docs: new hero banner + awesome-copilot submission tracking - #24
Conversation
📝 WalkthroughWalkthroughThe README now displays a new Version Sentinel hero image. A standalone hero page defines the branding and verification visual. Marketplace documentation now includes GitHub Copilot CLI submission and validation details. ChangesVersion Sentinel branding
GitHub Copilot CLI marketplace documentation
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@assets/hero.html`:
- Around line 146-150: Update the lodash example in assets/hero.html to use
version 4.18.1 consistently, including the displayed latest version and
installation command. Replace the recording step with the documented bash
scripts/vs-record.sh workflow using lodash 4.18.1 and the source URL, then
regenerate assets/hero.png so the README-rendered image matches.
In `@docs/marketplaces.md`:
- Around line 151-154: Update the local gate-rehearsal procedure in the
marketplace documentation to add the required upstream version verification and
corresponding bash scripts/vs-record.sh record before npm install, using the
appropriate ecosystem, package, version, and source URL. Make the working
directory explicit by instructing the user to run the commands from the cloned
awesome-copilot directory, while preserving the existing quality-gate command.
- Around line 149-150: Update the six-month re-review description in the
marketplace documentation to state that the nightly job marks approved listings
as due for re-review, while a maintainer performs the review on the original
issue. Preserve the existing timing and maintainer-command details.
🪄 Autofix
✅ Autofix completed
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 5e4d3cf8-79b3-43ff-aa37-28eb2be4e822
⛔ Files ignored due to path filters (1)
assets/hero.pngis excluded by!**/*.png
📒 Files selected for processing (3)
README.mdassets/hero.htmldocs/marketplaces.md
| <div class="cmd"><span class="prompt">$</span> npm install lodash@4.17.20</div> | ||
| <div class="blocked">✗ BLOCKED version-sentinel — no fresh version check on record</div> | ||
| <div class="muted">→ lookup npmjs.com/package/lodash · latest 4.17.21</div> | ||
| <div class="rec">→ vs-record npm lodash 4.17.21 <source-url></div> | ||
| <div class="ok">✓ VERIFIED — install allowed</div> |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
curl -fsSL https://registry.npmjs.org/lodash | jq -r '."dist-tags".latest'Repository: KSEGIT/Version-Sentinel
Length of output: 168
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== locate relevant files =="
git ls-files | grep -E '(^assets/hero\.html$|(^README\.md$|(^scripts/vs-record\.sh$))' || true
echo "== inspect assets/hero.html around relevant lines =="
sed -n '130,160p' assets/hero.html
echo "== inspect scripts/vs-record.sh if present =="
if [ -f scripts/vs-record.sh ]; then
sed -n '1,120p' scripts/vs-record.sh
else
echo "scripts/vs-record.sh not found"
fi
echo "== references to recorded lodash version and vs-record command in repo =="
rg -n "lodash@4\.17\.20|lodash@4\.17\.21|lodash@4\.18\.1|vs-record|version-sentinel|latest 4\.17" .Repository: KSEGIT/Version-Sentinel
Length of output: 34683
Use the current lodash version and the required recording command.
The flow shows latest 4.17.21, but npm marks 4.18.1 as latest. Use npm install lodash@4.18.1 for the requested version, and replace vs-record npm lodash 4.17.21 with bash scripts/vs-record.sh npm lodash 4.18.1 <source-url> so the example matches the documented workflow. Regenerate assets/hero.png because README.md renders it.
Proposed fix
- <div class="cmd"><span class="prompt">$</span> npm install lodash@4.17.20</div>
+ <div class="cmd"><span class="prompt">$</span> npm install lodash@4.18.1</div>
<div class="blocked">✗ BLOCKED version-sentinel — no fresh version check on record</div>
- <div class="muted">→ lookup npmjs.com/package/lodash · latest 4.17.21</div>
- <div class="rec">→ vs-record npm lodash 4.17.21 <source-url></div>
+ <div class="muted">→ lookup npmjs.com/package/lodash · latest 4.18.1</div>
+ <div class="rec">→ bash scripts/vs-record.sh npm lodash 4.18.1 <source-url></div>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| <div class="cmd"><span class="prompt">$</span> npm install lodash@4.17.20</div> | |
| <div class="blocked">✗ BLOCKED version-sentinel — no fresh version check on record</div> | |
| <div class="muted">→ lookup npmjs.com/package/lodash · latest 4.17.21</div> | |
| <div class="rec">→ vs-record npm lodash 4.17.21 <source-url></div> | |
| <div class="ok">✓ VERIFIED — install allowed</div> | |
| <div class="cmd"><span class="prompt">$</span> npm install lodash@4.18.1</div> | |
| <div class="blocked">✗ BLOCKED version-sentinel — no fresh version check on record</div> | |
| <div class="muted">→ lookup npmjs.com/package/lodash · latest 4.18.1</div> | |
| <div class="rec">→ bash scripts/vs-record.sh npm lodash 4.18.1 <source-url></div> | |
| <div class="ok">✓ VERIFIED — install allowed</div> |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@assets/hero.html` around lines 146 - 150, Update the lodash example in
assets/hero.html to use version 4.18.1 consistently, including the displayed
latest version and installation command. Replace the recording step with the
documented bash scripts/vs-record.sh workflow using lodash 4.18.1 and the source
URL, then regenerate assets/hero.png so the README-rendered image matches.
Source: Coding guidelines
| - After approval, a nightly job re-reviews listings every six months on the | ||
| original issue (`/re-review-keep` et al. are maintainer commands). |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Correct the six-month re-review description.
The nightly job does not perform the re-review. It identifies approved listings that are due and opens or updates a tracking issue. A maintainer then completes the review on the original issue. (raw.githubusercontent.com)
Change “nightly job re-reviews listings” to “nightly job marks listings due for re-review”.
Proposed wording
-After approval, a nightly job re-reviews listings every six months on the
-original issue (`/re-review-keep` et al. are maintainer commands).
+After approval, a nightly job marks listings due for six-month re-review and
+opens or updates a tracking issue. Maintainers complete the review on the
+original issue (`/re-review-keep` et al. are maintainer commands).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/marketplaces.md` around lines 149 - 150, Update the six-month re-review
description in the marketplace documentation to state that the nightly job marks
approved listings as due for re-review, while a maintainer performs the review
on the original issue. Preserve the existing timing and maintainer-command
details.
Source: MCP tools
| - The gates can be rehearsed locally before any resubmission: clone | ||
| awesome-copilot, `npm install`, and run | ||
| `node eng/external-plugin-quality-gates.mjs --plugin-json '<entry json>'` | ||
| with `copilot` on PATH (`@github/copilot` npm package). |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Document the required version-audit step before npm install.
This procedure runs an install command without the required upstream-version verification and vs-record.sh record when Version Sentinel blocks the command. The intake notes confirm that Version Sentinel blocks install commands until a fresh, source-cited check is recorded. (github.com)
Add the preflight step before npm install, and make the working directory explicit.
As per coding guidelines, dependency install commands require upstream version verification and a bash scripts/vs-record.sh <ecosystem> <pkg> <version> <source-url> record when blocked.
Proposed wording
-clone awesome-copilot, `npm install`, and run
+clone awesome-copilot, verify dependency versions against their upstream
+registries, record blocked targets with
+`bash scripts/vs-record.sh <ecosystem> <pkg> <version> <source-url>`, then run
+`npm install` and🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/marketplaces.md` around lines 151 - 154, Update the local gate-rehearsal
procedure in the marketplace documentation to add the required upstream version
verification and corresponding bash scripts/vs-record.sh record before npm
install, using the appropriate ecosystem, package, version, and source URL. Make
the working directory explicit by instructing the user to run the commands from
the cloned awesome-copilot directory, while preserving the existing quality-gate
command.
Sources: Coding guidelines, MCP tools
Fixes Applied SuccessfullyFixed 2 file(s) based on 3 unresolved review comments. Files modified:
Commit: The changes have been pushed to the Time taken: |
Fixed 2 file(s) based on 3 unresolved review comments. Co-authored-by: CodeRabbit <noreply@coderabbit.ai>
1 participant
What
assets/hero.png, 1536×768, 359KB — down from 1.3MB): mission-control layout with the real guardrail workflow in a terminal (BLOCKED→ registry lookup →vs-record→VERIFIED), the shield+magnifier mark in a glowing ring, and npm/PyPI/Cargo/NuGet orbit pills. Rendered from hand-built HTML (assets/hero.html, kept as the editable source), so the terminal text is accurate — the old AI-generated hero had garbled log lines baked in.<h1>removed.ready-for-review), including thesource.path: /intake gotcha and how to rehearse their quality gates locally.Test plan
assets/hero.png), renders on GitHubSummary by CodeRabbit
New Features
Documentation