chore: complete Genesis foundation hardening - #18
Conversation
|
Warning Review limit reached
Next review available in: 42 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (4)
📝 WalkthroughWalkthroughThe PR updates repository ownership and dependency monitoring. It adds tagged release packaging and publication. It also adds scheduled and event-driven SBOM generation, dependency audits, and secret scanning. ChangesRepository automation
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant ReleaseWorkflow
participant BuildTools
participant ReleaseStaging
participant GitHubRelease
ReleaseWorkflow->>BuildTools: configure build tools
ReleaseWorkflow->>BuildTools: validate and publish services
BuildTools->>ReleaseStaging: provide build outputs
ReleaseWorkflow->>ReleaseStaging: create archive, checksum, and SBOM
ReleaseStaging->>GitHubRelease: publish release artifacts
Possibly related issues
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
🤖 Hi @AcingTime420, I've received your request, and I'm working on it now! You can track my progress in the logs for more details. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Line 75: Update the release workflow to build Guardian before staging
artifacts, then make the out/guardian.jar check mandatory: fail the job when the
file is absent and copy it into release/ when present. Remove the conditional
copy behavior around the Guardian artifact.
- Line 17: Pin every GitHub Actions uses entry to its reviewed full commit SHA
and retain the existing version tag as an adjacent comment. Apply this to
.github/workflows/release.yml at 17-17, 22-22, 27-27, 34-34, 80-80, and 88-88;
.github/workflows/sbom.yml at 25-25, 27-27, and 34-34; and
.github/workflows/security.yml at 28-28, 30-30, 39-39, 41-41, 64-64, 66-66,
81-81, and 85-85. Ensure no mutable action version tags remain in these entries.
- Around line 39-46: Update the “Install Kotlin compiler” step to define the
trusted SHA-512 digest for Kotlin 2.0.0, run sha512sum --check against
/tmp/kotlin.zip immediately after downloading it, and only then execute unzip.
Keep the existing Kotlin path setup unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 82fc2f39-004a-4df7-a56b-b7169e9f8991
📒 Files selected for processing (5)
.github/CODEOWNERS.github/dependabot.yml.github/workflows/release.yml.github/workflows/sbom.yml.github/workflows/security.yml
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
for f in .github/workflows/release.yml .github/workflows/sbom.yml .github/workflows/security.yml; do
echo "===== $f ====="
sed -n '1,120p' "$f"
doneRepository: AcingTime420/Acing-IU-Genesis
Length of output: 6601
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
files = [
Path(".github/workflows/release.yml"),
Path(".github/workflows/sbom.yml"),
Path(".github/workflows/security.yml"),
]
for path in files:
text = path.read_text()
print(f"===== {path} =====")
for n, line in enumerate(text.splitlines(), 1):
if "uses:" in line or re.search(r"^\s*(permissions|contents):", line):
print(f"{n}: {line}")
PYRepository: AcingTime420/Acing-IU-Genesis
Length of output: 1158
Pin all 17 listed GitHub Actions to full commit SHAs.
The workflows use mutable version tags. A moved or compromised tag can execute unreviewed code. The release workflow grants these actions contents: write, which increases the impact.
Keep the version tag in a comment beside each reviewed SHA.
📍 Affects 3 files
.github/workflows/release.yml#L17-L17(this comment).github/workflows/release.yml#L22-L22.github/workflows/release.yml#L27-L27.github/workflows/release.yml#L34-L34.github/workflows/release.yml#L80-L80.github/workflows/release.yml#L88-L88.github/workflows/sbom.yml#L25-L25.github/workflows/sbom.yml#L27-L27.github/workflows/sbom.yml#L34-L34.github/workflows/security.yml#L28-L28.github/workflows/security.yml#L30-L30.github/workflows/security.yml#L39-L39.github/workflows/security.yml#L41-L41.github/workflows/security.yml#L64-L64.github/workflows/security.yml#L66-L66.github/workflows/security.yml#L81-L81.github/workflows/security.yml#L85-L85
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 17, Pin every GitHub Actions uses
entry to its reviewed full commit SHA and retain the existing version tag as an
adjacent comment. Apply this to .github/workflows/release.yml at 17-17, 22-22,
27-27, 34-34, 80-80, and 88-88; .github/workflows/sbom.yml at 25-25, 27-27, and
34-34; and .github/workflows/security.yml at 28-28, 30-30, 39-39, 41-41, 64-64,
66-66, 81-81, and 85-85. Ensure no mutable action version tags remain in these
entries.
| - name: Install Kotlin compiler | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| KOTLIN_VERSION="2.0.0" | ||
| curl -fsSL "https://github.com/JetBrains/kotlin/releases/download/v${KOTLIN_VERSION}/kotlin-compiler-${KOTLIN_VERSION}.zip" -o /tmp/kotlin.zip | ||
| unzip -q /tmp/kotlin.zip -d /tmp/kotlin | ||
| echo "/tmp/kotlin/kotlinc/bin" >> "$GITHUB_PATH" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/release.yml
printf '%s\n' '--- related Kotlin references ---'
rg -n -C 3 'KOTLIN|kotlin-compiler|sha256|checksum|actions/checkout|permissions|npm ci' .github README.md 2>/dev/null || true
printf '%s\n' '--- tracked workflow files ---'
git ls-files '.github/workflows/*'Repository: AcingTime420/Acing-IU-Genesis
Length of output: 25815
🏁 Script executed:
#!/bin/bash
set -euo pipefail
release_json="$(curl -fsSL https://api.github.com/repos/JetBrains/kotlin/releases/tags/v2.0.0)"
printf '%s\n' '--- release metadata ---'
printf '%s' "$release_json" | jq -r '.tag_name, .target_commitish, .assets[]?.name'
printf '%s\n' '--- matching asset metadata ---'
printf '%s' "$release_json" |
jq -r '.assets[]? | select(.name | test("kotlin-compiler-2\\.0\\.0|sha256|checksum"; "i")) |
[.name, .browser_download_url, .content_type, .size] | `@tsv`'
printf '%s\n' '--- archive headers ---'
curl -fsSIL https://github.com/JetBrains/kotlin/releases/download/v2.0.0/kotlin-compiler-2.0.0.zip |
sed -n '1,20p'Repository: AcingTime420/Acing-IU-Genesis
Length of output: 218
🌐 Web query:
JetBrains Kotlin v2.0.0 GitHub release kotlin-compiler-2.0.0.zip SHA-256 checksum
💡 Result:
The SHA-256 checksum for the kotlin-compiler-2.0.0.zip file, as officially distributed in the Gentoo Linux repository records for the Kotlin 2.0.0 release, is ca723146188a60a995089d4b06bb23c83bfb2dbaabbbad632921601babbccddf4e3f0519692018480b7a0a7a1d0ce3002dcb6f4a445dc2dfa2a2b8f4e39364c7 [1][2]. While the JetBrains GitHub release page [3] serves as the primary source for the release, individual asset checksum files were not explicitly displayed for this specific compiler zip in the search results. The checksum provided above is verified through the official Manifest files maintained by the Gentoo project, which pull directly from the official JetBrains distribution source at https://github.com/JetBrains/kotlin/releases/download/v2.0.0/kotlin-compiler-2.0.0.zip [4][2].
Citations:
- 1: https://archives.gentoo.org/gentoo-commits/1725389076.17f4805491905a9bbca1f1cdffc8367dcb729743.xgqt@gentoo/
- 2: https://archives.gentoo.org/gentoo-commits/1716645956.906243f3567f401fa121218705be637be28dbcc0.xgqt@gentoo/t/
- 3: https://github.com/JetBrains/kotlin/releases/tag/v2.0.0
- 4: https://archives.gentoo.org/gentoo-commits/1725389076.17f4805491905a9bbca1f1cdffc8367dcb729743.xgqt@gentoo/t/
🏁 Script executed:
#!/bin/bash
set -euo pipefail
python3 - <<'PY'
digest = "ca723146188a60a995089d4b06bb23c83bfb2dbaabbbad632921601babbccddf4e3f0519692018480b7a0a7a1d0ce3002dcb6f4a445dc2dfa2a2b8f8e39364c7"
print("digest_hex_length:", len(digest))
print("algorithm_by_hex_length:", {64: "SHA-256", 96: "SHA-384", 128: "SHA-512"}.get(len(digest), "unknown"))
PY
for url in \
'https://archives.gentoo.org/gentoo-commits/1716645956.906243f3567f401fa121218705be637be28dbcc0.xgqt@gentoo/t/' \
'https://archives.gentoo.org/gentoo-commits/1725389076.17f4805491905a9bbca1f1cdffc8367dcb729743.xgqt@gentoo/'; do
printf '\n--- %s ---\n' "$url"
curl -fsSL "$url" | sed -n '1,240p' | grep -i -C 3 -E 'kotlin|compiler-2\.0\.0|Manifest|SHA|BLAKE' || true
done
printf '\n--- release page asset references ---\n'
curl -fsSL 'https://github.com/JetBrains/kotlin/releases/tag/v2.0.0' |
grep -oE 'kotlin-compiler-2\.0\.0[^" <]*|[^" <]*(sha256|checksum)[^" <]*' |
sort -u || trueRepository: AcingTime420/Acing-IU-Genesis
Length of output: 12379
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- validation script references ---'
rg -n -C 5 'kotlinc|kotlin|guardian|java|gradle|compile|\.jar' scripts/validate-premerge.sh scripts .github/workflows/ci.yml 2>/dev/null || true
printf '%s\n' '--- validation script structure ---'
if command -v ast-grep >/dev/null 2>&1; then
ast-grep outline scripts/validate-premerge.sh
fiRepository: AcingTime420/Acing-IU-Genesis
Length of output: 6454
Verify the Kotlin compiler archive before extraction.
Use a trusted SHA-512 digest for Kotlin 2.0.0 and run sha512sum --check before unzip. The validation script invokes kotlinc, so an altered archive can execute on the release runner.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml around lines 39 - 46, Update the “Install
Kotlin compiler” step to define the trusted SHA-512 digest for Kotlin 2.0.0, run
sha512sum --check against /tmp/kotlin.zip immediately after downloading it, and
only then execute unzip. Keep the existing Kotlin path setup unchanged.
| if [[ -d frontend/public ]]; then cp -R frontend/public release/frontend/public; fi | ||
| cp -R docs/irp release/docs/irp | ||
| cp README.md SECURITY.md RELEASE_PROCESS.md release/ | ||
| if [[ -f out/guardian.jar ]]; then cp out/guardian.jar release/; fi |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Require the Guardian artifact before publication.
Line 75 permits a release without guardian.jar. The release artifact contract requires this file.
Build Guardian in this workflow. Then fail the job if out/guardian.jar is absent before staging release files.
Proposed safeguard
- if [[ -f out/guardian.jar ]]; then cp out/guardian.jar release/; fi
+ test -f out/guardian.jar
+ cp out/guardian.jar release/📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if [[ -f out/guardian.jar ]]; then cp out/guardian.jar release/; fi | |
| test -f out/guardian.jar | |
| cp out/guardian.jar release/ |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/release.yml at line 75, Update the release workflow to
build Guardian before staging artifacts, then make the out/guardian.jar check
mandatory: fail the job when the file is absent and copy it into release/ when
present. Remove the conditional copy behavior around the Guardian artifact.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c1850d076f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| pull_request: | ||
| branches: [master] | ||
| push: | ||
| branches: [master] |
There was a problem hiding this comment.
The repository uses main as its integration branch (CONTRIBUTING.md:61 and RELEASE_PROCESS.md:61), so these master filters prevent this workflow from running for normal pull requests and pushes. In particular, the dependency-review job is restricted to pull_request events and therefore never provides its high-severity gate for PRs targeting main; change both filters to main.
Useful? React with 👍 / 👎.
| pull_request: | ||
| branches: [master] | ||
| push: | ||
| branches: [master] |
There was a problem hiding this comment.
These filters target master, while development and releases use main, so ordinary PRs and pushes never generate or retain the promised SBOM artifact. Scheduled and manual runs still work, but they do not provide an SBOM for the commit being reviewed or merged; target main here.
Useful? React with 👍 / 👎.
| if [[ -d frontend/public ]]; then cp -R frontend/public release/frontend/public; fi | ||
| cp -R docs/irp release/docs/irp | ||
| cp README.md SECURITY.md RELEASE_PROCESS.md release/ | ||
| if [[ -f out/guardian.jar ]]; then cp out/guardian.jar release/; fi |
There was a problem hiding this comment.
On every tag build, validate-premerge.sh runs make inside system/security/guardian/build, whose Makefile writes guardian.jar and the boot scripts beneath system/security/guardian/build/out/ (Makefile:20-30). The checked out/guardian.jar path therefore never exists, and the conditional silently publishes a release archive without Guardian; stage the actual output directory, including its required scripts.
Useful? React with 👍 / 👎.
| uses: anchore/sbom-action@v0 | ||
| with: | ||
| path: . |
There was a problem hiding this comment.
On scheduled/manual runs (and after the branch filters are corrected), this job checks out the source tree and immediately scans it, but the reviewed tree contains only .csproj PackageReference declarations and no project.assets.json, .deps.json, or NuGet lock files. Without restoring or building first, the filesystem scan cannot resolve the backend's transitive NuGet dependency graph, so the published SBOM silently omits those packages; restore/build the solution and include its generated dependency metadata in the scan.
Useful? React with 👍 / 👎.
| uses: softprops/action-gh-release@v2 | ||
| with: | ||
| generate_release_notes: true | ||
| fail_on_unmatched_files: true |
There was a problem hiding this comment.
When the documented vX.Y.Z-rc.1 tag is pushed, it matches this workflow's tag pattern, but the release action is not given prerelease: true, so it creates an ordinary GitHub Release rather than a prerelease. That can present an RC as the latest stable release to users; derive the prerelease flag from the tag or use separate RC and stable publication paths.
Useful? React with 👍 / 👎.
| tags: | ||
| - "v*.*.*" |
There was a problem hiding this comment.
The v*.*.* ref glob is not a SemVer validator: tags such as vfoo.bar.baz or v1.2.3-extra.parts also match and proceed directly to publication. Because the repository's release policy requires SemVer tags, an accidental malformed tag can create a public release and assets under an invalid version; add an explicit strict SemVer check before packaging or narrow the release trigger.
Useful? React with 👍 / 👎.
| - name: Validate repository | ||
| run: bash scripts/validate-premerge.sh --skip-compose |
There was a problem hiding this comment.
When a tag points to a commit that has not already passed branch CI, this job can publish it after compilation alone: validate-premerge.sh only builds Guardian, while the later steps publish the APIs and build Next.js without running the two unit-test projects included in backend/AcingIU.sln. A commit with failing behavioral tests but compilable code therefore becomes a release; run dotnet test here or make publication depend on a verified successful CI run for the tagged SHA.
Useful? React with 👍 / 👎.
| cp -R frontend/.next release/frontend/.next | ||
| cp frontend/package.json frontend/package-lock.json release/frontend/ |
There was a problem hiding this comment.
When a user extracts the release and runs the packaged npm start, it fails because the archive contains .next and the manifests but no node_modules, so the next executable and all runtime dependencies are absent. The existing production Dockerfile explicitly copies node_modules alongside .next for this reason; package production dependencies as well, or configure Next.js standalone output and stage that runnable bundle.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 975cf8f27b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| on: | ||
| push: | ||
| tags: | ||
| - "v*.*.*" |
There was a problem hiding this comment.
When an unsigned or lightweight stable tag such as v1.2.3 is pushed, this workflow publishes it without verifying a signature. This bypasses the release provenance requirement documented in RELEASE_PROCESS.md:55,67, allowing a mistaken or unauthorized unsigned tag to become a public release; verify the tag signature before packaging and publishing.
Useful? React with 👍 / 👎.
1 participant
Summary
Completes the remaining work tracked in Issue #3 after the Genesis IRP v1.3.1 foundation merge.
Changes
Existing work confirmed
Validation required
Addresses #3.
Summary by CodeRabbit
New Features
Chores