docs: ingest Cloudron 9.1 official AI skills and update docs#2651
docs: ingest Cloudron 9.1 official AI skills and update docs#2651marcusquinn merged 2 commits intomainfrom
Conversation
- Import 3 upstream skills from git.cloudron.io/docs/skills: cloudron-app-packaging-skill, cloudron-app-publishing-skill, cloudron-server-ops-skill (with manifest-ref and addons-ref) - Update cloudron.md with 9.1 features: custom app builds, community packages, passkey auth, OIDC CLI login, MongoDB 8, Redis 8.4, ACME ARI, backup integrity verification - Register all 3 skills in skill-sources.json for update monitoring - Add skills to subagent-index.toon deployment section
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the platform's documentation and capabilities by integrating the latest Cloudron 9.1 features and official AI skills. It provides updated guides for app development, deployment, and server management, ensuring users have access to comprehensive and up-to-date resources for leveraging Cloudron's advanced functionalities. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review infoConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (3)
WalkthroughThis PR registers three new Cloudron skills, adds comprehensive packaging/publishing/server-ops documentation, updates the subagent index, and revises the Cloudron hosting doc to reflect 9.1 features and related skills. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Sun Mar 1 16:09:37 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.agents/tools/deployment/cloudron-server-ops-skill.md (1)
190-196: Use a placeholder token in CI/CD examples to avoid secret-like literals.Replace the hardcoded token-looking value with a placeholder (e.g.,
<api-token>) to reduce copy/paste risk and secret-scanner noise.Suggested patch
cloudron update \ --server my.example.com \ - --token 001e7174c4cbad2272 \ + --token <api-token> \ --app blog.example.com \ --image username/image:tag🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.agents/tools/deployment/cloudron-server-ops-skill.md around lines 190 - 196, Replace the hardcoded token-like literal in the Cloudron CLI example by using a non-secret placeholder to avoid accidental secret exposure; specifically update the example command that uses the --token flag (the snippet showing "cloudron update ... --token 001e7174c4cbad2272 ...") to use a placeholder such as <api-token> or <token> instead of the numeric-looking value so copy/paste from docs/CI won't leak secrets or trigger scanners.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.agents/subagent-index.toon:
- Line 26: The TOON header declares subagents[62] but the block actually
contains 59 entries; update the TOON header declaration from subagents[62] to
subagents[59] (the header token to change is the TOON comment line containing
"subagents[62]") so the declared cardinality matches the actual rows and
prevents the parser failure.
In @.agents/tools/deployment/cloudron-app-packaging-skill/addons-ref.md:
- Line 20: The markdown has multiple unlabeled fenced code blocks that trigger
MD040; update each fence that lists environment variables to include a language
tag (use "text") so the opening backticks become ```text; specifically edit the
blocks containing the env names such as CLOUDRON_MYSQL_URL,
CLOUDRON_POSTGRESQL_URL, CLOUDRON_MONGODB_URL, CLOUDRON_REDIS_URL,
CLOUDRON_LDAP_SERVER, CLOUDRON_OIDC_PROVIDER_NAME, CLOUDRON_MAIL_SMTP_SERVER,
CLOUDRON_MAIL_IMAP_SERVER, CLOUDRON_EMAIL_SMTP_SERVER, CLOUDRON_TURN_SERVER and
the final CLOUDRON_DOCKER_HOST block (and the other occurrences noted) to start
with ```text to satisfy the lint gate.
---
Nitpick comments:
In @.agents/tools/deployment/cloudron-server-ops-skill.md:
- Around line 190-196: Replace the hardcoded token-like literal in the Cloudron
CLI example by using a non-secret placeholder to avoid accidental secret
exposure; specifically update the example command that uses the --token flag
(the snippet showing "cloudron update ... --token 001e7174c4cbad2272 ...") to
use a placeholder such as <api-token> or <token> instead of the numeric-looking
value so copy/paste from docs/CI won't leak secrets or trigger scanners.
ℹ️ Review info
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (8)
.agents/configs/skill-sources.json.agents/services/hosting/cloudron.md.agents/subagent-index.toon.agents/tools/deployment/cloudron-app-packaging-skill.md.agents/tools/deployment/cloudron-app-packaging-skill/addons-ref.md.agents/tools/deployment/cloudron-app-packaging-skill/manifest-ref.md.agents/tools/deployment/cloudron-app-publishing-skill.md.agents/tools/deployment/cloudron-server-ops-skill.md
.agents/tools/deployment/cloudron-app-packaging-skill/addons-ref.md
Outdated
Show resolved
Hide resolved
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces new documentation and AI skills for Cloudron 9.1. The changes are well-structured and comprehensive, adding valuable information about new features and improving the existing documentation. I've identified a few minor issues related to data consistency in configuration files and a security best practice in a documentation example, which has been highlighted with a security review type and a reference to secure coding practices. Overall, this is a great contribution to keep the documentation up-to-date.
| { | ||
| "name": "cloudron-app-packaging", | ||
| "upstream_url": "https://git.cloudron.io/docs/skills", | ||
| "upstream_commit": "b247b124d168730051186aa63afad87c0c1f5a52", | ||
| "local_path": ".agents/tools/deployment/cloudron-app-packaging-skill.md", | ||
| "format_detected": "skill-md-nested", | ||
| "imported_at": "2026-03-01T18:00:00Z", | ||
| "last_checked": "2026-03-01T18:00:00Z", | ||
| "merge_strategy": "added", | ||
| "notes": "Official Cloudron skill from git.cloudron.io/docs/skills. Includes manifest-ref.md and addons-ref.md in cloudron-app-packaging-skill/" | ||
| }, | ||
| { | ||
| "name": "cloudron-app-publishing", | ||
| "upstream_url": "https://git.cloudron.io/docs/skills", | ||
| "upstream_commit": "b247b124d168730051186aa63afad87c0c1f5a52", | ||
| "local_path": ".agents/tools/deployment/cloudron-app-publishing-skill.md", | ||
| "format_detected": "skill-md", | ||
| "imported_at": "2026-03-01T18:00:00Z", | ||
| "last_checked": "2026-03-01T18:00:00Z", | ||
| "merge_strategy": "added", | ||
| "notes": "Official Cloudron skill for CloudronVersions.json publishing and community packages (9.1+)" | ||
| }, | ||
| { | ||
| "name": "cloudron-server-ops", | ||
| "upstream_url": "https://git.cloudron.io/docs/skills", | ||
| "upstream_commit": "b247b124d168730051186aa63afad87c0c1f5a52", | ||
| "local_path": ".agents/tools/deployment/cloudron-server-ops-skill.md", | ||
| "format_detected": "skill-md", | ||
| "imported_at": "2026-03-01T18:00:00Z", | ||
| "last_checked": "2026-03-01T18:00:00Z", | ||
| "merge_strategy": "added", | ||
| "notes": "Official Cloudron skill for CLI server operations (logs, exec, backups, env vars, CI/CD)" | ||
| } |
There was a problem hiding this comment.
The imported_at timestamps for the new Cloudron skills are set to a future date (2026-03-01). Semantically, imported_at should reflect the actual date of import. Using a future date can be misleading and may cause unexpected behavior in time-based logic. Please consider using the actual import timestamps for these entries.
.agents/subagent-index.toon
Outdated
| --> | ||
|
|
||
| <!--TOON:subagents[58]{folder,purpose,key_files}: | ||
| <!--TOON:subagents[62]{folder,purpose,key_files}: |
There was a problem hiding this comment.
The subagent count has been increased from 58 to 62, an increment of 4. However, this pull request seems to add 3 new skills to an existing subagent entry, without adding new subagent lines. Please verify if the count [62] is correct. If it's a manual count of subagent entries (lines), it seems it should not have changed.
|
|
||
| Default charset: `utf8mb4` / `utf8mb4_unicode_ci`. | ||
|
|
||
| Debug: `cloudron exec` then `mysql --user=$CLOUDRON_MYSQL_USERNAME --password=$CLOUDRON_MYSQL_PASSWORD --host=$CLOUDRON_MYSQL_HOST $CLOUDRON_MYSQL_DATABASE` |
There was a problem hiding this comment.
The provided mysql debug command exposes the password as a command-line argument, which is insecure as it can be seen in the process list by other users on the system. For better security, consider using an environment variable, similar to the postgresql example:
MYSQL_PWD=$CLOUDRON_MYSQL_PASSWORD mysql --user=$CLOUDRON_MYSQL_USERNAME --host=$CLOUDRON_MYSQL_HOST $CLOUDRON_MYSQL_DATABASE| Debug: `cloudron exec` then `mysql --user=$CLOUDRON_MYSQL_USERNAME --password=$CLOUDRON_MYSQL_PASSWORD --host=$CLOUDRON_MYSQL_HOST $CLOUDRON_MYSQL_DATABASE` | |
| Debug: cloudron exec then MYSQL_PWD=$CLOUDRON_MYSQL_PASSWORD mysql --user=$CLOUDRON_MYSQL_USERNAME --host=$CLOUDRON_MYSQL_HOST $CLOUDRON_MYSQL_DATABASE |
References
- When documenting security practices, explicitly emphasize the preference for secure tools (e.g., gopass) over less secure alternatives (e.g., plaintext files), even if the alternatives are permitted with restrictions. This comment highlights a security vulnerability (password exposure) and suggests a more secure method (environment variables).
- Fix subagent-index.toon TOON header cardinality: subagents[62] → subagents[59] - Replace hardcoded token literal with <api-token> placeholder in CI/CD example - Add 'text' language tag to all unlabeled fenced code blocks in addons-ref.md (MD040)
marcusquinn
left a comment
marcusquinn
left a comment
There was a problem hiding this comment.
Fixed all 3 CodeRabbit issues:
subagent-index.toon: TOON header cardinality correctedsubagents[62]→subagents[59]cloudron-server-ops-skill.md: replaced hardcoded token001e7174c4cbad2272with<api-token>placeholderaddons-ref.md: addedtextlanguage tag to all 11 unlabeled fenced code blocks (MD040)
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Sun Mar 1 16:16:34 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
|
1 participant
Summary
git.cloudron.io/docs/skills(upstream commitb247b124): app packaging, app publishing, and server opscloudron.mdwith Cloudron 9.1 features: custom app build & deploy, community packages, passkey/FIDO2 auth, OIDC CLI login, MongoDB 8, Redis 8.4, Node.js 24.x, ACME ARI, backup integrity verificationskill-sources.jsonfor update monitoring (GitLab source — manual update check until GitLab API support added)subagent-index.toondeployment sectionFiles Changed
.agents/tools/deployment/cloudron-app-packaging-skill.md.agents/tools/deployment/cloudron-app-packaging-skill/manifest-ref.md.agents/tools/deployment/cloudron-app-packaging-skill/addons-ref.md.agents/tools/deployment/cloudron-app-publishing-skill.md.agents/tools/deployment/cloudron-server-ops-skill.md.agents/services/hosting/cloudron.md.agents/configs/skill-sources.json.agents/subagent-index.toonNotes
cloudron.md,cloudron-app-packaging.md) remain primary entry points; imported skills complement with authoritative upstream content-skill.mdsuffix convention distinguishes imported skills from native subagentsSummary by CodeRabbit
New Features
Documentation