Complete secure GraphRAG assistant experience#40
Merged
Conversation
|
Warning Review limit reached
Next review available in: 33 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (10)
📝 WalkthroughWalkthroughThe change adds immutable graph-processing profiles, profile-aware graph indexing, citation-number propagation through assistant responses, OpenTelemetry GraphRAG events, secure media-type handling, offline evaluation tooling, and CI jobs for evaluation and browser tests. ChangesAssistant citations and source previews
Graph-processing profiles and indexing
Observability and upload handling
Evaluation and CI
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
Sequence Diagram(s)Assistant citation flowsequenceDiagram
participant AssistantService
participant AssistantController
participant UiMessageStream
participant AssistantAnswer
AssistantService->>AssistantController: return numbered citations
AssistantController->>UiMessageStream: emit source-url metadata
UiMessageStream->>AssistantAnswer: deliver citation number and source URL
AssistantAnswer->>AssistantAnswer: render citation marker as button
Graph indexing flowsequenceDiagram
participant GraphIndexLifecycleService
participant GraphIndexJobQueue
participant GraphProcessingProfileRegistry
participant GraphIndexingProcessor
participant GraphRagEventSink
GraphIndexLifecycleService->>GraphIndexJobQueue: enqueue current profile
GraphIndexJobQueue->>GraphProcessingProfileRegistry: resolve profile
GraphIndexJobQueue->>GraphIndexJobQueue: persist profile-aware job
GraphIndexingProcessor->>GraphIndexingProcessor: execute extraction, merge, embed, publish
GraphIndexingProcessor->>GraphRagEventSink: emit stage events
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
apps/worker/src/test/java/com/orgmemory/worker/graph/GraphIndexingProcessorTests.java (1)
88-89: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRemove the now-unused
routes.resolve(GRAPH_EXTRACTION)stub.
GraphIndexingProcessorbuilds the extraction route directly fromextractionProfile.provider()andextractionProfile.model(), soroutes.resolve(AiWorkload.GRAPH_EXTRACTION)is not exercised by this happy path. The stub that returns"gpt-5.6-sol"can be removed and replaced, if needed by strict stubbing, withnever(routes.resolve(AiWorkload.GRAPH_EXTRACTION))or another intentional assertion. Applies to line 112-113 as well, where the stubbedextractors.create(...)target has changed.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/worker/src/test/java/com/orgmemory/worker/graph/GraphIndexingProcessorTests.java` around lines 88 - 89, Remove the unused routes.resolve(AiWorkload.GRAPH_EXTRACTION) stub from GraphIndexingProcessorTests, including the corresponding occurrence near the later test lines. Update the affected extractors.create(...) stubbing to target the route built from extractionProfile.provider() and extractionProfile.model(); if strict stubbing requires an explicit expectation, assert that routes.resolve(AiWorkload.GRAPH_EXTRACTION) is never called.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 126: Update every GitHub Actions uses reference in the ci workflow from
mutable tags to the corresponding full immutable commit SHA, including
actions/checkout@v7.0.1. Add or preserve an adjacent Dependabot version comment
for each pinned action so future updates remain discoverable.
In
`@apps/api/src/main/java/com/orgmemory/api/knowledge/CitationContentController.java`:
- Around line 71-93: Extract the extension-to-media-type allowlist from
CitationContentController.safeMediaType into a shared core utility, enum, or
map, including the canonical .md mapping. Update
apps/api/src/main/java/com/orgmemory/api/knowledge/CitationContentController.java:71-93
to consume it, and update
core/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.java:135-144
so canonicalMediaType uses the same mapping instead of its local literals;
ensure both sites resolve every supported extension consistently.
In `@core/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobQueue.java`:
- Around line 67-102: Replace the hand-written SQL insert in the job enqueue
method with construction of a GraphIndexJob entity and persistence through
jobs.save(...), preserving the existing field values, defaults,
conflict/idempotency behavior, and scheduling data. Use GraphIndexJob’s entity
mapping as the single source of truth instead of duplicating its column list.
In
`@core/src/main/java/com/orgmemory/core/knowledge/GraphIndexLifecycleService.java`:
- Around line 84-95: Update the asset and version lookups in the relevant
GraphIndexLifecycleService method to replace both bare orElseThrow() calls with
descriptive IllegalStateException failures. Distinguish missing or archived
assets from assets whose current version is missing or not ACTIVE, while
preserving the existing filtering and currentVersionId validation.
In `@core/src/main/resources/db/migration/V1__baseline.sql`:
- Around line 367-374: Leave the existing V1 migration unchanged to preserve
Flyway checksums. Move the graph_processing_profiles table and all related
column, uniqueness, and foreign-key changes from the affected V1 sections into a
new versioned migration. In that migration, safely handle and backfill
pre-existing graph_index_jobs rows before enforcing the non-null profile
reference, then apply the constraints and indexes.
In `@evaluation/oracle/generate_lightrag_v1_5_4.py`:
- Around line 79-97: The load_upstream_weighted_polling function currently
executes only the extracted function, omitting upstream module context required
by pick_by_weighted_polling. Update it to load lightrag/utils.py through the
same importlib-based flow used by load_upstream_chunker, or execute the complete
module globals, then retrieve and return pick_by_weighted_polling from that
context.
In `@evaluation/src/orgmemory_eval/models.py`:
- Around line 9-15: Update the model containing case_id, question,
reference_answer, answer, contexts, citation_ids, and latency_ms to reject
whitespace-only semantic strings, including case IDs, questions, answers, and
citation IDs, while preserving existing length constraints. Add validation that
ensures latency_ms is finite as well as nonnegative, and apply equivalent
whitespace validation to relevant context/reference fields without altering
valid nonblank inputs.
- Line 15: Update the latency_ms field definition in the relevant model to
retain the non-negative constraint while setting allow_inf_nan=False, rejecting
both positive infinity and NaN before serialization. Add validation coverage for
inf and nan inputs.
In `@evaluation/src/orgmemory_eval/ragas_runner.py`:
- Around line 62-69: Update the argument validation in the parser flow to reject
timeout-seconds values below 1, alongside the existing max-workers validation.
Use parser.error with a clear --timeout-seconds message, while preserving valid
positive timeout values.
- Around line 51-69: Update the argument validation in the parser setup before
returning from the argument-parsing function to resolve args.input and
args.output and reject them when they refer to the same path, including
equivalent relative and absolute paths. Use parser.error with a clear message,
while preserving the existing trials and max-workers validation.
---
Outside diff comments:
In
`@apps/worker/src/test/java/com/orgmemory/worker/graph/GraphIndexingProcessorTests.java`:
- Around line 88-89: Remove the unused
routes.resolve(AiWorkload.GRAPH_EXTRACTION) stub from
GraphIndexingProcessorTests, including the corresponding occurrence near the
later test lines. Update the affected extractors.create(...) stubbing to target
the route built from extractionProfile.provider() and extractionProfile.model();
if strict stubbing requires an explicit expectation, assert that
routes.resolve(AiWorkload.GRAPH_EXTRACTION) is never called.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ad1c43d8-7a27-4c33-8c5e-9fb45bc7d980
⛔ Files ignored due to path filters (9)
contracts/openapi.jsonis excluded by!contracts/openapi.jsondocs/research/lightrag-v1.5.4-parity-manifest.mdis excluded by!docs/**docs/runbooks/graph-rag-production-hardening.mdis excluded by!docs/**docs/specs/domains/assistant-and-mcp.mdis excluded by!docs/**docs/specs/domains/knowledge-ingestion.mdis excluded by!docs/**docs/specs/domains/secure-graph-rag.mdis excluded by!docs/**docs/tests/domains/assistant-and-mcp.mdis excluded by!docs/**evaluation/uv.lockis excluded by!**/*.lockweb/pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml,!**/pnpm-lock.yaml
📒 Files selected for processing (91)
.github/workflows/ci.yml.gitignoreapps/api/build.gradle.ktsapps/api/src/main/java/com/orgmemory/api/OrgMemoryApiApplication.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantStreamPart.javaapps/api/src/main/java/com/orgmemory/api/assistant/UiMessageStream.javaapps/api/src/main/java/com/orgmemory/api/knowledge/CitationContentController.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeAssetLifecycleController.javaapps/api/src/main/java/com/orgmemory/api/source/SourceController.javaapps/api/src/main/resources/application.ymlapps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.javaapps/api/src/test/java/com/orgmemory/api/assistant/UiMessageStreamTests.javaapps/api/src/test/java/com/orgmemory/api/knowledge/CitationContentControllerTests.javaapps/api/src/test/java/com/orgmemory/api/source/SourceUploadIntegrationTests.javaapps/worker/build.gradle.ktsapps/worker/src/main/java/com/orgmemory/worker/OrgMemoryWorkerApplication.javaapps/worker/src/main/java/com/orgmemory/worker/graph/GraphIndexingProcessor.javaapps/worker/src/main/java/com/orgmemory/worker/graph/GraphIndexingProperties.javaapps/worker/src/main/java/com/orgmemory/worker/graph/GraphPublicationCommitter.javaapps/worker/src/main/java/com/orgmemory/worker/graph/SpringAiGraphExtractorFactory.javaapps/worker/src/main/resources/application.ymlapps/worker/src/test/java/com/orgmemory/worker/graph/GraphIndexingProcessorTests.javaapps/worker/src/test/java/com/orgmemory/worker/graph/GraphPublicationCommitterTests.javaapps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.javacomponents/graph-rag-core/build.gradle.ktscomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/extraction/LightRagExtractionPrompt.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/indexing/GraphContributionAssembler.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/indexing/LightRagEmbeddingPayloads.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/observability/GraphRagEventSink.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphProjectionManifest.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphRevisionProjection.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/processing/GraphProcessingProfile.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/processing/LightRagGraphProcessingProfiles.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/indexing/LightRagEmbeddingPayloadsTests.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/observability/GraphRagEventSinkTests.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/port/GraphProjectionManifestTests.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/processing/GraphProcessingProfileTests.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/query/LightRagUpstreamOracleTests.javacore/src/main/java/com/orgmemory/core/assistant/AssistantCitation.javacore/src/main/java/com/orgmemory/core/assistant/AssistantPromptFactory.javacore/src/main/java/com/orgmemory/core/assistant/AssistantService.javacore/src/main/java/com/orgmemory/core/assistant/AssistantTurn.javacore/src/main/java/com/orgmemory/core/knowledge/ClaimedGraphIndex.javacore/src/main/java/com/orgmemory/core/knowledge/CreateUploadSourceCommand.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJob.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobQueue.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobRepository.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobView.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexLifecycleService.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexingCoordinator.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRef.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRegistry.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRepository.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileResolver.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProperties.javacore/src/main/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalConfiguration.javacore/src/main/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalService.javacore/src/main/java/com/orgmemory/core/knowledge/PersistedGraphProcessingProfile.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.javacore/src/main/resources/db/migration/V1__baseline.sqlcore/src/test/java/com/orgmemory/core/assistant/AssistantServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/GraphIndexLifecycleServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/GraphIndexingCoordinatorTests.javacore/src/test/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalServiceTests.javacore/src/test/java/com/orgmemory/core/knowledge/SourceUploadServiceTests.javaevaluation/README.mdevaluation/baselines/lightrag-v1.5.4-oracle.jsonevaluation/fixtures/sample-evaluation.jsonevaluation/oracle/generate_lightrag_v1_5_4.pyevaluation/pyproject.tomlevaluation/src/orgmemory_eval/__init__.pyevaluation/src/orgmemory_eval/models.pyevaluation/src/orgmemory_eval/ragas_runner.pyevaluation/tests/test_models.pyevaluation/tests/test_ragas_runner.pyevaluation/tests/test_upstream_oracle.pyintegrations/ai-openai-compatible/src/main/java/com/orgmemory/integrations/ai/openai/OpenAiCompatibleChatModelProvider.javaintegrations/graph-rag-observability/build.gradle.ktsintegrations/graph-rag-observability/src/main/java/com/orgmemory/integrations/graphrag/observability/GraphRagObservabilityAutoConfiguration.javaintegrations/graph-rag-observability/src/main/java/com/orgmemory/integrations/graphrag/observability/OpenTelemetryGraphRagEventSink.javaintegrations/graph-rag-observability/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.importsintegrations/graph-rag-observability/src/test/java/com/orgmemory/integrations/graphrag/observability/OpenTelemetryGraphRagEventSinkTests.javasettings.gradle.ktsweb/package.jsonweb/playwright.config.tsweb/src/components/ai-elements/message-response.tsxweb/src/features/assistant/components/assistant-answer.tsxweb/src/features/assistant/components/assistant-page.tsxweb/src/features/assistant/components/assistant-sources-panel.tsxweb/test/e2e/assistant-pipeline.spec.ts
💤 Files with no reviewable changes (3)
- apps/api/src/test/java/com/orgmemory/api/source/SourceUploadIntegrationTests.java
- core/src/main/java/com/orgmemory/core/knowledge/CreateUploadSourceCommand.java
- apps/api/src/main/java/com/orgmemory/api/source/SourceController.java
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Backend · Java 25
🧰 Additional context used
📓 Path-based instructions (11)
**/*
📄 CodeRabbit inference engine (CLAUDE.md)
**/*: Before changing unfamiliar Spring Boot 4, Spring Modulith 2, Spring AI 2, Gradle, React, Vite, Tailwind, or TypeScript APIs, consult Context7/current official documentation and the projectorgmemory-*verification skills.
Readdocs/guidelines/agent-safety.mdbefore retrieval, AI, MCP, permission, upload, graph, or export work.
Never commit.envfiles, provider keys, tokens, or customer data.
Run the relevant gates fromdocs/guidelines/testing-harness.md; use a terminating clean test as the context gate, and do not treatbootRunas verification.
Current behavior belongs in architecture/specs only after it exists in code; intent belongs in vision, roadmap, or an active increment, and repository state must not be duplicated across documents.
Files:
evaluation/src/orgmemory_eval/__init__.pycore/src/main/java/com/orgmemory/core/assistant/AssistantCitation.javaevaluation/pyproject.tomlintegrations/graph-rag-observability/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.importsevaluation/baselines/lightrag-v1.5.4-oracle.jsonsettings.gradle.ktscore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobView.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/observability/GraphRagEventSinkTests.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/processing/LightRagGraphProcessingProfiles.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRef.javaintegrations/graph-rag-observability/src/main/java/com/orgmemory/integrations/graphrag/observability/GraphRagObservabilityAutoConfiguration.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRepository.javaevaluation/tests/test_upstream_oracle.pyapps/api/src/main/resources/application.ymlapps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.javaintegrations/graph-rag-observability/build.gradle.ktsapps/api/src/main/java/com/orgmemory/api/OrgMemoryApiApplication.javaapps/api/build.gradle.ktscore/src/main/java/com/orgmemory/core/knowledge/PersistedGraphProcessingProfile.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/indexing/LightRagEmbeddingPayloadsTests.javacore/src/test/java/com/orgmemory/core/assistant/AssistantServiceTests.javaapps/api/src/main/java/com/orgmemory/api/assistant/UiMessageStream.javaapps/worker/src/main/java/com/orgmemory/worker/OrgMemoryWorkerApplication.javaapps/api/src/test/java/com/orgmemory/api/assistant/UiMessageStreamTests.javacomponents/graph-rag-core/build.gradle.ktscore/src/main/java/com/orgmemory/core/knowledge/ClaimedGraphIndex.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/extraction/LightRagExtractionPrompt.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/query/LightRagUpstreamOracleTests.javaweb/playwright.config.tsapps/api/src/main/java/com/orgmemory/api/assistant/AssistantStreamPart.javaevaluation/README.mdcore/src/main/java/com/orgmemory/core/assistant/AssistantTurn.javaintegrations/graph-rag-observability/src/test/java/com/orgmemory/integrations/graphrag/observability/OpenTelemetryGraphRagEventSinkTests.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeAssetLifecycleController.javaintegrations/ai-openai-compatible/src/main/java/com/orgmemory/integrations/ai/openai/OpenAiCompatibleChatModelProvider.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileResolver.javacore/src/test/java/com/orgmemory/core/knowledge/GraphIndexLifecycleServiceTests.javaweb/src/components/ai-elements/message-response.tsxcomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/indexing/GraphContributionAssembler.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/port/GraphProjectionManifestTests.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/indexing/LightRagEmbeddingPayloads.javaevaluation/fixtures/sample-evaluation.jsoncore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProperties.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javaapps/worker/src/main/java/com/orgmemory/worker/graph/SpringAiGraphExtractorFactory.javacore/src/main/java/com/orgmemory/core/assistant/AssistantPromptFactory.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobRepository.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphProjectionManifest.javaapps/worker/src/main/resources/application.ymlapps/worker/build.gradle.ktscomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/processing/GraphProcessingProfileTests.javaweb/package.jsonintegrations/graph-rag-observability/src/main/java/com/orgmemory/integrations/graphrag/observability/OpenTelemetryGraphRagEventSink.javaweb/src/features/assistant/components/assistant-answer.tsxevaluation/oracle/generate_lightrag_v1_5_4.pycore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRegistry.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/observability/GraphRagEventSink.javacore/src/main/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalConfiguration.javaevaluation/tests/test_models.pyevaluation/src/orgmemory_eval/models.pycomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphRevisionProjection.javacore/src/test/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalServiceTests.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJob.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexLifecycleService.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobQueue.javacore/src/main/java/com/orgmemory/core/assistant/AssistantService.javacore/src/test/java/com/orgmemory/core/knowledge/GraphIndexingCoordinatorTests.javaapps/api/src/main/java/com/orgmemory/api/knowledge/CitationContentController.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.javaevaluation/tests/test_ragas_runner.pyapps/worker/src/test/java/com/orgmemory/worker/graph/GraphPublicationCommitterTests.javaweb/src/features/assistant/components/assistant-sources-panel.tsxcore/src/main/resources/db/migration/V1__baseline.sqlcore/src/main/java/com/orgmemory/core/knowledge/GraphIndexingCoordinator.javaapps/worker/src/main/java/com/orgmemory/worker/graph/GraphPublicationCommitter.javaweb/test/e2e/assistant-pipeline.spec.tscomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/processing/GraphProcessingProfile.javaapps/worker/src/main/java/com/orgmemory/worker/graph/GraphIndexingProcessor.javacore/src/test/java/com/orgmemory/core/knowledge/SourceUploadServiceTests.javaapps/api/src/test/java/com/orgmemory/api/knowledge/CitationContentControllerTests.javacore/src/main/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalService.javaapps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.javaevaluation/src/orgmemory_eval/ragas_runner.pyapps/worker/src/main/java/com/orgmemory/worker/graph/GraphIndexingProperties.javaweb/src/features/assistant/components/assistant-page.tsxapps/worker/src/test/java/com/orgmemory/worker/graph/GraphIndexingProcessorTests.java
**/*.{java,sql}
📄 CodeRabbit inference engine (CLAUDE.md)
Pair JPA schema changes with a Flyway migration.
Files:
core/src/main/java/com/orgmemory/core/assistant/AssistantCitation.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobView.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/observability/GraphRagEventSinkTests.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/processing/LightRagGraphProcessingProfiles.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRef.javaintegrations/graph-rag-observability/src/main/java/com/orgmemory/integrations/graphrag/observability/GraphRagObservabilityAutoConfiguration.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRepository.javaapps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.javaapps/api/src/main/java/com/orgmemory/api/OrgMemoryApiApplication.javacore/src/main/java/com/orgmemory/core/knowledge/PersistedGraphProcessingProfile.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/indexing/LightRagEmbeddingPayloadsTests.javacore/src/test/java/com/orgmemory/core/assistant/AssistantServiceTests.javaapps/api/src/main/java/com/orgmemory/api/assistant/UiMessageStream.javaapps/worker/src/main/java/com/orgmemory/worker/OrgMemoryWorkerApplication.javaapps/api/src/test/java/com/orgmemory/api/assistant/UiMessageStreamTests.javacore/src/main/java/com/orgmemory/core/knowledge/ClaimedGraphIndex.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/extraction/LightRagExtractionPrompt.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/query/LightRagUpstreamOracleTests.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantStreamPart.javacore/src/main/java/com/orgmemory/core/assistant/AssistantTurn.javaintegrations/graph-rag-observability/src/test/java/com/orgmemory/integrations/graphrag/observability/OpenTelemetryGraphRagEventSinkTests.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeAssetLifecycleController.javaintegrations/ai-openai-compatible/src/main/java/com/orgmemory/integrations/ai/openai/OpenAiCompatibleChatModelProvider.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileResolver.javacore/src/test/java/com/orgmemory/core/knowledge/GraphIndexLifecycleServiceTests.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/indexing/GraphContributionAssembler.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/port/GraphProjectionManifestTests.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/indexing/LightRagEmbeddingPayloads.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProperties.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javaapps/worker/src/main/java/com/orgmemory/worker/graph/SpringAiGraphExtractorFactory.javacore/src/main/java/com/orgmemory/core/assistant/AssistantPromptFactory.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobRepository.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphProjectionManifest.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/processing/GraphProcessingProfileTests.javaintegrations/graph-rag-observability/src/main/java/com/orgmemory/integrations/graphrag/observability/OpenTelemetryGraphRagEventSink.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRegistry.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/observability/GraphRagEventSink.javacore/src/main/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalConfiguration.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphRevisionProjection.javacore/src/test/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalServiceTests.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJob.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexLifecycleService.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobQueue.javacore/src/main/java/com/orgmemory/core/assistant/AssistantService.javacore/src/test/java/com/orgmemory/core/knowledge/GraphIndexingCoordinatorTests.javaapps/api/src/main/java/com/orgmemory/api/knowledge/CitationContentController.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.javaapps/worker/src/test/java/com/orgmemory/worker/graph/GraphPublicationCommitterTests.javacore/src/main/resources/db/migration/V1__baseline.sqlcore/src/main/java/com/orgmemory/core/knowledge/GraphIndexingCoordinator.javaapps/worker/src/main/java/com/orgmemory/worker/graph/GraphPublicationCommitter.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/processing/GraphProcessingProfile.javaapps/worker/src/main/java/com/orgmemory/worker/graph/GraphIndexingProcessor.javacore/src/test/java/com/orgmemory/core/knowledge/SourceUploadServiceTests.javaapps/api/src/test/java/com/orgmemory/api/knowledge/CitationContentControllerTests.javacore/src/main/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalService.javaapps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.javaapps/worker/src/main/java/com/orgmemory/worker/graph/GraphIndexingProperties.javaapps/worker/src/test/java/com/orgmemory/worker/graph/GraphIndexingProcessorTests.java
**/*.java
📄 CodeRabbit inference engine (CLAUDE.md)
JetBrains IDE inspection is a Java-backend gate only.
Files:
core/src/main/java/com/orgmemory/core/assistant/AssistantCitation.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobView.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/observability/GraphRagEventSinkTests.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/processing/LightRagGraphProcessingProfiles.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRef.javaintegrations/graph-rag-observability/src/main/java/com/orgmemory/integrations/graphrag/observability/GraphRagObservabilityAutoConfiguration.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRepository.javaapps/api/src/test/java/com/orgmemory/api/assistant/AssistantControllerStreamingTests.javaapps/api/src/main/java/com/orgmemory/api/OrgMemoryApiApplication.javacore/src/main/java/com/orgmemory/core/knowledge/PersistedGraphProcessingProfile.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/indexing/LightRagEmbeddingPayloadsTests.javacore/src/test/java/com/orgmemory/core/assistant/AssistantServiceTests.javaapps/api/src/main/java/com/orgmemory/api/assistant/UiMessageStream.javaapps/worker/src/main/java/com/orgmemory/worker/OrgMemoryWorkerApplication.javaapps/api/src/test/java/com/orgmemory/api/assistant/UiMessageStreamTests.javacore/src/main/java/com/orgmemory/core/knowledge/ClaimedGraphIndex.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/extraction/LightRagExtractionPrompt.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/query/LightRagUpstreamOracleTests.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantStreamPart.javacore/src/main/java/com/orgmemory/core/assistant/AssistantTurn.javaintegrations/graph-rag-observability/src/test/java/com/orgmemory/integrations/graphrag/observability/OpenTelemetryGraphRagEventSinkTests.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeAssetLifecycleController.javaintegrations/ai-openai-compatible/src/main/java/com/orgmemory/integrations/ai/openai/OpenAiCompatibleChatModelProvider.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileResolver.javacore/src/test/java/com/orgmemory/core/knowledge/GraphIndexLifecycleServiceTests.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/indexing/GraphContributionAssembler.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/port/GraphProjectionManifestTests.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/indexing/LightRagEmbeddingPayloads.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProperties.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javaapps/worker/src/main/java/com/orgmemory/worker/graph/SpringAiGraphExtractorFactory.javacore/src/main/java/com/orgmemory/core/assistant/AssistantPromptFactory.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobRepository.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphProjectionManifest.javacomponents/graph-rag-core/src/test/java/com/orgmemory/graphrag/processing/GraphProcessingProfileTests.javaintegrations/graph-rag-observability/src/main/java/com/orgmemory/integrations/graphrag/observability/OpenTelemetryGraphRagEventSink.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRegistry.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/observability/GraphRagEventSink.javacore/src/main/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalConfiguration.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/port/GraphRevisionProjection.javacore/src/test/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalServiceTests.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJob.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexLifecycleService.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobQueue.javacore/src/main/java/com/orgmemory/core/assistant/AssistantService.javacore/src/test/java/com/orgmemory/core/knowledge/GraphIndexingCoordinatorTests.javaapps/api/src/main/java/com/orgmemory/api/knowledge/CitationContentController.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.javaapps/worker/src/test/java/com/orgmemory/worker/graph/GraphPublicationCommitterTests.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexingCoordinator.javaapps/worker/src/main/java/com/orgmemory/worker/graph/GraphPublicationCommitter.javacomponents/graph-rag-core/src/main/java/com/orgmemory/graphrag/processing/GraphProcessingProfile.javaapps/worker/src/main/java/com/orgmemory/worker/graph/GraphIndexingProcessor.javacore/src/test/java/com/orgmemory/core/knowledge/SourceUploadServiceTests.javaapps/api/src/test/java/com/orgmemory/api/knowledge/CitationContentControllerTests.javacore/src/main/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalService.javaapps/worker/src/test/java/com/orgmemory/worker/ingestion/SourceIngestionPipelineIntegrationTests.javaapps/worker/src/main/java/com/orgmemory/worker/graph/GraphIndexingProperties.javaapps/worker/src/test/java/com/orgmemory/worker/graph/GraphIndexingProcessorTests.java
**/*.{ts,tsx,js,jsx,json,html,css,scss}
📄 CodeRabbit inference engine (CLAUDE.md)
Do not run JetBrains IDE inspection on TypeScript, TSX, or web configuration files.
Files:
evaluation/baselines/lightrag-v1.5.4-oracle.jsonweb/playwright.config.tsweb/src/components/ai-elements/message-response.tsxevaluation/fixtures/sample-evaluation.jsonweb/package.jsonweb/src/features/assistant/components/assistant-answer.tsxweb/src/features/assistant/components/assistant-sources-panel.tsxweb/test/e2e/assistant-pipeline.spec.tsweb/src/features/assistant/components/assistant-page.tsx
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java
⚙️ CodeRabbit configuration file
core/src/main/java/com/orgmemory/core/{authorization,knowledge,permission}/**/*.java: Treat PostgreSQL ACL evidence as canonical and OpenFGA as the relationship
authorization decision point. Authorization must fail closed. Filtering
must happen before ranking, LIMIT, graph traversal, answer generation,
export, and citation rendering. Flag metadata or timing leak paths.
Files:
core/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobView.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRef.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRepository.javacore/src/main/java/com/orgmemory/core/knowledge/PersistedGraphProcessingProfile.javacore/src/main/java/com/orgmemory/core/knowledge/ClaimedGraphIndex.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileResolver.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProperties.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobRepository.javacore/src/main/java/com/orgmemory/core/knowledge/GraphProcessingProfileRegistry.javacore/src/main/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalConfiguration.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJob.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexLifecycleService.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexJobQueue.javacore/src/main/java/com/orgmemory/core/knowledge/SourceUploadService.javacore/src/main/java/com/orgmemory/core/knowledge/GraphIndexingCoordinator.javacore/src/main/java/com/orgmemory/core/knowledge/GraphRagKnowledgeRetrievalService.java
**/*.{yml,yaml,properties}
📄 CodeRabbit inference engine (CLAUDE.md)
Keep
ddl-auto=validatein application configuration.
Files:
apps/api/src/main/resources/application.ymlapps/worker/src/main/resources/application.yml
apps/api/src/main/java/**/*.java
⚙️ CodeRabbit configuration file
apps/api/src/main/java/**/*.java: Enforce the browser-BFF and resource-server boundaries. Authentication
must resolve an active internal actor through the explicit issuer and
subject binding. Reject identity, tenant, roles, or permissions supplied
by request payloads, JWT email, or untrusted JWT role claims.
Files:
apps/api/src/main/java/com/orgmemory/api/OrgMemoryApiApplication.javaapps/api/src/main/java/com/orgmemory/api/assistant/UiMessageStream.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantStreamPart.javaapps/api/src/main/java/com/orgmemory/api/knowledge/KnowledgeAssetLifecycleController.javaapps/api/src/main/java/com/orgmemory/api/assistant/AssistantController.javaapps/api/src/main/java/com/orgmemory/api/knowledge/CitationContentController.java
**/*.{ts,tsx}
📄 CodeRabbit inference engine (CLAUDE.md)
For frontend files, use Oxlint, TypeScript typecheck, the production build, and browser tests when the UI flow matters.
Files:
web/playwright.config.tsweb/src/components/ai-elements/message-response.tsxweb/src/features/assistant/components/assistant-answer.tsxweb/src/features/assistant/components/assistant-sources-panel.tsxweb/test/e2e/assistant-pipeline.spec.tsweb/src/features/assistant/components/assistant-page.tsx
web/src/**/*.{ts,tsx}
⚙️ CodeRabbit configuration file
web/src/**/*.{ts,tsx}: OAuth access and refresh tokens must never enter browser JavaScript or
browser storage. Use the HttpOnly BFF session, CSRF-protected mutations,
generated Hey API data clients, accessible states, and both light and
dark themes. Handwritten transport is reserved for documented protocol
flows such as navigation redirects and streaming.
Files:
web/src/components/ai-elements/message-response.tsxweb/src/features/assistant/components/assistant-answer.tsxweb/src/features/assistant/components/assistant-sources-panel.tsxweb/src/features/assistant/components/assistant-page.tsx
.github/**/*.{yml,yaml}
⚙️ CodeRabbit configuration file
.github/**/*.{yml,yaml}: Require least-privilege permissions, immutable action SHAs, bounded job
timeouts, concurrency cancellation, frozen lockfiles, and no secrets in
pull-request workflows. Keep Dependabot comments beside pinned action
SHAs so action updates remain discoverable.
Files:
.github/workflows/ci.yml
core/src/main/resources/db/migration/*.sql
⚙️ CodeRabbit configuration file
core/src/main/resources/db/migration/*.sql: Flyway migrations are immutable after release. Check tenant isolation,
foreign keys, uniqueness, indexes, append-only evidence semantics, safe
defaults, and compatibility with PostgreSQL 18 plus pgvector.
Files:
core/src/main/resources/db/migration/V1__baseline.sql
🧠 Learnings (1)
📚 Learning: 2026-07-23T23:30:44.585Z
Learnt from: kl3inIT
Repo: kl3inIT/OrgMemory PR: 30
File: core/src/main/resources/db/migration/V32__evidence_scoped_graph_semantics.sql:0-0
Timestamp: 2026-07-23T23:30:44.585Z
Learning: For OrgMemory PostgreSQL Flyway migrations under core/src/main/resources/db/migration, do not recommend using `CREATE INDEX CONCURRENTLY` or `DROP INDEX CONCURRENTLY` inside application-owned Flyway migration SQL. Flyway’s schema-history connection may hold a transaction that can cause concurrent index operations to wait indefinitely (e.g., on a `virtualxid`), and docs/conventions.md forbids this pattern. If you need large production-table index replacement, pre-stage online index operations via the deployment pipeline (outside Flyway) rather than inside the migration; “ordinary” index replacement is acceptable for unreleased projections before production traffic.
Applied to files:
core/src/main/resources/db/migration/V1__baseline.sql
🪛 ast-grep (0.44.1)
integrations/graph-rag-observability/src/main/java/com/orgmemory/integrations/graphrag/observability/OpenTelemetryGraphRagEventSink.java
[warning] 60-60: Avoid using untrusted input as a setAttribute() name (trust boundary violation)
Context: span.setAttribute(OPERATION_ID, event.operationId().toString())
Note: [CWE-501] Trust Boundary Violation.
(trust-boundaries-java)
[warning] 61-61: Avoid using untrusted input as a setAttribute() name (trust boundary violation)
Context: span.setAttribute(ORGANIZATION_ID, event.organizationId().toString())
Note: [CWE-501] Trust Boundary Violation.
(trust-boundaries-java)
[warning] 62-62: Avoid using untrusted input as a setAttribute() name (trust boundary violation)
Context: span.setAttribute(STAGE, enumValue(event.stage()))
Note: [CWE-501] Trust Boundary Violation.
(trust-boundaries-java)
[warning] 63-63: Avoid using untrusted input as a setAttribute() name (trust boundary violation)
Context: span.setAttribute(OUTCOME, enumValue(event.outcome()))
Note: [CWE-501] Trust Boundary Violation.
(trust-boundaries-java)
[warning] 64-64: Avoid using untrusted input as a setAttribute() name (trust boundary violation)
Context: span.setAttribute(DURATION_NANOS, event.duration().toNanos())
Note: [CWE-501] Trust Boundary Violation.
(trust-boundaries-java)
[warning] 65-65: Avoid using untrusted input as a setAttribute() name (trust boundary violation)
Context: span.setAttribute(INPUT_COUNT, event.inputCount())
Note: [CWE-501] Trust Boundary Violation.
(trust-boundaries-java)
[warning] 66-66: Avoid using untrusted input as a setAttribute() name (trust boundary violation)
Context: span.setAttribute(OUTPUT_COUNT, event.outputCount())
Note: [CWE-501] Trust Boundary Violation.
(trust-boundaries-java)
[warning] 68-70: Avoid using untrusted input as a setAttribute() name (trust boundary violation)
Context: span.setAttribute(
MODEL_ROUTE_FINGERPRINT,
event.modelRouteFingerprint())
Note: [CWE-501] Trust Boundary Violation.
(trust-boundaries-java)
[warning] 73-73: Avoid using untrusted input as a setAttribute() name (trust boundary violation)
Context: span.setAttribute(FAILURE_CODE, event.failureCode())
Note: [CWE-501] Trust Boundary Violation.
(trust-boundaries-java)
evaluation/oracle/generate_lightrag_v1_5_4.py
[error] 95-95: The use of exec can be insecure
Context: exec(compile(module, str(source_path), "exec"), namespace)
Note: [CWE-94] Improper Control of Generation of Code ('Code Injection').
(no-exec)
[warning] 95-95: The use of compile can be insecure
Context: compile(module, str(source_path), "exec")
Note: [CWE-94] Improper Control of Generation of Code ('Code Injection').
(no-compile)
[info] 115-120: use jsonify instead of json.dumps for JSON output
Context: json.dumps(
payload,
ensure_ascii=False,
separators=(",", ":"),
sort_keys=True,
)
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
[info] 203-203: use jsonify instead of json.dumps for JSON output
Context: json.dumps(payload, ensure_ascii=False, indent=2)
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
[error] 41-47: Command coming from incoming request
Context: subprocess.run(
["git", "rev-parse", "HEAD"],
cwd=upstream,
check=True,
capture_output=True,
text=True,
)
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(subprocess-from-request)
evaluation/src/orgmemory_eval/ragas_runner.py
[info] 284-284: use jsonify instead of json.dumps for JSON output
Context: json.dumps(payload, ensure_ascii=False, indent=2)
Note: [CWE-116] Improper Encoding or Escaping of Output.
(use-jsonify)
🪛 LanguageTool
evaluation/README.md
[style] ~32-~32: Consider replacing this word to strengthen your wording.
Context: ...ases. It is a stochastic external judge and must be run in at least two trials; the...
(AND_THAT)
[grammar] ~53-~53: Use a hyphen to join words.
Context: ... ` --trials 3 ``` The API key is read only from the environment. Prompts, retr...
(QB_NEW_EN_HYPHEN)
🪛 Squawk (2.59.0)
core/src/main/resources/db/migration/V1__baseline.sql
[warning] 369-369: Using character is likely a mistake and should almost always be replaced by text or varchar.
(ban-char-field)
[warning] 1481-1481: Adding a primary key constraint requires an ACCESS EXCLUSIVE lock that will block all reads and writes to the table while the primary key index is built. Add the PRIMARY KEY constraint USING an index.
(adding-serial-primary-key-field)
🪛 zizmor (1.26.1)
.github/workflows/ci.yml
[error] 126-126: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 131-131: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 136-136: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security and latency boundary
nosniff,no-store, and inline/attachment allowlistsVerification
./gradlew --no-daemon clean build— 109 tasks, successfulgit diff --check— cleanNotes
Summary by CodeRabbit
New Features
Improvements
Tests