chore: sync from monorepo @3b483eb - #21
Conversation
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 23 minutes and 18 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (26)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Code Review
This pull request introduces a comprehensive environment setup framework, including a new setup script and a library of shell utilities, while also downgrading the nixpkgs version and removing several files such as a pre-push hook and a large suite of integration tests. Feedback identifies a critical typo in the Docker installation logic, suggests using printf for more robust logging, and recommends enforcing lockfile integrity for JavaScript dependencies. Most importantly, the removal of core integration tests is flagged as a significant regression that requires justification or reversal.
I am having trouble creating individual review comments. Click here to see my feedback.
scripts/lib/shell-utils.sh (503)
There is a typo in the command name: ls_release should be lsb_release. This will cause the Docker repository setup to fail on Debian/Ubuntu-based systems.
sudo add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
resq-airspace/tests/integration.rs (1190-1505)
This commit removes a significant number of critical integration tests (Fee collection, Access Policy enforcement, coordinate validation, and permit expiry) without providing replacements or an explanation in the PR description. This drastically reduces the test coverage for core on-chain logic and security constraints. If these tests were moved to another harness, please ensure they are correctly integrated; otherwise, they should be retained to prevent regressions.
scripts/lib/shell-utils.sh (106)
Using echo -e can be unreliable if the message starts with a hyphen or contains other characters that echo might interpret as options. Using printf is more robust and portable for logging formatted messages.
printf "%b[%s]%b %s\n" "$color" "$level" "$COLOR_NC" "$message" >&2
scripts/setup.sh (190)
The fallback to --no-frozen-lockfile silently ignores dependency mismatches between the bun.lockb and package.json. In a development or CI setup, it is safer to respect the lockfile to ensure reproducible environments. If the lockfile is out of sync, the setup should ideally fail or warn the user rather than automatically bypassing the integrity check.
cd "$PROJECT_ROOT" && bun install
#32) * ci(security): harden security workflow — clear zizmor alerts #10 & #11 Resolves both open code-scanning alerts on .github/workflows/security.yml (zizmor 1.24.1, verified locally with `zizmor --persona=auditor`): - #11 secrets-inherit (warning): replace `secrets: inherit` — which hands the reusable workflow ALL of this repo's secrets — with named forwarding of just SEMGREP_APP_TOKEN (the only enabled token-consuming scanner). Enabled by resq-software/.github#21, which declares the secret under workflow_call.secrets; re-pinned to that workflow's new SHA (b48036af, #21). - #10 unpinned-uses (error): already SHA-pinned in #30; carried forward. Also clears two latent findings the stale scan predates: - excessive-permissions: drop workflow-level `permissions` to `{}` and move contents/security-events/pull-requests scopes onto the `scan` job, so they apply only to the reusable call. - undocumented-permissions: every scope now carries an explanatory comment. `zizmor --no-online-audits` reports "No findings" on the result. NOTE: this does not by itself explain the separate scheduled-run startup_failure (which persisted after the #30 pin); switching off `secrets: inherit` is the leading remaining hypothesis and this PR tests it. * fix(ci): grant actions:read so the security reusable can start Root cause of the security-workflow startup_failure (every run since 2026-05-04, 0 jobs executed): the reusable security-scan.yml's CodeQL and zizmor jobs request `actions: read` (added in resq-software/.github#20, 2026-05-04 — exactly when the failures began). A reusable workflow's jobs cannot request a permission the caller did not grant; GitHub rejects the entire run at startup. The prior #30 SHA-pin and the secrets-inherit removal did not fix it because neither granted actions:read. Add it to the scan job's permissions.
Automated sync from resq-software/resQ@
3b483eb.Review before merging — direct pushes to standalone repos are preserved.