Skip to content

chore: sync from monorepo @3b483eb - #21

Merged
WomB0ComB0 merged 9 commits into
mainfrom
sync/monorepo-3b483eb
Apr 18, 2026
Merged

WomB0ComB0 merged 9 commits into
mainfrom
sync/monorepo-3b483eb

Conversation

@WomB0ComB0

Copy link
Copy Markdown
Member

Automated sync from resq-software/resQ@3b483eb.

Review before merging — direct pushes to standalone repos are preserved.

@coderabbitai

coderabbitai Bot commented Apr 18, 2026 •

Copy link
Copy Markdown

Warning

Rate limit exceeded

@WomB0ComB0 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 23 minutes and 18 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 23 minutes and 18 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 58fb045b-cfd1-4061-a4b2-3261ceed0962

📥 Commits

Reviewing files that changed from the base of the PR and between 7786503 and 64d5923.

⛔ Files ignored due to path filters (1)
  • flake.lock is excluded by !**/*.lock
📒 Files selected for processing (26)
  • .git-hooks/local-pre-push
  • .gitignore
  • README.md
  • bootstrap.sh
  • flake.nix
  • resq-airspace/src/error.rs
  • resq-airspace/src/instructions/grant_permit.rs
  • resq-airspace/src/instructions/initialize_property.rs
  • resq-airspace/src/instructions/record_crossing.rs
  • resq-airspace/src/instructions/update_policy.rs
  • resq-airspace/src/instructions/update_treasury.rs
  • resq-airspace/src/lib.rs
  • resq-airspace/src/state/airspace_account.rs
  • resq-airspace/src/state/mod.rs
  • resq-airspace/src/state/permit.rs
  • resq-airspace/tests/host_init_regression.rs
  • resq-airspace/tests/integration.rs
  • resq-delivery/src/error.rs
  • resq-delivery/src/instructions/mod.rs
  • resq-delivery/src/instructions/record_delivery.rs
  • resq-delivery/src/lib.rs
  • resq-delivery/src/state/delivery_record.rs
  • resq-delivery/src/state/mod.rs
  • resq-delivery/tests/integration.rs
  • scripts/lib/shell-utils.sh
  • scripts/setup.sh
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch sync/monorepo-3b483eb

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a comprehensive environment setup framework, including a new setup script and a library of shell utilities, while also downgrading the nixpkgs version and removing several files such as a pre-push hook and a large suite of integration tests. Feedback identifies a critical typo in the Docker installation logic, suggests using printf for more robust logging, and recommends enforcing lockfile integrity for JavaScript dependencies. Most importantly, the removal of core integration tests is flagged as a significant regression that requires justification or reversal.

I am having trouble creating individual review comments. Click here to see my feedback.

scripts/lib/shell-utils.sh (503)

critical

There is a typo in the command name: ls_release should be lsb_release. This will cause the Docker repository setup to fail on Debian/Ubuntu-based systems.

                sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"

resq-airspace/tests/integration.rs (1190-1505)

high

This commit removes a significant number of critical integration tests (Fee collection, Access Policy enforcement, coordinate validation, and permit expiry) without providing replacements or an explanation in the PR description. This drastically reduces the test coverage for core on-chain logic and security constraints. If these tests were moved to another harness, please ensure they are correctly integrated; otherwise, they should be retained to prevent regressions.

scripts/lib/shell-utils.sh (106)

medium

Using echo -e can be unreliable if the message starts with a hyphen or contains other characters that echo might interpret as options. Using printf is more robust and portable for logging formatted messages.

    printf "%b[%s]%b %s\n" "$color" "$level" "$COLOR_NC" "$message" >&2

scripts/setup.sh (190)

medium

The fallback to --no-frozen-lockfile silently ignores dependency mismatches between the bun.lockb and package.json. In a development or CI setup, it is safer to respect the lockfile to ensure reproducible environments. If the lockfile is out of sync, the setup should ideally fail or warn the user rather than automatically bypassing the integrity check.

    cd "$PROJECT_ROOT" && bun install

@WomB0ComB0
WomB0ComB0 merged commit 4e46daf into main Apr 18, 2026
16 of 19 checks passed
@WomB0ComB0
WomB0ComB0 deleted the sync/monorepo-3b483eb branch April 18, 2026 07:49
WomB0ComB0 added a commit that referenced this pull request Jun 2, 2026
#32)

* ci(security): harden security workflow — clear zizmor alerts #10 & #11

Resolves both open code-scanning alerts on .github/workflows/security.yml
(zizmor 1.24.1, verified locally with `zizmor --persona=auditor`):

- #11 secrets-inherit (warning): replace `secrets: inherit` — which hands
  the reusable workflow ALL of this repo's secrets — with named forwarding
  of just SEMGREP_APP_TOKEN (the only enabled token-consuming scanner).
  Enabled by resq-software/.github#21, which declares the secret under
  workflow_call.secrets; re-pinned to that workflow's new SHA
  (b48036af, #21).
- #10 unpinned-uses (error): already SHA-pinned in #30; carried forward.

Also clears two latent findings the stale scan predates:
- excessive-permissions: drop workflow-level `permissions` to `{}` and move
  contents/security-events/pull-requests scopes onto the `scan` job, so they
  apply only to the reusable call.
- undocumented-permissions: every scope now carries an explanatory comment.

`zizmor --no-online-audits` reports "No findings" on the result.

NOTE: this does not by itself explain the separate scheduled-run
startup_failure (which persisted after the #30 pin); switching off
`secrets: inherit` is the leading remaining hypothesis and this PR tests it.

* fix(ci): grant actions:read so the security reusable can start

Root cause of the security-workflow startup_failure (every run since
2026-05-04, 0 jobs executed): the reusable security-scan.yml's CodeQL and
zizmor jobs request `actions: read` (added in resq-software/.github#20,
2026-05-04 — exactly when the failures began). A reusable workflow's jobs
cannot request a permission the caller did not grant; GitHub rejects the
entire run at startup.

The prior #30 SHA-pin and the secrets-inherit removal did not fix it
because neither granted actions:read. Add it to the scan job's permissions.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant