chore(CLAUDE): Adds fuckin claude files ig.#144
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughAdds repository and package-level ChangesRepository Guidance
CI and Website Tooling
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr.yml:
- Line 9: Update both checkout steps in the PR workflow to configure
persist-credentials as false through each action’s with settings, ensuring
subsequent dependency installation and checks cannot use a persisted
GITHUB_TOKEN.
In `@packages/db/CLAUDE.md`:
- Line 17: Update the database deployment guidance and the workflow behavior
around db:push so direct schema pushes from main are gated to non-production
environments. For production, replace the direct push path with generated,
reviewed migrations that include rollback support, preserving the existing
schema-change trigger while preventing unreviewed changes from applying
directly.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: d44d0858-4f42-41bf-a96f-c546720fdacd
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (8)
.github/workflows/pr.yml.gitignoreCLAUDE.mdapps/website/CLAUDE.mdapps/website/package.jsonapps/website/postcss.config.cjspackages/db/CLAUDE.mdpackages/skeleton-plugin/CLAUDE.md
🚧 Files skipped from review as they are similar to previous changes (3)
- CLAUDE.md
- packages/skeleton-plugin/CLAUDE.md
- apps/website/CLAUDE.md
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - uses: pnpm/action-setup@v4 | ||
| - uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files .github/workflows || true
echo "== pr.yml =="
if [ -f .github/workflows/pr.yml ]; then
nl -ba .github/workflows/pr.yml | sed -n '1,160p'
fi
echo "== action version pins =="
rg -n 'uses:\s*actions/checkout@|persist-credentials|pnpm i|pnpm lint|pnpm (install|run lint|lint)' .github/workflows .github 2>/dev/null || true
echo "== check pin metadata if gh available =="
if command -v gh >/dev/null 2>&1; then
echo "gh version:"
gh --version | head -3
for ref in v7; do
echo "== gh inspect actions/checkout@$ref =="
obj=$(gh api repos/actions/checkout/git/refs/tags/$ref --jq '.object.sha' 2>/dev/null || true)
typ=$(gh api repos/actions/checkout/git/refs/tags/$ref --jq '.object.type' 2>/dev/null || true)
echo "tag ref object=$obj type=$typ"
if [ "$typ" = "tag" ] && [ -n "$obj" ]; then
commit=$(gh api repos/actions/checkout/git/tags/$obj --jq '.object.sha' 2>/dev/null || true)
echo "dereferenced commit=$commit"
fi
done
else
echo "gh not available"
fiRepository: sungmanito/mono
Length of output: 294
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== pr.yml relevant contents =="
python3 - <<'PY'
from pathlib import Path
p=Path('.github/workflows/pr.yml')
for i,line in enumerate(p.read_text().splitlines(),1):
print(f"{i:4}: {line}")
PY
echo "== checkout references in workflows =="
grep -RInE 'uses:\s*actions/checkout@|persist-credentials|pnpm (i|install|lint|run lint)' .github/workflows .github 2>/dev/null || true
echo "== available gh =="
command -v gh >/dev/null 2>&1 && gh --version | head -3 || echo "gh not available"Repository: sungmanito/mono
Length of output: 2401
🌐 Web query:
actions/checkout v7 persist-credentials default value GITHUB_TOKEN
💡 Result:
The default value for the persist-credentials input in actions/checkout v7 is true [1][2]. When set to true (the default), the action configures the repository's local Git configuration to use the GITHUB_TOKEN (or an alternative token/SSH key if provided) to authenticate Git commands [3][4][2]. This allows your subsequent workflow steps to perform authenticated Git operations, such as git fetch or git push [3][5]. In v7, this credential persistence is handled more securely than in earlier versions by storing the credentials in a separate file under $RUNNER_TEMP rather than directly within.git/config [5][6]. The token is automatically removed during the post-job cleanup process [3][2]. To opt out of this behavior, you can explicitly set persist-credentials to false [3][4].
Citations:
- 1: https://github.com/actions/checkout/blob/34e114876b0b11c390a56381ad16ebd13914f8d5/action.yml
- 2: https://github.com/actions/checkout/blob/de0fac2e4500dabe0009e67214ff5f5447ce83dd/action.yml
- 3: https://github.com/actions/checkout?tab=readme-ov-file
- 4: https://github.com/actions/checkout
- 5: actions/checkout@v4.2.2...v7
- 6: actions/checkout@v4.3.1...v7
🌐 Web query:
repository sungmanito mono package.json scripts prettier lint
💡 Result:
The sungmanito/mono repository is a monorepo containing the codebase for a bill-tracking application named Sungmanito [1]. While search results confirm the repository exists and utilizes technologies such as SvelteKit 2, Drizzle ORM, and Supabase [1][2], there is no specific public information available regarding the exact configuration of Prettier or linting scripts within its package.json files. The repository is structured with an apps directory, which currently contains a single SvelteKit application [1]. If you are looking to configure Prettier and linting in a similar SvelteKit monorepo environment, common industry practice involves installing the necessary dependencies (e.g., eslint, prettier, eslint-config-prettier, eslint-plugin-svelte) and defining scripts in your package.json, such as: { "scripts": { "lint": "eslint.", "format": "prettier --write." } } Since specific implementation details for this repository's linting and formatting configuration were not found in the available search data, you would need to inspect the package.json file directly within the sungmanito/mono repository to see their specific setup [1].
Citations:
- 1: https://github.com/sungmanito/mono
- 2: Builds break after upgrading to SvelteKit 2 sveltejs/kit#11434
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== checkout metadata files =="
git ls-files 'action.yml' 'package.json' 'pnpm-lock.yaml' package-lock.json yarn.lock 2>/dev/null || true
echo "== package workspace/package scripts =="
python3 - <<'PY'
from pathlib import Path
for p in list(Path('.').rglob('package.json'))[:50]:
try:
import json
data=json.loads(p.read_text())
except Exception as e:
continue
if p == Path('package.json') or (p.is_relative_to(Path('.')) and any(part in {'.github','node_modules'} for part in p.parts)):
pass
if data:
print(f"-- {p} --")
if 'scripts' in data:
for k,v in data['scripts'].items():
if k in {'lint','prettier','format','build','dev'} or 'lint' in k or 'prettier' in k:
print(f"{k}: {v}")
if 'dependencies' in data or 'devDependencies' in data:
deps={}
deps.update(data.get('dependencies',{}))
deps.update(data.get('devDependencies',{}))
for d in ['eslint','prettier','svelte-check','typescript']:
if d in deps:
print(f"dep {d}: {deps[d]}")
PY
echo "== .github/workflows/pr.yml with with block support =="
python3 - <<'PY'
from pathlib import Path
text=Path('.github/workflows/pr.yml').read_text().splitlines()
for i,line in enumerate(text,1):
if 'uses: actions/checkout@' in line:
print(f"{i}: {line}")
cur=i
while cur < len(text):
nxt=cur+1
if nxt <= len(text) and (text[nxt-1].startswith(' ') or text[nxt-1].startswith('\t')):
print(f"{nxt}: {text[nxt]}")
cur=nxt
else:
break
PYRepository: sungmanito/mono
Length of output: 8443
Disable checkout credential persistence in PR checks.
Leave the repo checkout unauthenticated for PR workflows: add with: persist-credentials: false to both .github/workflows/pr.yml checkout steps. After checkout, pnpm i --frozen-lockfile followed by pnpm prettier:check or pnpm lint runs pull-request-controlled code with the default persisted GITHUB_TOKEN.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 9-9: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/pr.yml at line 9, Update both checkout steps in the PR
workflow to configure persist-credentials as false through each action’s with
settings, ensuring subsequent dependency installation and checks cannot use a
persisted GITHUB_TOKEN.
Source: Linters/SAST tools
| - `pnpm db:generate` — `drizzle-kit generate` (emit SQL migration files into `./drizzle`) | ||
| - `pnpm db:studio` — `drizzle-kit studio` | ||
|
|
||
| No `build`, `lint`, `dev`, or `test` scripts are defined for this package. CI (`.github/workflows/db.yml`) runs `pnpm db:push` from this directory on every push to `main` that touches `packages/db/src/**/*.ts` — i.e. schema changes pushed to `main` apply directly to the database, there's no generate/review step in that workflow. |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repo files relevant =="
git ls-files | rg '(^\.github/workflows/db\.yml$|packages/db/CLAUDE\.md$|packages/db/.*)' | sed -n '1,120p'
echo
echo "== packages/db/CLAUDE.md context =="
if [ -f packages/db/CLAUDE.md ]; then
nl -ba packages/db/CLAUDE.md | sed -n '1,80p'
fi
echo
echo "== .github/workflows/db.yml =="
if [ -f .github/workflows/db.yml ]; then
nl -ba .github/workflows/db.yml | sed -n '1,220p'
fi
echo
echo "== package scripts / drizzle / database URLs =="
for f in packages/db/package.json pnpm-workspace.yaml; do
if [ -f "$f" ]; then
echo "--- $f"
cat "$f"
fi
done
echo
echo "== search db env/workflow refs =="
rg -n "DATABASE_|DB_|drizzle|db:push|schema|migration|main|push|production|staging|preview|heroku|vercel|railway|supabase|neon|rds|postgres|mysql" .github packages/db -S 2>/dev/null | sed -n '1,240p'Repository: sungmanito/mono
Length of output: 1264
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== packages/db/CLAUDE.md context =="
if [ -f packages/db/CLAUDE.md ]; then
cat -n packages/db/CLAUDE.md | sed -n '1,80p'
fi
echo
echo "== .github/workflows/db.yml =="
if [ -f .github/workflows/db.yml ]; then
cat -n .github/workflows/db.yml | sed -n '1,220p'
fi
echo
echo "== package scripts / drizzle / database URLs =="
for f in packages/db/package.json pnpm-workspace.yaml; do
if [ -f "$f" ]; then
echo "--- $f"
cat -n "$f"
fi
done
echo
echo "== search db env/workflow refs =="
rg -n "DATABASE_|DB_|drizzle|db:push|schema|migration|main|push|production|staging|preview|heroku|vercel|railway|supabase|neon|rds|postgres|mysql" .github packages/db -S 2>/dev/null | sed -n '1,260p'Repository: sungmanito/mono
Length of output: 10979
Avoid normalizing direct schema pushes from main.
.github/workflows/db.yml runs cd packages/db && pnpm db:push on every main push touching packages/db/src/**/*.ts, with no environment gate or migration/review step. If this targets a shared or production database, db:push can apply unreviewed schema changes directly; gate it to non-production, and generate/review migrations for production with rollback support.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~17-~17: The official name of this software platform is spelled with a capital “H”.
Context: ...ripts are defined for this package. CI (.github/workflows/db.yml) runs pnpm db:push ...
(GITHUB)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/db/CLAUDE.md` at line 17, Update the database deployment guidance
and the workflow behavior around db:push so direct schema pushes from main are
gated to non-production environments. For production, replace the direct push
path with generated, reviewed migrations that include rollback support,
preserving the existing schema-change trigger while preventing unreviewed
changes from applying directly.
1 participant
Summary by CodeRabbit
apps/website,packages/db, andpackages/skeleton-plugin.