Workspace update (2026-05-06)

[KooshaPari]

User description

Summary

• Workspace hygiene: linting, concurrency, dependency updates
• CI improvements and security fixes

Test plan

• CI passes on all affected repos
• Tests pass

🤖 Generated with Claude Code

---

Note

High Risk
Touches many GitHub Actions workflows and devcontainer/docker-compose plumbing; small YAML/schema mistakes (e.g., triggers/permissions duplication) could disable CI/CD or alter deployment/rollback behavior. Also shifts several local/dev defaults to required env-based secrets (DB/Grafana/Neo4j), which may break existing setups if not populated.

Overview
Workspace/infra hardening and hygiene. Updates the devcontainer and .devcontainer/docker-compose.yml to pin service images by digest, pin devcontainer feature versions, and switch DB/Grafana/Neo4j credentials to env-driven values (plus updates .env.example to avoid default Grafana creds).

CI/CD workflow refactor. Broadly rewrites many .github/workflows/* files to add concurrency cancellation, explicit timeout-minutes, and pin third-party actions to commit SHAs (plus various trigger/formatting adjustments across CI, CodeQL, contract tests, docs deploy/perf, load tests, chaos tests, dependabot auto-merge, canary deploy, and rollback workflows).

Project process additions. Adds .agileplus/README.md for AgilePlus spec linkage conventions and introduces GitHub issue templates (bug-report, feature-request) plus issue template config with security/discussion links.

^{Reviewed by Cursor Bugbot for commit fdb4e78. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

CodeAnt-AI Description

Harden the app and CI setup while fixing a few user-facing flows

What Changed

• The landing page footer links now send users to login and sign-up pages instead of dead links.
• Local item and link data can now be saved, loaded, listed, and deleted on disk, which supports offline storage and future syncing.
• Production tracing now sends fewer spans, reducing the chance of telemetry overload during normal use.
• The test and deploy workflows now stop overlapping runs, use fixed action versions, and add time limits so CI jobs finish or fail instead of hanging.
• Environment and deployment files now require explicit credentials and avoid public exposure of local monitoring ports.

Impact

✅ Fewer broken footer links
✅ Less trace traffic in production
✅ Fewer stuck CI runs
✅ Safer deployment defaults

🔄 Retrigger CodeAnt AI Review

Details

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

• Documentation

  • Added comprehensive security audit reports and findings documentation.
  • Added project structure README files for crates and tooling directories.

• Security

  • Migrated hardcoded credentials to environment variables across Docker and dev configurations.
  • Updated pre-commit hooks and secret scanning tools.

• Configuration

  • Updated development container and Docker Compose configurations with pinned service versions.
  • Modernized GitHub Actions workflows with updated action versions.

• New Features

  • Added Python database connection management and storage sync capabilities.
  • Introduced chat API handlers for compatibility.