chore(release): promote the shared star-chart refresh workflow to main - #33
Merged
Conversation
Adds organization-wide community health defaults, validation, ownership, contribution guidance, security policy, and hardened workflow checks.
* ci(workflows): add reusable CI foundation * fix(workflows): harden reusable release contracts
* feat(quality): add normalized reporting foundation * test(quality): run reporting contracts in standards validation * fix(quality): align report validator with schema * test(quality): verify GitHub integration outputs
* ci(profile): make asset generation read-only * fix(profile): restrict asset validation egress
* ci(review): add deduplicated Greptile summon * fix(review): serialize exact-head Greptile summons * test(review): lock Greptile security controls
go-ci.yml's test and lint jobs ran unconditionally, so a Go-less repo that only wants the language-agnostic workflow-security (zizmor) job couldn't call it. Add run-test/run-lint boolean inputs, mirroring the existing run-govulncheck/run-workflow-security/etc. toggle pattern, defaulting to true so existing callers see no behavior change. Fixes: #18
* ci(workflows): add module-directory input to node-ci Mirrors go-ci's module-directory idiom: a string input defaulting to "." threaded into each fixed script's env as MODULE_DIRECTORY, so a repo with several independently-gated Node projects can call node-ci once per project. The default preserves current behavior for existing callers. Extends the reusable CI contract test to assert the new input and its threading, matching how run-test/run-lint were added for go-ci in #19. * test(workflows): assert module-directory threads into all three node jobs
* docs(onboarding): align with the codified standards registry - docs(onboarding): name Codecov as the coverage cloud; Qlty Cloud App and maintainability badge stay, checks stay non-required - docs(onboarding): trivy deprecated in favor of Grype, including the qlty plugin blocks in the two reference configs (drydock#753, portwing#135) - docs(onboarding): CodeRabbit free Pro is public-only; private repos use cross-account human review - docs(onboarding): add the greptile.json contract and the label-gated second-opinion caller * docs(onboarding): reword the CodeRabbit private-repo claim as org policy - docs(onboarding): free-plan private-repo reviews exist but are rate-limited and never fired here; the skip is policy, not a plan fact - docs(onboarding): pair the Greptile caller with auto-applied CodeRabbit labeling so the second-opinion label is criteria-driven
* chore(repo): meet our own onboarding checklist - chore(repo): MIT LICENSE (infrastructure repos are MIT; products AGPL) - docs(repo): root AGENTS.md with repo-specific rules and validation - build(hooks): lefthook with commit-msg + pre-push mirroring CI via scripts/validate.sh * fix(hooks): tighten the commit-msg exemptions and mirror zizmor's CI flags - fix(hooks): merge/revert exemptions match git's generated subjects only, so a hand-typed 'Merge ...' subject no longer bypasses the check - fix(hooks): require a non-whitespace character after the colon - fix(hooks): zizmor runs --no-online-audits locally, matching CI's online-audits: false for local/CI parity * fix(hooks): exempt only git-generated merge and revert subjects
* docs(community): add org-default code of conduct and community checklist items CODE_OF_CONDUCT.md is Contributor Covenant 2.0 (drydock's tuned copy) with the org contact security@codeswhat.com, cascading to every repo without a local one. Onboarding checklist gains the cascade-first rule and the Discussions on/off split for product vs meta repos. * test(community): assert the code of conduct in the community-health contract
…32) * feat(workflows): add the shared star-chart refresh reusable workflow Replaces both retired star-chart engines org-wide. The chart becomes a first-party SVG generated from GitHub's own stargazer timestamps and committed into the consuming repository, so it needs no secret and makes no request at render time. That property is the point. A live route that loses its credential serves a plausible placeholder at HTTP 200 forever with nothing reporting red, which is exactly how drydock's chart sat broken. A committed artifact fails visibly or not at all. The generator is embedded in the workflow rather than checked out from a second repository, so a caller's SHA pin covers every line of behaviour with nothing resolved at run time. Verified against live data before committing: byte-identical output to the reference implementation for drydock at 238 stars and 3 API calls, and a clean no-op exit on a repo with a single star. - feat(workflows): starchart-refresh.yml, egress-blocked to api.github.com and github.com, contents: write as its only elevated scope - test(workflows): contract test covering the embedded generator, env-var input handling, the self-contained SVG, and the conditional commit-back - ci(validation): run the new contract test in standards validation - docs(onboarding): document the caller shape and why the artifact is committed rather than served * test(workflows): syntax-check the embedded star-chart generator This workflow never runs in this repository, so a syntax error inside the heredoc would first surface in a consumer's scheduled job, days later and in someone else's lane. The test recovers the generator the way the shell will actually see it, stripping the run block's base indentation rather than reading the file as written, since a heredoc body that looks correct in YAML can still reach node malformed. Then node --check parses it. Verified with a negative control rather than assumed: injecting a syntax error into the generator fails the test, and reverting passes it. * fix(workflows): reject the inputs that would publish a wrong star chart All three from CodeRabbit on #32, and the max-pages one was a real bug of exactly the kind this workflow exists to prevent. max-pages: 0 made pages 0, which fetched nothing, which hit the "too few stars" clean exit. A repository with 238 stars would have reported a green no-op. A cap below the needed page count was worse than that: it drew a chart from the first N pages and published a partial history as a whole one behind a ::warning:: nobody reads. Both now fail loudly, and the cap must be a positive integer. branch had no runtime guard. Omitting a default only prevents omission, so a caller could still pass main and, on a repository whose ruleset let the push through, commit straight to the default branch. Rejected before checkout rather than at the push, where the error would be confusing. output-path was read through the environment, which stops script injection but not traversal. An absolute or ../ path reached writeFileSync outside the checkout, and the commit step then found nothing staged and reported success. Writes now use the resolved and validated path rather than the raw input, since a check that doesn't govern the write is decoration. Verified behaviourally, not by reading: each rejected input throws, the one-star exit still no-ops, nothing lands outside the workspace, and the happy path is still byte-identical to the reference output for drydock.
scttbnsn
requested review from
ALARGECOMPANY and
biggest-littlest
as code owners
August 20, 2026 22:59
|
Warning Review limit reached
Next review available in: 50 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
biggest-littlest
approved these changes
Aug 20, 2026
biggest-littlest
left a comment
biggest-littlest
left a comment
Member
There was a problem hiding this comment.
Approved for promotion. Same content reviewed on #32; the reconcile left the tree unchanged, and checks are green on the exact head.
ALARGECOMPANY
approved these changes
Aug 20, 2026
ALARGECOMPANY
left a comment
ALARGECOMPANY
left a comment
Member
There was a problem hiding this comment.
Approved. Reusable workflow with contents: write asserted as its only elevated scope, egress blocked, and the commit-back guarded against a default-branch target before checkout.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes
starchart-refresh.ymland its contract test so consuming repos can pin a frozen full commit SHA onmain.Reviewed on #32 (two non-author approvals, CodeRabbit read and answered). Reconciled with
chore(sync): reconcile main before promotion; the reconcile left the tree unchanged.What lands
.github/workflows/starchart-refresh.yml— reusable workflow that regenerates a repository's star-history chart as a first-party SVG from GitHub's stargazer timestamps and commits it back to the caller's integration branch, only when the chart changed..github/tests/starchart_refresh_contract_test.py— 10 contract tests, wired into Standards Validation.REPOSITORY_ONBOARDING.md— the caller shape and why the chart is a committed artifact rather than a live route or a third-party embed.Why it exists
Third star-chart decision in a week, and the first two both rested on a diagnosis that turned out to be false. The record said GitHub had restricted stargazer API access. It hadn't:
Accept: application/vnd.github.star+jsonreturns realstarred_attimestamps with any authenticated token, 3 API calls for drydock's 238 stars against 5000/hour.star-history.combroke because a third party has no token for our repos. drydock's self-hosted route broke because its own code returns a placeholder SVG at HTTP 200 whenprocess.env.GITHUB_TOKENis unset, and it was never set in Vercel production.So the rule isn't that self-hosting can't work. It's that a live route needs a production secret and fails silently without one, while a committed artifact needs nothing at runtime and can't fail silently. It also settles the marketing-page case with no proxy: same file, zero third-party requests, no visitor IPs leaving our infrastructure.
Review found a real one
CodeRabbit caught that
max-pages: 0fetched nothing, which fell through to the "too few stars" clean exit, so a repository with 238 stars would have reported a green no-op. That's the same silent-success shape this workflow exists to remove, sitting inside the workflow itself. A cap merely below the needed count was the other half, publishing a partial history as a whole one behind a::warning::. Both now fail loudly. Two smaller ones fixed alongside:branchis rejected before checkout if it names a default branch, andoutput-pathcan't escape the workspace.Verification
actionlintclean,zizmorclean (one commented suppression:persist-credentials: true, because the job's whole purpose is a commit-back).node --checkof the generator recovered exactly as the shell sees it after YAML strips the run block's indentation. Proven with a negative control: injecting a syntax error fails the test.8288ada60e169c3b968cd7ca38a7c6491dec7c6c.@coderabbitai review