint command and use the Go command from the Go conventions. Track this as a Linear issue before merge so work is complete only after build, tests, and lint pass.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` at line 12, Update the “Done” guidance in AGENTS.md to include the
repository’s actual lint command and replace the Go test example with the
required go test -race command, while retaining the build and test requirements.
Create and track a Linear issue before merge, and require all build, race-test,
and lint checks to pass before considering the work complete.
Source: Coding guidelines
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
synced local file(s) with hallelx2/dev-standards.
Changed files
AGENTS.mdfrom remoteAGENTS.md.github/copilot-instructions.mdfrom remote.github/copilot-instructions.md.github/agents/and copied all sub files/folders from remote directory.github/agents/.github/instructions/backend.instructions.mdfrom remote.github/instructions/backend.instructions.md.github/instructions/frontend.instructions.mdfrom remote.github/instructions/frontend.instructions.md.github/instructions/security.instructions.mdfrom remote.github/instructions/security.instructions.md.github/workflows/security.ymlfrom remote.github/workflows/security.yml.github/workflows/security.reusable.ymlfrom remote.github/workflows/security.reusable.yml.github/workflows/jules-review.ymlfrom remote.github/workflows/jules-review.yml.github/dependabot.ymlwith remote.github/dependabot.ymlThis PR was created automatically by the repo-file-sync-action workflow run #30801469164
Summary by CodeRabbit
New Features
Chores