chore(standards): synced file(s) with hallelx2/dev-standards - #7
chore(standards): synced file(s) with hallelx2/dev-standards#7hallelx2 wants to merge 10 commits into
Conversation
Reviewer's GuideAdds standardized AI agent configuration, review rubrics, and security workflows by syncing repo with hallelx2/dev-standards. This introduces AGENTS.md, Copilot instructions, specialized agent configs, path-scoped review instructions, and reusable GitHub Actions for security scanning and optional Jules-based PR security review. Sequence diagram for jules-review GitHub Action on PRssequenceDiagram
actor Dev
participant GitHub
participant jules_review_workflow as jules-review_workflow
participant guard_step as guard_step
participant jules_pr_reviewer as sanjay3290/jules-pr-reviewer
participant Jules_API
Dev->>GitHub: open/synchronize PR
GitHub->>jules_review_workflow: trigger pull_request event
jules_review_workflow->>guard_step: run Guard step
guard_step-->>jules_review_workflow: outputs enabled=true/false
alt JULES_API_KEY present
jules_review_workflow->>jules_pr_reviewer: run Jules security review
jules_pr_reviewer->>Jules_API: call with jules-api-key and review-prompt
Jules_API-->>jules_pr_reviewer: security review result
jules_pr_reviewer-->>GitHub: post review comments on PR
else JULES_API_KEY missing
jules_review_workflow-->>GitHub: log skip message
end
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
📝 WalkthroughWalkthroughAdded repository review standards, specialized AI reviewer agents, Dependabot updates, and GitHub Actions workflows for security scanning and Jules security reviews. ChangesRepository governance and security automation
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- In
.github/workflows/security.reusable.yml, consider pinning third-party actions likegitleaks/gitleaks-action@v2andaquasecurity/trivy-action@0.28.0to specific commit SHAs rather than tags to reduce supply-chain risk. - In the
go-sastjob,securego/gosec@masteris tracking a moving branch; using a tagged release or commit SHA would make the workflow behavior more deterministic and auditable.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In `.github/workflows/security.reusable.yml`, consider pinning third-party actions like `gitleaks/gitleaks-action@v2` and `aquasecurity/trivy-action@0.28.0` to specific commit SHAs rather than tags to reduce supply-chain risk.
- In the `go-sast` job, `securego/gosec@master` is tracking a moving branch; using a tagged release or commit SHA would make the workflow behavior more deterministic and auditable.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
1ac2a93 to
1d756e1
Compare
There was a problem hiding this comment.
Pull request overview
This PR syncs shared AI agent guidance and security automation from hallelx2/dev-standards into the pdftable repository, standardizing how automated reviewers operate and adding baseline security scanning workflows.
Changes:
- Adds a repo-level AI agent brief (
AGENTS.md) plus baseline Copilot review instructions. - Introduces specialized agent profiles and path-scoped review rubrics for backend/frontend/security.
- Adds a reusable security scanning workflow (gitleaks, Trivy, gosec) and an optional Jules PR review workflow.
Reviewed changes
Copilot reviewed 12 out of 12 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
| AGENTS.md | Adds shared agent brief and engineering/review standards for the repo. |
| .github/copilot-instructions.md | Defines baseline Copilot PR review guidance and expectations. |
| .github/agents/backend-reviewer.agent.md | Adds a Go-focused reviewer profile. |
| .github/agents/frontend-reviewer.agent.md | Adds a TS/Next-focused reviewer profile. |
| .github/agents/security-reviewer.agent.md | Adds a security-focused reviewer profile and threat checklist. |
| .github/agents/test-reliability-reviewer.agent.md | Adds a test quality/determinism reviewer profile. |
| .github/instructions/backend.instructions.md | Adds path-scoped Go review rubric. |
| .github/instructions/frontend.instructions.md | Adds path-scoped TS/Next/CSS review rubric. |
| .github/instructions/security.instructions.md | Adds path-scoped security review rubric. |
| .github/workflows/security.yml | Adds caller workflow to run the reusable security scanners on PRs and main pushes. |
| .github/workflows/security.reusable.yml | Implements the reusable security scanning jobs (gitleaks/Trivy/gosec). |
| .github/workflows/jules-review.yml | Adds optional automated Jules PR security review workflow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| uses: ./.github/workflows/security.reusable.yml | ||
| secrets: inherit |
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| security-events: write | ||
|
|
| - name: gosec | ||
| if: steps.detect.outputs.is_go == 'true' | ||
| uses: securego/gosec@master | ||
| with: |
| - name: Trivy filesystem scan | ||
| uses: aquasecurity/trivy-action@0.28.0 | ||
| with: | ||
| scan-type: fs | ||
| scanners: vuln,secret,misconfig | ||
| severity: HIGH,CRITICAL | ||
| ignore-unfixed: true | ||
| format: table | ||
| exit-code: '0' # report-only to start; flip to '1' once the baseline is clean | ||
|
|
| - name: Jules security review | ||
| if: steps.guard.outputs.enabled == 'true' | ||
| uses: sanjay3290/jules-pr-reviewer@main | ||
| with: | ||
| jules-api-key: ${{ secrets.JULES_API_KEY }} | ||
| github-token: ${{ github.token }} |
| @@ -0,0 +1,22 @@ | |||
| # Copilot review — baseline | |||
|
|
|||
| You are reviewing a pull request for the Vectorless codebase. Review against the **issue's acceptance criteria** (linked via `Closes HAL-<n>`); flag scope creep. Be concrete: cite `file:line`, explain the risk, propose the fix. Prefer fewer, high-confidence findings over noise. | |||
1d756e1 to
ce0b57c
Compare
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
bfebb81 to
1b93b46
Compare
a4ef865 to
611db59
Compare
611db59 to
83686fd
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # Local reference — the reusable file is synced into THIS repo too, so each repo | ||
| # is self-contained and this works whether dev-standards is public or private. | ||
| uses: ./.github/workflows/security.reusable.yml | ||
| secrets: inherit |
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Install Trivy (latest binary — avoids the action's broken setup-trivy pin) | ||
| run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin |
| name: Vulns + misconfig (Trivy) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| id: detect | ||
| run: | | ||
| if ls requirements*.txt pyproject.toml setup.py >/dev/null 2>&1; then echo "is_py=true" >> "$GITHUB_OUTPUT"; else echo "is_py=false" >> "$GITHUB_OUTPUT"; fi | ||
| - uses: actions/setup-python@v5 |
| name: Python deps + SAST (pip-audit + bandit) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - uses: gitleaks/gitleaks-action@v2 |
| name: Secrets (gitleaks) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 |
| - package-ecosystem: npm | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 5 | ||
| labels: [dependencies, security] |
| - package-ecosystem: gomod | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 5 | ||
| labels: [dependencies, security] |
| - package-ecosystem: github-actions | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| labels: [dependencies, security] |
dc14cd0 to
58b3d31
Compare
58b3d31 to
a5c4207
Compare
a5c4207 to
0364264
Compare
Synced AI-review standards from hallelx2/dev-standards.
…m remote '.github/copilot-instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…b/agents/' Synced AI-review standards from hallelx2/dev-standards.
…tions.md' from remote '.github/instructions/backend.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…ctions.md' from remote '.github/instructions/frontend.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
…ctions.md' from remote '.github/instructions/security.instructions.md' Synced AI-review standards from hallelx2/dev-standards.
… remote '.github/workflows/security.yml' Synced AI-review standards from hallelx2/dev-standards.
…yml' from remote '.github/workflows/security.reusable.yml' Synced AI-review standards from hallelx2/dev-standards.
…from remote '.github/workflows/jules-review.yml' Synced AI-review standards from hallelx2/dev-standards.
…'.github/dependabot.yml' Synced AI-review standards from hallelx2/dev-standards.
0364264 to
fd2db57
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🧹 Nitpick comments (1)
AGENTS.md (1)
12-12: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winMake the completion checks complete and executable.
Line 12 requires build, tests, and lint, but the examples omit lint. Line 24 requires
go test -race, but Line 12 lists onlygo test ./....Define repository-specific build, test, and lint commands. Include
go test -race ./...for Go repositories.Based on learnings: “Consider work done only after running the real build, tests, and lint checks, including the applicable Go or JavaScript build commands.”
Also applies to: 22-24
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@AGENTS.md` at line 12, Update the completion-check guidance in AGENTS.md to define executable repository-specific build, test, and lint commands, including lint in the JavaScript examples and the applicable JavaScript build commands. Ensure the Go checks include go build ./..., go test -race ./..., and the repository’s lint command, keeping the “Done” requirement aligned with the real build, tests, and lint checks.Source: Learnings
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/copilot-instructions.md:
- Line 22: Update the guidance in the specialized-review paragraph to state that
path-scoped files in .github/instructions/ apply automatically only when their
applyTo pattern matches, while custom agents in .github/agents/ require explicit
selection or assignment. Remove the claim that specialized agents apply
automatically, and preserve the explicit security-finding guidance.
In @.github/dependabot.yml:
- Around line 5-24: Add a Dependabot update entry for the pip package ecosystem
alongside the existing npm and gomod entries, targeting the repository root and
using the same weekly schedule, pull-request limit, and dependency/security
labels. Configure its directory to match the project’s Python dependency
manifest location.
In @.github/workflows/security.reusable.yml:
- Line 33: Update the Semgrep container image reference in the workflow’s image
configuration to use the reviewed release’s immutable SHA256 digest instead of
the mutable semgrep/semgrep tag.
- Around line 112-125: Update the pip-audit step in the Python-project path to
audit repository manifests rather than only the current environment: run
pip-audit . when pyproject.toml is present, and run pip-audit -r
"$requirements_file" for each matching requirements file. Preserve the existing
Python-project detection condition and keep Bandit under that condition.
In `@AGENTS.md`:
- Around line 32-34: Define one complete AES-256-GCM BYOK standard in AGENTS.md,
including fresh unique nonces per encryption key, authenticated-tag
verification, envelope encryption with managed key storage, key rotation,
tenant-scoped access, and prohibition of plaintext keys in logs, responses, and
client bundles. Mirror the complete rule in .github/copilot-instructions.md,
require nonce uniqueness and key-lifecycle checks in
.github/instructions/security.instructions.md, and update
.github/agents/security-reviewer.agent.md to verify all the same controls.
---
Nitpick comments:
In `@AGENTS.md`:
- Line 12: Update the completion-check guidance in AGENTS.md to define
executable repository-specific build, test, and lint commands, including lint in
the JavaScript examples and the applicable JavaScript build commands. Ensure the
Go checks include go build ./..., go test -race ./..., and the repository’s lint
command, keeping the “Done” requirement aligned with the real build, tests, and
lint checks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 6f1fde29-9b8c-40e7-ba0a-8dc8f4fe8a88
📒 Files selected for processing (13)
.github/agents/backend-reviewer.agent.md.github/agents/frontend-reviewer.agent.md.github/agents/security-reviewer.agent.md.github/agents/test-reliability-reviewer.agent.md.github/copilot-instructions.md.github/dependabot.yml.github/instructions/backend.instructions.md.github/instructions/frontend.instructions.md.github/instructions/security.instructions.md.github/workflows/jules-review.yml.github/workflows/security.reusable.yml.github/workflows/security.ymlAGENTS.md
| - New dependencies: justified, reputable, no known CVEs. | ||
| - Concurrency (Go): data races, unguarded shared state, leaked goroutines. | ||
|
|
||
| For deeper, area-specific review, the specialized agents in `.github/agents/` and the path-scoped rubrics in `.github/instructions/` apply automatically. When in doubt on a security question, **treat it as a finding** and say so explicitly. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== candidate files =="
git ls-files | rg '(^|/)(copilot-instructions\.md|agents|instructions)' || true
echo
echo "== .github/copilot-instructions.md =="
if [ -f .github/copilot-instructions.md ]; then
nl -ba .github/copilot-instructions.md | sed -n '1,120p'
fi
echo
echo "== .github/agents =="
if [ -d .github/agents ]; then
find .github/agents -maxdepth 3 -type f -print | sort | while read -r f; do
echo "--- $f"
nl -ba "$f" | sed -n '1,160p'
done
fi
echo
echo "== .github/instructions =="
if [ -d .github/instructions ]; then
find .github/instructions -maxdepth 3 -type f -print | sort | while read -r f; do
echo "--- $f"
nl -ba "$f" | sed -n '1,160p'
done
fiRepository: hallelx2/pdftable
Length of output: 601
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== .github/copilot-instructions.md =="
if [ -f .github/copilot-instructions.md ]; then
awk '{printf "%6d %s\n", NR, $0}' .github/copilot-instructions.md | sed -n '1,120p'
fi
echo
echo "== custom agent files =="
for f in .github/agents/*.agent.md; do
[ -f "$f" ] || continue
echo "--- $f"
awk '{printf "%6d %s\n", NR, $0}' "$f" | sed -n '1,180p'
done
echo
echo "== instruction files =="
for f in .github/instructions/*.instructions.md; do
[ -f "$f" ] || continue
echo "--- $f"
awk '{printf "%6d %s\n", NR, $0}' "$f" | sed -n '1,160p'
doneRepository: hallelx2/pdftable
Length of output: 11865
🌐 Web query:
GitHub Copilot custom agents applyTo path-specific instruction files automatic selection documentation
💡 Result:
In GitHub Copilot, path-specific instruction files are configured using *.instructions.md files, which allow you to define instructions that are applied automatically based on the files or directories currently being accessed [1][2][3]. Key details for implementation include: 1. Storage Location: These files should be stored within or below the .github/instructions directory in your repository [1][4][5]. 2. Configuration: Each .instructions.md file must include a YAML frontmatter block at the start of the file that defines the applyTo property [1][3]. This property uses glob syntax to determine which files the instructions apply to [1][2][3]. Example configuration: --- applyTo: "app/models//*.rb" --- 3. Automatic Selection: GitHub Copilot automatically selects and applies these instructions when the path of the file being worked on matches the glob pattern specified in the applyTo field [1][3]. If no applyTo property is defined, the instructions will not be applied automatically, though they may still be available for manual selection in some interfaces [3]. 4. Multiple Patterns: You can specify multiple patterns within the applyTo field by separating them with commas (e.g., applyTo: "/*.ts,/*.tsx") [1][2]. 5. Scope and Precedence: When a path matches, these path-specific instructions are used alongside repository-wide custom instructions (defined in .github/copilot-instructions.md) if they exist [1][5]. You can verify which instructions were applied by checking the References section of a Copilot chat response [3]. This functionality is supported in various Copilot features, including Copilot Chat in IDEs like Visual Studio Code and Visual Studio, as well as the Copilot cloud agent [4][6]. While custom agents (defined in files like AGENTS.md) and path-specific instructions both serve to customize behavior, they are distinct mechanisms; custom agents define broader agent profiles, whereas *.instructions.md files provide targeted, file-context-aware instructions [4][5][7].
Citations:
- 1: https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/add-custom-instructions/add-repository-instructions
- 2: https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/add-custom-instructions
- 3: https://code.visualstudio.com/docs/agent-customization/custom-instructions
- 4: https://docs.github.com/en/copilot/reference/custom-instructions-support
- 5: https://docs.github.com/en/copilot/concepts/prompting/response-customization?tool=eclipse
- 6: https://docs.github.com/en/copilot/tutorials/customization-library/custom-instructions/your-first-custom-instructions
- 7: https://docs.github.com/en/copilot/concepts/agents/copilot-cli/about-custom-agents
🌐 Web query:
GitHub Copilot custom agents *.agent.md automatic selection agents panel profile selection applyTo instructions
💡 Result:
GitHub Copilot custom agents are defined using Markdown files with the .agent.md extension [1][2]. These files use YAML frontmatter to configure the agent's identity, behavioral instructions, and capabilities [3][4]. Automatic Selection and the Agents Panel GitHub Copilot can automatically select and use a custom agent based on the task context [5]. Key configuration properties in the .agent.md file control this behavior: - disable-model-invocation: If set to true, this prevents Copilot from automatically using the agent based on task context; the agent must then be selected manually [5]. - user-invocable: If set to false, the agent cannot be manually selected by a user and is restricted to programmatic access [5]. - infer (Retired): Previously used to control automatic selection; it is now recommended to use disable-model-invocation and user-invocable instead [5]. In IDEs and GitHub interfaces, users can typically select agents manually from an agents panel, dropdown, or tab when initiating a new session [6][7][8]. Instructions and applyTo While custom agents use .agent.md files for their core definition [1][4], separate instruction files often use the *.instructions.md format [9][10]. These instruction files utilize the applyTo property to manage scope [9][11]: - applyTo: This property accepts glob patterns to specify which files or directories the instructions apply to [9][11][10]. For example, applyTo: "/*.ts" would apply the instructions to all TypeScript files [11][10]. If this property is omitted, the instructions may not be applied automatically [9]. - Custom Agent Instructions: Within an .agent.md file, the behavioral instructions are defined in the Markdown content below the YAML frontmatter [4][12]. These instructions guide the agent's expertise, constraints, and behavior during its execution [4][2]. In summary, .agent.md files define the custom agent itself, while *.instructions.md files are often used for repository-wide or path-specific behavioral rules governed by the applyTo property [9][13][10].
Citations:
- 1: https://code.visualstudio.com/docs/agent-customization/custom-agents
- 2: https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/create-custom-agents-for-cli
- 3: https://github.com/github/docs/blob/main/content/copilot/how-tos/use-copilot-agents/coding-agent/create-custom-agents.md
- 4: https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/create-custom-agents
- 5: https://github.com/github/docs/blob/main/content/copilot/reference/custom-agents-configuration.md
- 6: https://docs.github.com/en/copilot/how-tos/copilot-on-github/use-copilot-agents/overview
- 7: https://docs.github.com/en/copilot/how-tos/copilot-cli/use-copilot-cli/invoke-custom-agents
- 8: https://github.com/github/docs/blob/main/content/copilot/concepts/agents/cloud-agent/agent-management.md
- 9: https://code.visualstudio.com/docs/agent-customization/custom-instructions
- 10: https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/add-custom-instructions/add-repository-instructions
- 11: https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/add-custom-instructions
- 12: https://docs.github.com/en/copilot/how-tos/use-copilot-agents/cloud-agent/create-custom-agents-in-your-ide?tool=vscode
- 13: https://code.visualstudio.com/docs/agents/guides/customize-copilot-guide
Do not claim that custom agents apply automatically.
Path-specific .github/instructions/ files apply automatically when applyTo matches. Custom agents in .github/agents/ require explicit selection or assignment; do not present them as already running.
🧰 Tools
🪛 LanguageTool
[uncategorized] ~22-~22: The official name of this software platform is spelled with a capital “H”.
Context: ...cific review, the specialized agents in .github/agents/ and the path-scoped rubrics in...
(GITHUB)
[uncategorized] ~22-~22: The official name of this software platform is spelled with a capital “H”.
Context: ...agents/and the path-scoped rubrics in.github/instructions/` apply automatically. Whe...
(GITHUB)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/copilot-instructions.md at line 22, Update the guidance in the
specialized-review paragraph to state that path-scoped files in
.github/instructions/ apply automatically only when their applyTo pattern
matches, while custom agents in .github/agents/ require explicit selection or
assignment. Remove the claim that specialized agents apply automatically, and
preserve the explicit security-finding guidance.
| updates: | ||
| - package-ecosystem: github-actions | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| labels: [dependencies, security] | ||
|
|
||
| - package-ecosystem: gomod | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 5 | ||
| labels: [dependencies, security] | ||
|
|
||
| - package-ecosystem: npm | ||
| directory: "/" | ||
| schedule: | ||
| interval: weekly | ||
| open-pull-requests-limit: 5 | ||
| labels: [dependencies, security] |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Tracked files relevant to Dependabot/workflows:\n'
git ls-files | rg '(^|/)\.github/(dependabot\.yml|workflows/|pyproject\.toml|requirements|setup\.py|poetry\.lock|Pipfile\.lock)' || true
printf '\nCurrent .github/dependabot.yml:\n'
cat -n .github/dependabot.yml
printf '\nSearch for python dependency scanning declarations:\n'
rg -n "python|pip|safety|bandit|security|oss-supplier|dependency|dependabot|package-ecosystem" .github -S || true
printf '\nSearch for pip ecosystems in dependabot files:\n'
rg -n "package-ecosystem:\s*(pip|poetry|requirements)" .github || trueRepository: hallelx2/pdftable
Length of output: 7039
🌐 Web query:
GitHub Dependabot package-ecosystem pip depends on requirements.txt setup.py pyproject.toml
💡 Result:
To configure Dependabot to monitor your Python dependency files, use the pip package ecosystem in your .github/dependabot.yml file [1][2][3]. Dependabot supports requirements.txt, setup.py, and pyproject.toml files under this single ecosystem [4][5][6]. Configuration Details: - Ecosystem Name: Use package-ecosystem: "pip" [1][2][6]. - File Support: Dependabot monitors requirements.txt (any .txt file), setup.py, and pyproject.toml (if it follows PEP 621) when configured with the pip ecosystem [5][6]. It also supports related files like setup.cfg [5]. - Directory Configuration: Specify the directory where these files are located (e.g., directory: "/") [3]. To ensure Dependabot scans nested directories, you can use patterns like directory: "//*" [7]. Common Setup: A standard dependabot.yml configuration for a Python project typically looks like this [3]: version: 2 updates: - package-ecosystem: "pip" directory: "/" schedule: interval: "weekly" Important Considerations: - Grouped Updates: If you have multiple dependency files (e.g., both a pyproject.toml and a requirements.txt) and want them updated together, you may need to use Dependabot's grouping feature to prevent separate, uncoordinated pull requests [7][4]. - Limitations: Dependabot's ability to keep requirements.txt files synchronized with pyproject.toml changes—especially if the requirements file is generated by an external tool like pip-compile—can vary [8][9]. In some cases, Dependabot may update the pyproject.toml but not the associated requirements.txt if the relationship between the two is not natively recognized by its update logic [9]. If you rely on external tools to sync these files, you may need to manage those updates outside of standard Dependabot version updates or ensure the files are in locations Dependabot consistently crawls [7][9].
Citations:
- 1: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference
- 2: https://help.github.com/en/enterprise-server@3.5/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
- 3: https://docs.github.com/en/copilot/tutorials/copilot-cookbook/analyze-security/manage-dependency-updates
- 4: https://til.simonwillison.net/github/dependabot-python-setup
- 5: https://github.com/dependabot/dependabot-core/blob/748aac6e/python/lib/dependabot/python/file_fetcher.rb
- 6: https://docs.github.com/en/enterprise-server@3.13/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories
- 7: pip configuration does not recurse with pyproject.toml files dependabot/dependabot-core#14569
- 8: How to get updates for a pyproject.toml/requirements.txt setup? dependabot/dependabot-core#9455
- 9: pip no longer updates requirement files along with pyproject dependabot/dependabot-core#11750
🌐 Web query:
site:docs.github.com/dependabot/generate-dependabot.yml gomod npm pip
💡 Result:
Use these package-ecosystem values in .github/dependabot.yml:
version: 2
updates:
- package-ecosystem: "gomod"
directory: "/"
schedule:
interval: "weekly"
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "weekly"
- package-ecosystem: "pip"
directory: "/"
schedule:
interval: "weekly"gomod is for Go modules; npm covers npm, Yarn, and pnpm; pip also covers pipenv and Poetry projects. [1][2]
Add pip updates to Dependabot.
Dependabot supports package-ecosystem: pip for Python requirement files, and target repositories synced to this config will not get Python update PRs without it. Add the same format as the existing npm/gomod update entries, with dependency manifest support matching the project.
🧰 Tools
🪛 GitHub Check: Semgrep OSS
[warning] 19-24: Semgrep Finding: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown
This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a cooldown block with default-days: 7 to each package-ecosystem entry under updates to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
[warning] 12-17: Semgrep Finding: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown
This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a cooldown block with default-days: 7 to each package-ecosystem entry under updates to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
[warning] 6-10: Semgrep Finding: package_managers.dependabot.dependabot-missing-cooldown.dependabot-missing-cooldown
This Dependabot configuration does not set a cooldown period. Newly published packages can be malicious or unstable. Add a cooldown block with default-days: 7 to each package-ecosystem entry under updates to wait 7 days before proposing updates to newly published package versions. Reference: https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#cooldown
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/dependabot.yml around lines 5 - 24, Add a Dependabot update entry
for the pip package ecosystem alongside the existing npm and gomod entries,
targeting the repository root and using the same weekly schedule, pull-request
limit, and dependency/security labels. Configure its directory to match the
project’s Python dependency manifest location.
| name: SAST — OWASP Top 10 + CWE Top 25 (Semgrep) | ||
| runs-on: ubuntu-latest | ||
| container: | ||
| image: semgrep/semgrep |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Tracked workflow file location:"
git ls-files .github/workflows/security*
echo
echo "Relevant workflow content:"
if [ -f .github/workflows/security.reusable.yml ]; then
nl -ba .github/workflows/security.reusable.yml | sed -n '1,120p'
fi
echo
echo "Search for Semgrep image references:"
rg -n "semgrep/semgrep|image: " .github/workflows/security.reusable.yml || trueRepository: hallelx2/pdftable
Length of output: 327
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Relevant workflow snippets:"
awk '{printf "%8d %s\n", NR, $0}' .github/workflows/security.reusable.yml | sed -n '1,120p'
echo
echo "Semgrep image references in workflow:"
grep -n "semgrep/semgrep\|image:" .github/workflows/security.reusable.yml || true
echo
echo "Check whether image reference has a digest:"
python3 - <<'PY'
from pathlib import Path
for line in Path(".github/workflows/security.reusable.yml").read_text().splitlines():
stripped = line.strip()
if stripped.startswith("image:") or stripped.startswith("image= "):
value = stripped.split("=", 1)[1] if "=" in stripped else stripped.split(None, 1)[1]
print(value, "has_digest:", "@" in value.split()[0])
PYRepository: hallelx2/pdftable
Length of output: 5446
Pin the Semgrep container image to its SHA256 digest.
semgrep/semgrep is mutable by tag. A SHA256 digest can identify the reviewed Semgrep release as fixed image content.
Proposed fix
- image: semgrep/semgrep
+ image: semgrep/semgrep@sha256:<reviewed-image-digest>🧰 Tools
🪛 zizmor (1.28.0)
[error] 33-33: unpinned image references (unpinned-images): container image is unpinned
(unpinned-images)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.reusable.yml at line 33, Update the Semgrep
container image reference in the workflow’s image configuration to use the
reviewed release’s immutable SHA256 digest instead of the mutable
semgrep/semgrep tag.
Source: Linters/SAST tools
| - name: Detect Python project | ||
| id: detect | ||
| run: | | ||
| if ls requirements*.txt pyproject.toml setup.py >/dev/null 2>&1; then echo "is_py=true" >> "$GITHUB_OUTPUT"; else echo "is_py=false" >> "$GITHUB_OUTPUT"; fi | ||
| - uses: actions/setup-python@v5 | ||
| if: steps.detect.outputs.is_py == 'true' | ||
| with: | ||
| python-version: '3.x' | ||
| - name: pip-audit (CVEs) + bandit (SAST) | ||
| if: steps.detect.outputs.is_py == 'true' | ||
| run: | | ||
| pip install --quiet pip-audit bandit | ||
| pip-audit || true | ||
| bandit -r . -ll || true |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '--- workflow excerpt ---\n'
sed -n '90,140p' .github/workflows/security.reusable.yml 2>/dev/null || true
printf '\n--- pip-auss usages ---\n'
rg -n "pip-audit|projects_file|requirement|dependencies_file|bandit" .github/workflows || true
printf '\n--- repository manifest files ---\n'
git ls-files | rg '(^|/)(requirements[^[:space:]]*\.txt|pyproject\.toml|setup\.py|setup\.cfg|Pipfile|poetry\.lock|uv\.lock|Pipfile\.lock)$' || trueRepository: hallelx2/pdftable
Length of output: 246
🌐 Web query:
pip-audit command line documentation pip-audit . local project pyproject.toml requirements.txt default behavior no arguments
💡 Result:
The pip-audit tool is a vulnerability scanner for Python projects that audits dependencies against known vulnerabilities [1][2]. Its behavior depends on the arguments provided or the presence of a specific project path [3][4]. Default Behavior (No Arguments) When run without any arguments (pip-audit), the tool defaults to auditing the current active Python environment [3][5]. It inspects the installed packages in the environment and checks them against vulnerability databases [2]. Auditing Requirements Files To audit specific dependency files, use the -r or --requirement flag [3][4]. This flag can be used multiple times to audit multiple files (e.g., pip-audit -r requirements.txt -r dev-requirements.txt) [3][4]. pip-audit supports scanning requirements.txt files [4][2]. Auditing Local Projects You can audit a local project by providing its path as a positional argument [3]. When a project path is provided, pip-audit searches for specific "project" files, such as pyproject.toml [4]. Key Flags and Options -l, --local: Limits the audit to dependencies installed in the local environment, excluding globally installed packages if applicable [3][4]. --locked: Used when auditing from a project path to specifically audit lock files (currently supporting formats like pylock.*.toml) [3][4]. -f FORMAT, --format FORMAT: Specifies the output format (e.g., columns, json, cyclonedx-json, cyclonedx-xml, markdown) [6][3]. -s SERVICE, --vulnerability-service SERVICE: Selects the vulnerability service to use (options include osv, pypi, esms) [6][3]. -S, --strict: Causes the audit to fail if dependency collection fails for any dependency [6][3]. For detailed usage information, you can run pip-audit --help in your terminal [3][4].
Citations:
- 1: https://pypi.org/project/pip-audit/
- 2: https://stackharbor.com/en/knowledge-base/python-pip-audit-safety/
- 3: https://pypi.org/project/pip-audit/2.10.0/
- 4: https://github.com/pypa/pip-audit
- 5: https://discuss.python.org/t/towards-a-pip-audit-subcommand-for-vulnerability-analysis-management/17681?page=2
- 6: https://github.com/pypa/pip-audit?tab=readme-ov-file
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow excerpt ---'
sed -n '90,145p' .github/workflows/security.reusable.yml
printf '%s\n' ''
printf '%s\n' '--- pip-audit/bandit usages ---'
rg -n "pip-audit|requirement|dependencies_file|bandit" .github/workflows || true
printf '%s\n' ''
printf '%s\n' '--- repository manifest files ---'
git ls-files | rg '(^|/)(requirements[^[:space:]]*\.txt|pyproject\.toml|setup\.py|setup\.cfg|Pipfile|poetry\.lock|uv\.lock|Pipfile\.lock)$' || trueRepository: hallelx2/pdftable
Length of output: 3007
Audit the repository dependency manifests.
pip-audit without an argument scans the current Python environment. This job only installs the audit tools, so repository dependencies are not scanned. Use pip-audit . for supported pyproject.toml projects and pip-audit -r "$requirements_file" for each requirements file. Keep Bandit under the existing Python-project detection condition.
🧰 Tools
🪛 GitHub Check: Semgrep OSS
[warning] 116-116: Semgrep Finding: yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
GitHub Actions step uses a mutable tag or branch reference. Tags and branch names can be silently repointed by the action owner, enabling supply-chain attacks — as seen in the trivy-action and kics-github-action compromises. Pin the reference to a full 40-character commit SHA instead, e.g. uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/security.reusable.yml around lines 112 - 125, Update the
pip-audit step in the Python-project path to audit repository manifests rather
than only the current environment: run pip-audit . when pyproject.toml is
present, and run pip-audit -r "$requirements_file" for each matching
requirements file. Preserve the existing Python-project detection condition and
keep Bandit under that condition.
| ## Security must-haves (Vectorless-specific) | ||
| - **BYOK keys**: encrypted at rest (AES-256-GCM), never logged, never returned in responses. | ||
| - **Multi-tenant**: every query/store access scoped to the caller's org/tenant — no cross-tenant reads or writes. This is the #1 risk in `vectorless-control-plane`. |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Use one complete BYOK encryption standard in every synchronized file.
All four locations require AES-256-GCM but do not consistently state the nonce and key-lifecycle requirements. Add one shared rule that requires:
- A fresh, unique nonce for every encryption under a key.
- Authenticated-tag verification.
- Envelope encryption with managed key storage.
- Key rotation and tenant-scoped access.
- No plaintext keys in logs, responses, or client bundles.
GCM IV reuse can invalidate confidentiality and authentication guarantees. (nvlpubs.nist.gov)
AGENTS.md#L32-L34: define the complete repository standard..github/copilot-instructions.md#L15-L18: mirror the complete BYOK rule..github/instructions/security.instructions.md#L8-L10: require nonce uniqueness and key lifecycle checks..github/agents/security-reviewer.agent.md#L13-L16: make the security agent verify the same controls.
📍 Affects 4 files
AGENTS.md#L32-L34(this comment).github/copilot-instructions.md#L15-L18.github/instructions/security.instructions.md#L8-L10.github/agents/security-reviewer.agent.md#L13-L16
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` around lines 32 - 34, Define one complete AES-256-GCM BYOK
standard in AGENTS.md, including fresh unique nonces per encryption key,
authenticated-tag verification, envelope encryption with managed key storage,
key rotation, tenant-scoped access, and prohibition of plaintext keys in logs,
responses, and client bundles. Mirror the complete rule in
.github/copilot-instructions.md, require nonce uniqueness and key-lifecycle
checks in .github/instructions/security.instructions.md, and update
.github/agents/security-reviewer.agent.md to verify all the same controls.
Source: Coding guidelines
synced local file(s) with hallelx2/dev-standards.
Changed files
AGENTS.mdfrom remoteAGENTS.md.github/copilot-instructions.mdfrom remote.github/copilot-instructions.md.github/agents/and copied all sub files/folders from remote directory.github/agents/.github/instructions/backend.instructions.mdfrom remote.github/instructions/backend.instructions.md.github/instructions/frontend.instructions.mdfrom remote.github/instructions/frontend.instructions.md.github/instructions/security.instructions.mdfrom remote.github/instructions/security.instructions.md.github/workflows/security.ymlfrom remote.github/workflows/security.yml.github/workflows/security.reusable.ymlfrom remote.github/workflows/security.reusable.yml.github/workflows/jules-review.ymlfrom remote.github/workflows/jules-review.yml.github/dependabot.ymlfrom remote.github/dependabot.ymlThis PR was created automatically by the repo-file-sync-action workflow run #30801469164
Summary by CodeRabbit
New Features
Documentation