Skip to content

Release v0.1.0#94

Merged
seonghobae merged 84 commits into
mainfrom
release/v0.1.0
Mar 27, 2026
Merged

Release v0.1.0#94
seonghobae merged 84 commits into
mainfrom
release/v0.1.0

Conversation

@seonghobae
Copy link
Copy Markdown
Owner

Purpose

This PR brings the fully completed BandScope implementation (from Issue #26 roadmap) into the main branch as the first official release (v0.1.0).

Contents

All epic implementation PRs from the develop branch.
Included updates:

  • Created CHANGELOG.md.
  • Patched 1 moderate severity npm vulnerability via npm audit fix.

Security Notes

All features have been strictly developed under the constraints of the repository's security, supply-chain, and dependency policies.

Closes #93

dependabot Bot and others added 30 commits March 11, 2026 03:57
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4.4.0 to 6.3.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@49933ea...53b8394)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from e58605a9b6da7c637471fab8847a5e5a6b8df081 to d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@e58605a...d4b2f3b)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [react](https://github.com/facebook/react/tree/HEAD/packages/react) and [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react). These dependencies needed to be updated together.

Updates `react` from 18.3.1 to 19.2.4
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.4/packages/react)

Updates `@types/react` from 18.3.28 to 19.2.14
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

---
updated-dependencies:
- dependency-name: react
  dependency-version: 19.2.4
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: "@types/react"
  dependency-version: 19.2.14
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@34e1148...de0fac2)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/setup-python](https://github.com/actions/setup-python) from 5.6.0 to 6.2.0.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@a26af69...a309ff8)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: 6.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 4.3.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](actions/download-artifact@d3f86a1...70fc10c)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [react-dom](https://github.com/facebook/react/tree/HEAD/packages/react-dom) and [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom). These dependencies needed to be updated together.

Updates `react-dom` from 18.3.1 to 19.2.4
- [Release notes](https://github.com/facebook/react/releases)
- [Changelog](https://github.com/facebook/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/facebook/react/commits/v19.2.4/packages/react-dom)

Updates `@types/react-dom` from 18.3.7 to 19.2.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

---
updated-dependencies:
- dependency-name: react-dom
  dependency-version: 19.2.4
  dependency-type: direct:production
  update-type: version-update:semver-major
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.3
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.32.6 to 4.32.6.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@820e316...0d579ff)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-version: 4.32.6
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.6.2 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@ea165f8...bbbca2d)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 4.7.0 to 5.1.4.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@5.1.4/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 5.1.4
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [jsdom](https://github.com/jsdom/jsdom) from 26.1.0 to 28.1.0.
- [Release notes](https://github.com/jsdom/jsdom/releases)
- [Changelog](https://github.com/jsdom/jsdom/blob/main/Changelog.md)
- [Commits](jsdom/jsdom@26.1.0...28.1.0)

---
updated-dependencies:
- dependency-name: jsdom
  dependency-version: 28.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 22.19.15 to 25.4.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 25.4.0
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 6.4.1 to 7.3.1.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.1/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 7.3.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
…p/astral-sh/setup-uv-d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86' into deps/consolidated-green
…p/actions/setup-python-6.2.0' into deps/consolidated-green
…p/actions/download-artifact-8.0.0' into deps/consolidated-green
…p/actions/upload-artifact-7.0.0' into deps/consolidated-green
…vitejs/plugin-react-5.1.4' into deps/consolidated-green
…types/node-25.4.0' into deps/consolidated-green
chore(deps): consolidate green Dependabot updates
Bumps [eslint](https://github.com/eslint/eslint) from 9.39.4 to 10.0.3.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.4...v10.0.3)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.0.3
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) from 3.2.4 to 4.0.18.
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/coverage-v8)

---
updated-dependencies:
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.0.18
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 3.2.4 to 4.0.18.
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.0.18/packages/vitest)

---
updated-dependencies:
- dependency-name: vitest
  dependency-version: 4.0.18
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Copilot AI and others added 26 commits March 25, 2026 15:24
* Initial plan

* feat: add OSSF Scorecard GitHub Actions workflow and update supply-chain verification

Co-authored-by: seonghobae <8172694+seonghobae@users.noreply.github.com>
Agent-Logs-Url: https://github.com/seonghobae/bandscope/sessions/ba935340-dbe2-4369-bee3-5b437786b486

* fix: remove unsupported branch_protection_rule trigger from ossf-scorecard workflow

The branch_protection_rule event is not supported by the ossf/scorecard-action
and causes unexpected behavior. Keep only push (develop, main) and weekly schedule.

Addresses CodeRabbit review comment on PR #82.

* refactor: use extend() with generator in verify_workflow_coverage scorecard loop

Replace individual append() calls in the ossf scorecard token loop with
a single extend() using a generator expression, as requested in CodeRabbit review.

* ci: re-trigger build runners

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: seonghobae <8172694+seonghobae@users.noreply.github.com>
Co-authored-by: Seongho Bae <me@seonghobae.me>
* feat(deps): upgrade vite to ^8.0.2 and @vitejs/plugin-react to ^6.0.1

Combines previously-closed PRs #71 and #77. Upgrades vite ^7.3.1→^8.0.2
and @vitejs/plugin-react ^5.1.4→^6.0.1 together to satisfy peer dependency
requirements. All 12 tests pass at 100% coverage.

* ci: re-trigger build to clear stalled runners
Co-authored-by: Seongho Bae <me@seonghobae.me>
Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.4.0 to 25.5.0.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 25.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Seongho Bae <me@seonghobae.me>
Co-authored-by: Seongho Bae <me@seonghobae.me>
…red-types (#79)

Co-authored-by: Seongho Bae <me@seonghobae.me>
Co-authored-by: Seongho Bae <me@seonghobae.me>
…red-types (#80)

Co-authored-by: Seongho Bae <me@seonghobae.me>
Co-authored-by: Seongho Bae <me@seonghobae.me>
Co-authored-by: Seongho Bae <me@seonghobae.me>
* feat(analysis): complete section extraction pipeline

- Introduce section/form/cue extraction domain models
- Extract section tags using lyric phrasing and count anchors
- Synchronize frontend TS models with backend extraction model
- Validate with comprehensive engine and shared-type tests

* fix: update picomatch to 4.0.4 to fix high severity npm audit vulnerability
* feat: implement role extraction domain model and part graph

* fix: resolve docstring and line length linting errors in role extraction domain

* fix: resolve mypy errors by correctly typing ManualOverride and RehearsalRolePayload

* fix(roles): remove unused pytest import to fix ruff check

* fix(roles): address code review feedback

- Renamed audio_features to _audio_features to indicate intentional unuse.
- Used Enum references directly instead of string literals (.value) in RehearsalRole dict assignments to satisfy structural typing since Python 3.12 Enums serialize nicely to JSON.
- Updated TypedDict definitions in model.py to use the actual Enum types instead of string, for better type safety.

* fix(analysis): resolve CodeRabbit review comments
- Add PartGraphNodePayload to RehearsalSectionPayload in api.py
- Add section dict type validation to RoleExtractor
- Include inactive roles in part_graph for all sections
- Add tests for new behaviors

* fix: resolve E501 line too long error in extractor.py

* style: format tests/test_roles.py with ruff
* feat: implement role-specific harmony, range, overlap, and confidence output

Resolves #31

* chore: remove scratchpad files
feat: implement practical rehearsal workspace UI
- Fix macro compilation error in src-tauri/src/main.rs by replacing unreachable!() with unwrap_or(false).
- Enforce 5MB limit for file uploads and handle User cancelled string in Rust.
- Display errors using UI state rather than console.error in App.tsx.
- Filter out old harmony overrides before adding new ones in SectionRoadmap.tsx.
- Add parseRehearsalSong validation to saveProject to ensure schema correctness before saving.
- Include newline at EOF in docs/engineering/local-project-format.md.
- Update tests for 100% test coverage.
- Add defensive null check for jobResult in handleSaveProject
- Add test coverage for null jobResult when saving
- Memoize translation function in SectionRoadmap.tsx
- Remove stray agent json files
…and-persistence

feat: implement manual override and local project persistence (Issue #27)
* feat: implement policy-constrained YouTube import (#30)

- Add `yt-dlp` to Python engine dependencies and inventory
- Implement robust audio extraction logic enforcing constraints (audio only, 50MB limit, 15 min limit)
- Expose `import_youtube_url` Tauri IPC command
- Add UI inputs for YouTube URL import and loading state
- Ensure 100% test coverage

* fix: address CodeRabbit review feedback for YouTube import

- Add url crate for robust URL validation in Tauri.

- Wrap synchronous CLI execution in spawn_blocking in Tauri.

- Refactor YouTube URL validation in Python engine to limit URL length and handle unknown exceptions.

- Ensure 100% test coverage for YouTube module.

- Fix hardcoded UI strings by migrating to i18n locale files.

- Resolve Ruff line-length formatting issues.

* fix(youtube): enhance youtube import stability and coverage

Adds 120s timeout and filename sanitization to rust main.rs. Fixes youtube.py duration checking by using two-pass extract_info logic. Adds missing test cases for 100% test coverage.

* fix(python): update yt-dlp config and verify audio output for CodeRabbit

- Replace extract_audio with postprocessors.FFmpegExtractAudio
- Add fallback extension checking when yt-dlp transcodes audio
- Add 100% test coverage for file not found and extension changes

* fix: resolve CodeRabbit comments on mock logic and sanitize filename

* fix(rust): return explicit error when youtube import metadata is missing and add tokio time feature

* test: refine runpy os mock per CodeRabbit review

* fix: remove unused os import to fix ruff error

* test: add missing docstring for mock function in test_youtube
* docs: finalize roadmap completion (fixes #26)

* docs: add required Security Notes to roadmap completion plan

* docs: add required security subsections to roadmap completion

* docs: clarify coverage scope in README.md per review

* trigger: force CodeRabbit review update

* trigger: force another CodeRabbit review
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented Mar 27, 2026

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: c481469b-83f2-4c55-ab53-3354125dff68

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch release/v0.1.0

Comment @coderabbitai help to get the list of available commands and usage tips.

@seonghobae seonghobae enabled auto-merge March 27, 2026 01:50
@seonghobae seonghobae merged commit b36b56e into main Mar 27, 2026
22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants