chore(renovate): tidy go.sum after a gomod update by scttbnsn · Pull Request #40 · CodesWhat/.github

scttbnsn · 2026-08-27T05:12:54Z

Adds postUpdateOptions: ["gomodTidy"] to the shared Renovate preset.

The failure this fixes

Renovate writes the new go.sum hashes on a gomod bump and leaves the superseded ones in place. go build ./... passes, because go.sum only has to be sufficient, not minimal. So nothing catches it at compile time and the break surfaces later in the GoReleaser gate, whose go mod tidy before-hook removes the stale lines, dirties the tree, and fails the gate's clean-tree assertion.

Diagnosed by the sockguard lane on sockguard#343, where a go-containerregistry 0.21.8 → 0.21.9 bump pulled a transitive golang.org/x/net 0.57 → 0.58. That branch's go.sum carries all four versions — verified here, two lines each for 0.21.8, 0.21.9, 0.57 and 0.58.

The failure reads as unrelated to Renovate when you hit it, which is most of its cost. The job that goes red names neither Renovate nor go.sum.

Why the preset and not the repo

sockguard and portwing are the org's two Go consumers. Both extend this file, neither sets its own postUpdateOptions. So portwing hits the identical failure on its next transitive bump, and fixing it in sockguard alone would leave that in place. The sockguard lane deliberately declined to fork its local config to paper over it, which was the right call.

Only gomodTidy

gomodUpdateImportPaths was suggested alongside it. Not included: it rewrites import paths on major-version module path changes, which is a different problem with no observed failure here, and it would change behaviour on every major bump across both repos. Worth adding on its own evidence if it ever produces one.

Test

renovate_config_contract_test.py asserts gomodTidy is present, with the sockguard#343 evidence in the docstring so it doesn't read as arbitrary. Mutation-checked: deleting the key fails the test. Full suite 91 tests green.

Consumers

Preset changes take effect on the next Renovate run without a pin roll, so no consuming repo needs a change.

Renovate writes the new go.sum hashes and leaves the superseded ones behind. `go build` passes because go.sum only has to be sufficient, so the failure surfaces later in the GoReleaser gate, whose `go mod tidy` before-hook removes the stale lines and dirties the tree against a clean-tree assertion. Diagnosed on sockguard #343 by that lane: a go-containerregistry 0.21.8 -> 0.21.9 bump pulled a transitive golang.org/x/net 0.57 -> 0.58 and go.sum ended up carrying all four versions. Fixed in the shared preset rather than per-repo. sockguard and portwing are the two Go consumers, both extend this file with no local postUpdateOptions, so portwing would hit the identical failure on its next transitive bump. Only gomodTidy. gomodUpdateImportPaths was suggested alongside it but addresses major-version module path rewrites, which is a different problem with no observed failure here, and it changes behaviour on every major bump across both repos.

coderabbitai · 2026-08-27T05:13:03Z

Warning

Review limit reached

Next included review available in 31 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1f435005-0a9a-4953-b62f-385299f4d583

📥 Commits

Reviewing files that changed from the base of the PR and between 54f1b86 and c830cfc.

📒 Files selected for processing (2)

.github/tests/renovate_config_contract_test.py
renovate-config.json

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

scttbnsn · 2026-08-27T05:13:08Z

@coderabbitai review

coderabbitai · 2026-08-27T05:13:14Z

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

biggest-littlest

Checked the evidence rather than the reasoning. sockguard#343's go.sum does carry all four versions, two lines each, so the stale-lines claim holds. And the preset is the right place: sockguard and portwing both extend it with no local postUpdateOptions, so a per-repo fix would have left portwing exposed.

Portwing's dependency dashboard already has renovate/non-major-gomod queued for golang.org/x/crypto v0.54.0 to v0.55.0, unopened. That's the next instance of this exact failure, and it lands before the Monday Renovate run if this merges now.

Leaving gomodUpdateImportPaths out is right. Different problem, no observed failure, and it would change behaviour on every major bump.

Approving.

ALARGECOMPANY

Approving. The contract test is the part that makes this durable — a bare config key with no test is exactly what disappears in a reformat, and the failure it prevents surfaces weeks later in a GoReleaser job that names neither Renovate nor go.sum. Good that the docstring carries the #343 evidence instead of just asserting the key matters.

scttbnsn · 2026-08-27T05:16:54Z

Correction to this PR body: "Preset changes take effect on the next Renovate run without a pin roll, so no consuming repo needs a change" is wrong.

Renovate resolves a local>CodesWhat/.github:renovate-config preset from this repo's default branch, not from the branch the change merged to. renovate-config.json on main still has no postUpdateOptions, so this fix does nothing until dev/repository-standards promotes. No consuming repo needs a change, which was the part I got right, but the timing claim was wrong.

Promotion is #41. Portwing has renovate/non-major-gomod queued for golang.org/x/crypto v0.54.0 to v0.55.0 and the preset schedule is "before 6am on monday", so that PR opens 08-31 and hits this exact failure unless #41 lands first.

Same mistake I codified a guard against earlier today in standards/ci.md: I checked the branch I merged to instead of the branch that actually gets consulted.

The bump pulled a transitive golang.org/x/net 0.57->0.58 and left the stale go-containerregistry 0.21.8 and x/net 0.57 hashes in go.sum. go build stays green on the surplus lines, but the GoReleaser gate runs go mod tidy as a before-hook and fails its clean-tree check on the resulting diff. Tidied here; the durable fix (gomodTidy in the shared CodesWhat/.github renovate preset) is CodesWhat/.github#40.

#41) * docs(standards): add organization health defaults Adds organization-wide community health defaults, validation, ownership, contribution guidance, security policy, and hardened workflow checks. * ci(greptile): require manual review requests (#11) * ci(workflows): add reusable CI foundation (#13) * ci(workflows): add reusable CI foundation * fix(workflows): harden reusable release contracts * feat(quality): standardize long-run reporting (#15) * feat(quality): add normalized reporting foundation * test(quality): run reporting contracts in standards validation * fix(quality): align report validator with schema * test(quality): verify GitHub integration outputs * fix(quality): enforce report contract boundaries * fix(quality): decode reports as utf-8 * test(quality): pin fixture encoding * ci(profile): make asset generation read-only (#10) * ci(profile): make asset generation read-only * fix(profile): restrict asset validation egress * ci(review): add deduplicated Greptile summon (#9) * ci(review): add deduplicated Greptile summon * fix(review): serialize exact-head Greptile summons * test(review): lock Greptile security controls * ci(workflows): add run-test and run-lint toggles to go-ci (#19) go-ci.yml's test and lint jobs ran unconditionally, so a Go-less repo that only wants the language-agnostic workflow-security (zizmor) job couldn't call it. Add run-test/run-lint boolean inputs, mirroring the existing run-govulncheck/run-workflow-security/etc. toggle pattern, defaulting to true so existing callers see no behavior change. Fixes: #18 * ci(workflows): add module-directory input to node-ci (#22) * ci(workflows): add module-directory input to node-ci Mirrors go-ci's module-directory idiom: a string input defaulting to "." threaded into each fixed script's env as MODULE_DIRECTORY, so a repo with several independently-gated Node projects can call node-ci once per project. The default preserves current behavior for existing callers. Extends the reusable CI contract test to assert the new input and its threading, matching how run-test/run-lint were added for go-ci in #19. * test(workflows): assert module-directory threads into all three node jobs * docs(onboarding): record the qlty alignment baseline (#24) * docs(onboarding): align with the codified standards registry (#26) * docs(onboarding): align with the codified standards registry - docs(onboarding): name Codecov as the coverage cloud; Qlty Cloud App and maintainability badge stay, checks stay non-required - docs(onboarding): trivy deprecated in favor of Grype, including the qlty plugin blocks in the two reference configs (drydock#753, portwing#135) - docs(onboarding): CodeRabbit free Pro is public-only; private repos use cross-account human review - docs(onboarding): add the greptile.json contract and the label-gated second-opinion caller * docs(onboarding): reword the CodeRabbit private-repo claim as org policy - docs(onboarding): free-plan private-repo reviews exist but are rate-limited and never fired here; the skip is policy, not a plan fact - docs(onboarding): pair the Greptile caller with auto-applied CodeRabbit labeling so the second-opinion label is criteria-driven * chore(repo): meet our own onboarding checklist (#28) * chore(repo): meet our own onboarding checklist - chore(repo): MIT LICENSE (infrastructure repos are MIT; products AGPL) - docs(repo): root AGENTS.md with repo-specific rules and validation - build(hooks): lefthook with commit-msg + pre-push mirroring CI via scripts/validate.sh * fix(hooks): tighten the commit-msg exemptions and mirror zizmor's CI flags - fix(hooks): merge/revert exemptions match git's generated subjects only, so a hand-typed 'Merge ...' subject no longer bypasses the check - fix(hooks): require a non-whitespace character after the colon - fix(hooks): zizmor runs --no-online-audits locally, matching CI's online-audits: false for local/CI parity * fix(hooks): exempt only git-generated merge and revert subjects * docs(community): org-default code of conduct + community checklist (#30) * docs(community): add org-default code of conduct and community checklist items CODE_OF_CONDUCT.md is Contributor Covenant 2.0 (drydock's tuned copy) with the org contact security@codeswhat.com, cascading to every repo without a local one. Onboarding checklist gains the cascade-first rule and the Discussions on/off split for product vs meta repos. * test(community): assert the code of conduct in the community-health contract * feat(workflows): add the shared star-chart refresh reusable workflow (#32) * feat(workflows): add the shared star-chart refresh reusable workflow Replaces both retired star-chart engines org-wide. The chart becomes a first-party SVG generated from GitHub's own stargazer timestamps and committed into the consuming repository, so it needs no secret and makes no request at render time. That property is the point. A live route that loses its credential serves a plausible placeholder at HTTP 200 forever with nothing reporting red, which is exactly how drydock's chart sat broken. A committed artifact fails visibly or not at all. The generator is embedded in the workflow rather than checked out from a second repository, so a caller's SHA pin covers every line of behaviour with nothing resolved at run time. Verified against live data before committing: byte-identical output to the reference implementation for drydock at 238 stars and 3 API calls, and a clean no-op exit on a repo with a single star. - feat(workflows): starchart-refresh.yml, egress-blocked to api.github.com and github.com, contents: write as its only elevated scope - test(workflows): contract test covering the embedded generator, env-var input handling, the self-contained SVG, and the conditional commit-back - ci(validation): run the new contract test in standards validation - docs(onboarding): document the caller shape and why the artifact is committed rather than served * test(workflows): syntax-check the embedded star-chart generator This workflow never runs in this repository, so a syntax error inside the heredoc would first surface in a consumer's scheduled job, days later and in someone else's lane. The test recovers the generator the way the shell will actually see it, stripping the run block's base indentation rather than reading the file as written, since a heredoc body that looks correct in YAML can still reach node malformed. Then node --check parses it. Verified with a negative control rather than assumed: injecting a syntax error into the generator fails the test, and reverting passes it. * fix(workflows): reject the inputs that would publish a wrong star chart All three from CodeRabbit on #32, and the max-pages one was a real bug of exactly the kind this workflow exists to prevent. max-pages: 0 made pages 0, which fetched nothing, which hit the "too few stars" clean exit. A repository with 238 stars would have reported a green no-op. A cap below the needed page count was worse than that: it drew a chart from the first N pages and published a partial history as a whole one behind a ::warning:: nobody reads. Both now fail loudly, and the cap must be a positive integer. branch had no runtime guard. Omitting a default only prevents omission, so a caller could still pass main and, on a repository whose ruleset let the push through, commit straight to the default branch. Rejected before checkout rather than at the push, where the error would be confusing. output-path was read through the environment, which stops script injection but not traversal. An absolute or ../ path reached writeFileSync outside the checkout, and the commit step then found nothing staged and reported success. Writes now use the resolved and validated path rather than the raw input, since a check that doesn't govern the write is decoration. Verified behaviourally, not by reading: each rejected input throws, the one-star exit still no-ops, nothing lands outside the workspace, and the happy path is still byte-identical to the reference output for drydock. * Main-is-released check, and the codified star-chart shape (#34) * ci(standards): assert main points at a release tag Reusable workflow for the invariant behind "main is the released version, not the newest work": every commit on main is a tagged release, so an untagged main head is itself the alarm. Callers pin it by SHA and run it on a schedule plus push to main. It separates three states that all look like "not tagged" from the outside. A repository with zero tags cannot be evaluated at all and says so rather than reporting drift. A drifted main reports the newest reachable tag and how many commits it is behind. A prerelease on main is its own failure by default, since a release candidate on the default branch is the exact drift this exists to catch. Read-only: contents: read, egress blocked to github.com, and no credentials persisted through checkout. fetch-depth: 0 because tags only travel with full history and a shallow clone would fail for the wrong reason and read as real drift. * ci(starchart): render the codified chart shape in both themes Scott drew the target and it is now the renderer. The chart reads as native GitHub UI rather than as a third-party embed: a 900x460 card on GitHub's own border colour, sans for the words and mono for every number, a 2px accent line over a faint gradient, interior gridlines and a solid baseline. The accent is the repository's logo colour, passed as a new required input, and an accent that is not a colour now fails instead of drawing a chart with no line. Three behaviours the renderer decides rather than hard-codes, each because the naive version produced something wrong on a real repository. The y-axis searches step-and-tick-count pairs, since rounding the step alone put drydock's 239 stars on a 0-400 axis with the curve in the bottom 60% of the plot. The curve is a monotone cubic, since a cardinal spline overshoots on a curve this flat and an overshoot on a cumulative count draws a dip that never happened. X labels drop to day precision when month names collide, which is the actual condition rather than a guessed span threshold. Two files ship now, not one. GitHub's theme toggle does not reach a media query inside an <img>-embedded SVG, so a self-theming file shows a white card to anyone reading GitHub dark with a light OS. It does drive a <picture> element in the README, so the pair is generated from one fetch and the markup chooses. They commit together or not at all: a <picture> with a fresh light chart and a stale dark one shows two different histories depending on who is looking, and nothing reports it. The documented trigger moves from a cron to the release cut. A committed artifact refreshed on a schedule mutates underneath a tag, which is what the main-is-released rule forbids. The renderer block is generated from ops render-chart.mjs by splice-into-workflow.mjs rather than hand-copied, and byte parity with that module was verified against live drydock data before this landed. Also fixes an assertion in the main-is-released test that sliced the whole if-block as the decisive expression and so could never pass. * docs(onboarding): add the main-is-released caller to the section 4 checklist * fix(workflows): close three shared-workflow defects (#36) * fix(workflows): close three shared-workflow defects starchart-refresh: the documented `release: [published]` trigger never fires. GitHub suppresses workflow runs for events caused by GITHUB_TOKEN, and every consuming repo publishes its release with exactly that — portwing via GoReleaser, drydock via `gh release create`. A caller wired from this file's own example lints clean, reads as correctly configured, and refreshes nothing forever. That's the silent-success shape the committed-SVG rework existed to remove, reintroduced by the instructions for it. Example is now a workflow_dispatch the release cut fires, with the suppression and its two documented exceptions written down so the next person doesn't rederive the broken version. Found by the sockguard lane after three repos had been told to adopt it. main-is-released: an exact tag match alone was never the invariant. Any tag satisfied it, so one named `snapshot` or `latest` parked on a drifted main read as a pass. Now requires a release-shaped version. Prerelease detection moved off `case *-*`, which called `my-tag` a prerelease and would have accepted it under allow-prerelease. main-is-released: a promotion merges before its tag is pushed, so a run in that window reported drift that resolved itself seconds later. Three attempts with a tag refetch between them. It can't mask real drift — an untagged main is still untagged on the last attempt — and a failed refetch warns rather than passing. Verified by extracting the decision block and running it against real repositories: v1.7.4 and 1.7.4 pass, snapshot/latest/my-tag fail as malformed, v1.7.0-rc.2 fails as prerelease and passes under allow-prerelease, and allow-prerelease does not reopen the any-tag hole. 87 contract tests green. * fix(workflows): correct two overstated claims CodeRabbit caught The refetch warning said the verdict uses the refs from checkout. It might not: attempt 1 can succeed and attempt 2 fail, and a failed fetch can leave some refs updated. Now says the refs currently available on the runner, which is what's actually true. 'The two documented exceptions to the suppression' was an overclaim. pull_request with opened/synchronize/reopened is a third — it creates a run in an approval-required state rather than being suppressed. workflow_dispatch and repository_dispatch are the two that fire UNATTENDED, which is the property a release cut actually needs, so the comment now says that instead. * chore: gitignore .claude/ so a nested worktree can't be staged as a gitlink (#38) * fix(starchart): the documented dispatch step needs actions:write (#39) * fix(starchart): the documented dispatch step needs actions:write portwing v0.9.7 shipped this snippet as written and the first real cut died on HTTP 403: creating a workflow dispatch is an Actions API write, and contents:write does not imply it. A PAT needs the scope too. Records the tag-push trigger as the other working option, and the evidence that a GITHUB_TOKEN dispatch does create a run, since that was reported as false and it's load-bearing for every cut-dispatched caller in the org. * docs(starchart): cite GitHub's own wording on the dispatch exception * test(starchart): assert the refuted-claim verdict, not just its evidence The contract test named portkey-admin-mcp and github-actions[bot] and stopped there, so a rewrite that kept both source names and reversed the conclusion passed. Verified by mutation: flipping "That does not hold:" to "That is confirmed:" left the old assertions green and now fails. Asserts against the flattened comment prose for the same reason the tag-trigger test does, so the assertions pin the claim rather than the line width. * chore(renovate): tidy go.sum after a gomod update (#40) Renovate writes the new go.sum hashes and leaves the superseded ones behind. `go build` passes because go.sum only has to be sufficient, so the failure surfaces later in the GoReleaser gate, whose `go mod tidy` before-hook removes the stale lines and dirties the tree against a clean-tree assertion. Diagnosed on sockguard #343 by that lane: a go-containerregistry 0.21.8 -> 0.21.9 bump pulled a transitive golang.org/x/net 0.57 -> 0.58 and go.sum ended up carrying all four versions. Fixed in the shared preset rather than per-repo. sockguard and portwing are the two Go consumers, both extend this file with no local postUpdateOptions, so portwing would hit the identical failure on its next transitive bump. Only gomodTidy. gomodUpdateImportPaths was suggested alongside it but addresses major-version module path rewrites, which is a different problem with no observed failure here, and it changes behaviour on every major bump across both repos.

* docs(standards): add organization health defaults Adds organization-wide community health defaults, validation, ownership, contribution guidance, security policy, and hardened workflow checks. * ci(greptile): require manual review requests (#11) * ci(workflows): add reusable CI foundation (#13) * ci(workflows): add reusable CI foundation * fix(workflows): harden reusable release contracts * feat(quality): standardize long-run reporting (#15) * feat(quality): add normalized reporting foundation * test(quality): run reporting contracts in standards validation * fix(quality): align report validator with schema * test(quality): verify GitHub integration outputs * fix(quality): enforce report contract boundaries * fix(quality): decode reports as utf-8 * test(quality): pin fixture encoding * ci(profile): make asset generation read-only (#10) * ci(profile): make asset generation read-only * fix(profile): restrict asset validation egress * ci(review): add deduplicated Greptile summon (#9) * ci(review): add deduplicated Greptile summon * fix(review): serialize exact-head Greptile summons * test(review): lock Greptile security controls * ci(workflows): add run-test and run-lint toggles to go-ci (#19) go-ci.yml's test and lint jobs ran unconditionally, so a Go-less repo that only wants the language-agnostic workflow-security (zizmor) job couldn't call it. Add run-test/run-lint boolean inputs, mirroring the existing run-govulncheck/run-workflow-security/etc. toggle pattern, defaulting to true so existing callers see no behavior change. Fixes: #18 * ci(workflows): add module-directory input to node-ci (#22) * ci(workflows): add module-directory input to node-ci Mirrors go-ci's module-directory idiom: a string input defaulting to "." threaded into each fixed script's env as MODULE_DIRECTORY, so a repo with several independently-gated Node projects can call node-ci once per project. The default preserves current behavior for existing callers. Extends the reusable CI contract test to assert the new input and its threading, matching how run-test/run-lint were added for go-ci in #19. * test(workflows): assert module-directory threads into all three node jobs * docs(onboarding): record the qlty alignment baseline (#24) * docs(onboarding): align with the codified standards registry (#26) * docs(onboarding): align with the codified standards registry - docs(onboarding): name Codecov as the coverage cloud; Qlty Cloud App and maintainability badge stay, checks stay non-required - docs(onboarding): trivy deprecated in favor of Grype, including the qlty plugin blocks in the two reference configs (drydock#753, portwing#135) - docs(onboarding): CodeRabbit free Pro is public-only; private repos use cross-account human review - docs(onboarding): add the greptile.json contract and the label-gated second-opinion caller * docs(onboarding): reword the CodeRabbit private-repo claim as org policy - docs(onboarding): free-plan private-repo reviews exist but are rate-limited and never fired here; the skip is policy, not a plan fact - docs(onboarding): pair the Greptile caller with auto-applied CodeRabbit labeling so the second-opinion label is criteria-driven * chore(repo): meet our own onboarding checklist (#28) * chore(repo): meet our own onboarding checklist - chore(repo): MIT LICENSE (infrastructure repos are MIT; products AGPL) - docs(repo): root AGENTS.md with repo-specific rules and validation - build(hooks): lefthook with commit-msg + pre-push mirroring CI via scripts/validate.sh * fix(hooks): tighten the commit-msg exemptions and mirror zizmor's CI flags - fix(hooks): merge/revert exemptions match git's generated subjects only, so a hand-typed 'Merge ...' subject no longer bypasses the check - fix(hooks): require a non-whitespace character after the colon - fix(hooks): zizmor runs --no-online-audits locally, matching CI's online-audits: false for local/CI parity * fix(hooks): exempt only git-generated merge and revert subjects * docs(community): org-default code of conduct + community checklist (#30) * docs(community): add org-default code of conduct and community checklist items CODE_OF_CONDUCT.md is Contributor Covenant 2.0 (drydock's tuned copy) with the org contact security@codeswhat.com, cascading to every repo without a local one. Onboarding checklist gains the cascade-first rule and the Discussions on/off split for product vs meta repos. * test(community): assert the code of conduct in the community-health contract * feat(workflows): add the shared star-chart refresh reusable workflow (#32) * feat(workflows): add the shared star-chart refresh reusable workflow Replaces both retired star-chart engines org-wide. The chart becomes a first-party SVG generated from GitHub's own stargazer timestamps and committed into the consuming repository, so it needs no secret and makes no request at render time. That property is the point. A live route that loses its credential serves a plausible placeholder at HTTP 200 forever with nothing reporting red, which is exactly how drydock's chart sat broken. A committed artifact fails visibly or not at all. The generator is embedded in the workflow rather than checked out from a second repository, so a caller's SHA pin covers every line of behaviour with nothing resolved at run time. Verified against live data before committing: byte-identical output to the reference implementation for drydock at 238 stars and 3 API calls, and a clean no-op exit on a repo with a single star. - feat(workflows): starchart-refresh.yml, egress-blocked to api.github.com and github.com, contents: write as its only elevated scope - test(workflows): contract test covering the embedded generator, env-var input handling, the self-contained SVG, and the conditional commit-back - ci(validation): run the new contract test in standards validation - docs(onboarding): document the caller shape and why the artifact is committed rather than served * test(workflows): syntax-check the embedded star-chart generator This workflow never runs in this repository, so a syntax error inside the heredoc would first surface in a consumer's scheduled job, days later and in someone else's lane. The test recovers the generator the way the shell will actually see it, stripping the run block's base indentation rather than reading the file as written, since a heredoc body that looks correct in YAML can still reach node malformed. Then node --check parses it. Verified with a negative control rather than assumed: injecting a syntax error into the generator fails the test, and reverting passes it. * fix(workflows): reject the inputs that would publish a wrong star chart All three from CodeRabbit on #32, and the max-pages one was a real bug of exactly the kind this workflow exists to prevent. max-pages: 0 made pages 0, which fetched nothing, which hit the "too few stars" clean exit. A repository with 238 stars would have reported a green no-op. A cap below the needed page count was worse than that: it drew a chart from the first N pages and published a partial history as a whole one behind a ::warning:: nobody reads. Both now fail loudly, and the cap must be a positive integer. branch had no runtime guard. Omitting a default only prevents omission, so a caller could still pass main and, on a repository whose ruleset let the push through, commit straight to the default branch. Rejected before checkout rather than at the push, where the error would be confusing. output-path was read through the environment, which stops script injection but not traversal. An absolute or ../ path reached writeFileSync outside the checkout, and the commit step then found nothing staged and reported success. Writes now use the resolved and validated path rather than the raw input, since a check that doesn't govern the write is decoration. Verified behaviourally, not by reading: each rejected input throws, the one-star exit still no-ops, nothing lands outside the workspace, and the happy path is still byte-identical to the reference output for drydock. * Main-is-released check, and the codified star-chart shape (#34) * ci(standards): assert main points at a release tag Reusable workflow for the invariant behind "main is the released version, not the newest work": every commit on main is a tagged release, so an untagged main head is itself the alarm. Callers pin it by SHA and run it on a schedule plus push to main. It separates three states that all look like "not tagged" from the outside. A repository with zero tags cannot be evaluated at all and says so rather than reporting drift. A drifted main reports the newest reachable tag and how many commits it is behind. A prerelease on main is its own failure by default, since a release candidate on the default branch is the exact drift this exists to catch. Read-only: contents: read, egress blocked to github.com, and no credentials persisted through checkout. fetch-depth: 0 because tags only travel with full history and a shallow clone would fail for the wrong reason and read as real drift. * ci(starchart): render the codified chart shape in both themes Scott drew the target and it is now the renderer. The chart reads as native GitHub UI rather than as a third-party embed: a 900x460 card on GitHub's own border colour, sans for the words and mono for every number, a 2px accent line over a faint gradient, interior gridlines and a solid baseline. The accent is the repository's logo colour, passed as a new required input, and an accent that is not a colour now fails instead of drawing a chart with no line. Three behaviours the renderer decides rather than hard-codes, each because the naive version produced something wrong on a real repository. The y-axis searches step-and-tick-count pairs, since rounding the step alone put drydock's 239 stars on a 0-400 axis with the curve in the bottom 60% of the plot. The curve is a monotone cubic, since a cardinal spline overshoots on a curve this flat and an overshoot on a cumulative count draws a dip that never happened. X labels drop to day precision when month names collide, which is the actual condition rather than a guessed span threshold. Two files ship now, not one. GitHub's theme toggle does not reach a media query inside an <img>-embedded SVG, so a self-theming file shows a white card to anyone reading GitHub dark with a light OS. It does drive a <picture> element in the README, so the pair is generated from one fetch and the markup chooses. They commit together or not at all: a <picture> with a fresh light chart and a stale dark one shows two different histories depending on who is looking, and nothing reports it. The documented trigger moves from a cron to the release cut. A committed artifact refreshed on a schedule mutates underneath a tag, which is what the main-is-released rule forbids. The renderer block is generated from ops render-chart.mjs by splice-into-workflow.mjs rather than hand-copied, and byte parity with that module was verified against live drydock data before this landed. Also fixes an assertion in the main-is-released test that sliced the whole if-block as the decisive expression and so could never pass. * docs(onboarding): add the main-is-released caller to the section 4 checklist * fix(workflows): close three shared-workflow defects (#36) * fix(workflows): close three shared-workflow defects starchart-refresh: the documented `release: [published]` trigger never fires. GitHub suppresses workflow runs for events caused by GITHUB_TOKEN, and every consuming repo publishes its release with exactly that — portwing via GoReleaser, drydock via `gh release create`. A caller wired from this file's own example lints clean, reads as correctly configured, and refreshes nothing forever. That's the silent-success shape the committed-SVG rework existed to remove, reintroduced by the instructions for it. Example is now a workflow_dispatch the release cut fires, with the suppression and its two documented exceptions written down so the next person doesn't rederive the broken version. Found by the sockguard lane after three repos had been told to adopt it. main-is-released: an exact tag match alone was never the invariant. Any tag satisfied it, so one named `snapshot` or `latest` parked on a drifted main read as a pass. Now requires a release-shaped version. Prerelease detection moved off `case *-*`, which called `my-tag` a prerelease and would have accepted it under allow-prerelease. main-is-released: a promotion merges before its tag is pushed, so a run in that window reported drift that resolved itself seconds later. Three attempts with a tag refetch between them. It can't mask real drift — an untagged main is still untagged on the last attempt — and a failed refetch warns rather than passing. Verified by extracting the decision block and running it against real repositories: v1.7.4 and 1.7.4 pass, snapshot/latest/my-tag fail as malformed, v1.7.0-rc.2 fails as prerelease and passes under allow-prerelease, and allow-prerelease does not reopen the any-tag hole. 87 contract tests green. * fix(workflows): correct two overstated claims CodeRabbit caught The refetch warning said the verdict uses the refs from checkout. It might not: attempt 1 can succeed and attempt 2 fail, and a failed fetch can leave some refs updated. Now says the refs currently available on the runner, which is what's actually true. 'The two documented exceptions to the suppression' was an overclaim. pull_request with opened/synchronize/reopened is a third — it creates a run in an approval-required state rather than being suppressed. workflow_dispatch and repository_dispatch are the two that fire UNATTENDED, which is the property a release cut actually needs, so the comment now says that instead. * chore: gitignore .claude/ so a nested worktree can't be staged as a gitlink (#38) * fix(starchart): the documented dispatch step needs actions:write (#39) * fix(starchart): the documented dispatch step needs actions:write portwing v0.9.7 shipped this snippet as written and the first real cut died on HTTP 403: creating a workflow dispatch is an Actions API write, and contents:write does not imply it. A PAT needs the scope too. Records the tag-push trigger as the other working option, and the evidence that a GITHUB_TOKEN dispatch does create a run, since that was reported as false and it's load-bearing for every cut-dispatched caller in the org. * docs(starchart): cite GitHub's own wording on the dispatch exception * test(starchart): assert the refuted-claim verdict, not just its evidence The contract test named portkey-admin-mcp and github-actions[bot] and stopped there, so a rewrite that kept both source names and reversed the conclusion passed. Verified by mutation: flipping "That does not hold:" to "That is confirmed:" left the old assertions green and now fails. Asserts against the flattened comment prose for the same reason the tag-trigger test does, so the assertions pin the claim rather than the line width. * chore(renovate): tidy go.sum after a gomod update (#40) Renovate writes the new go.sum hashes and leaves the superseded ones behind. `go build` passes because go.sum only has to be sufficient, so the failure surfaces later in the GoReleaser gate, whose `go mod tidy` before-hook removes the stale lines and dirties the tree against a clean-tree assertion. Diagnosed on sockguard #343 by that lane: a go-containerregistry 0.21.8 -> 0.21.9 bump pulled a transitive golang.org/x/net 0.57 -> 0.58 and go.sum ended up carrying all four versions. Fixed in the shared preset rather than per-repo. sockguard and portwing are the two Go consumers, both extend this file with no local postUpdateOptions, so portwing would hit the identical failure on its next transitive bump. Only gomodTidy. gomodUpdateImportPaths was suggested alongside it but addresses major-version module path rewrites, which is a different problem with no observed failure here, and it changes behaviour on every major bump across both repos. * chore(renovate): move the vite ecosystem as one group (#42) The preset groups `minor` and `patch` per manager and leaves majors to split into one PR each. That works everywhere except a peer-locked set, where a major arriving alone has no resolvable outcome at all. careerrat #208 is the worked example: `@vitejs/plugin-react` 6.1.0 peer-requires `vite ^8.0.0`, `vite` is pinned at 6.4.3, and no vite major PR exists for it to land against. The branch is deadlocked no matter how many times it rebases, and `renovate/artifacts`, `tests`, `web-build`, `website-build` and `windows-package-smoke` all fail on it every run. Grouping every update type, not just non-major, is the point: the majors are exactly the ones that have to travel together. The rule sits last so it wins over the non-major group for the packages it names. Affects the three repos that declare any of these, checked against every tracked package.json: careerrat (vite 6.4.3, @vitejs/plugin-react 4.7.0, vitest 3.2.7), drydock (vite 7.3.6/8.2.1/8.2.2, @vitejs/plugin-vue 6.0.8, vitest 4.1.10/4.1.11), mailbox0 (vite ^6.3.5, @vitejs/plugin-react ^4.7.0, vitest ^1.0.4 and 3.2.4, @vitest/ui ^1.0.4). Presets resolve from this repo's default branch, so it takes effect on all three the moment it reaches main.

* docs(standards): add organization health defaults Adds organization-wide community health defaults, validation, ownership, contribution guidance, security policy, and hardened workflow checks. * ci(greptile): require manual review requests (#11) * ci(workflows): add reusable CI foundation (#13) * ci(workflows): add reusable CI foundation * fix(workflows): harden reusable release contracts * feat(quality): standardize long-run reporting (#15) * feat(quality): add normalized reporting foundation * test(quality): run reporting contracts in standards validation * fix(quality): align report validator with schema * test(quality): verify GitHub integration outputs * fix(quality): enforce report contract boundaries * fix(quality): decode reports as utf-8 * test(quality): pin fixture encoding * ci(profile): make asset generation read-only (#10) * ci(profile): make asset generation read-only * fix(profile): restrict asset validation egress * ci(review): add deduplicated Greptile summon (#9) * ci(review): add deduplicated Greptile summon * fix(review): serialize exact-head Greptile summons * test(review): lock Greptile security controls * ci(workflows): add run-test and run-lint toggles to go-ci (#19) go-ci.yml's test and lint jobs ran unconditionally, so a Go-less repo that only wants the language-agnostic workflow-security (zizmor) job couldn't call it. Add run-test/run-lint boolean inputs, mirroring the existing run-govulncheck/run-workflow-security/etc. toggle pattern, defaulting to true so existing callers see no behavior change. Fixes: #18 * ci(workflows): add module-directory input to node-ci (#22) * ci(workflows): add module-directory input to node-ci Mirrors go-ci's module-directory idiom: a string input defaulting to "." threaded into each fixed script's env as MODULE_DIRECTORY, so a repo with several independently-gated Node projects can call node-ci once per project. The default preserves current behavior for existing callers. Extends the reusable CI contract test to assert the new input and its threading, matching how run-test/run-lint were added for go-ci in #19. * test(workflows): assert module-directory threads into all three node jobs * docs(onboarding): record the qlty alignment baseline (#24) * docs(onboarding): align with the codified standards registry (#26) * docs(onboarding): align with the codified standards registry - docs(onboarding): name Codecov as the coverage cloud; Qlty Cloud App and maintainability badge stay, checks stay non-required - docs(onboarding): trivy deprecated in favor of Grype, including the qlty plugin blocks in the two reference configs (drydock#753, portwing#135) - docs(onboarding): CodeRabbit free Pro is public-only; private repos use cross-account human review - docs(onboarding): add the greptile.json contract and the label-gated second-opinion caller * docs(onboarding): reword the CodeRabbit private-repo claim as org policy - docs(onboarding): free-plan private-repo reviews exist but are rate-limited and never fired here; the skip is policy, not a plan fact - docs(onboarding): pair the Greptile caller with auto-applied CodeRabbit labeling so the second-opinion label is criteria-driven * chore(repo): meet our own onboarding checklist (#28) * chore(repo): meet our own onboarding checklist - chore(repo): MIT LICENSE (infrastructure repos are MIT; products AGPL) - docs(repo): root AGENTS.md with repo-specific rules and validation - build(hooks): lefthook with commit-msg + pre-push mirroring CI via scripts/validate.sh * fix(hooks): tighten the commit-msg exemptions and mirror zizmor's CI flags - fix(hooks): merge/revert exemptions match git's generated subjects only, so a hand-typed 'Merge ...' subject no longer bypasses the check - fix(hooks): require a non-whitespace character after the colon - fix(hooks): zizmor runs --no-online-audits locally, matching CI's online-audits: false for local/CI parity * fix(hooks): exempt only git-generated merge and revert subjects * docs(community): org-default code of conduct + community checklist (#30) * docs(community): add org-default code of conduct and community checklist items CODE_OF_CONDUCT.md is Contributor Covenant 2.0 (drydock's tuned copy) with the org contact security@codeswhat.com, cascading to every repo without a local one. Onboarding checklist gains the cascade-first rule and the Discussions on/off split for product vs meta repos. * test(community): assert the code of conduct in the community-health contract * feat(workflows): add the shared star-chart refresh reusable workflow (#32) * feat(workflows): add the shared star-chart refresh reusable workflow Replaces both retired star-chart engines org-wide. The chart becomes a first-party SVG generated from GitHub's own stargazer timestamps and committed into the consuming repository, so it needs no secret and makes no request at render time. That property is the point. A live route that loses its credential serves a plausible placeholder at HTTP 200 forever with nothing reporting red, which is exactly how drydock's chart sat broken. A committed artifact fails visibly or not at all. The generator is embedded in the workflow rather than checked out from a second repository, so a caller's SHA pin covers every line of behaviour with nothing resolved at run time. Verified against live data before committing: byte-identical output to the reference implementation for drydock at 238 stars and 3 API calls, and a clean no-op exit on a repo with a single star. - feat(workflows): starchart-refresh.yml, egress-blocked to api.github.com and github.com, contents: write as its only elevated scope - test(workflows): contract test covering the embedded generator, env-var input handling, the self-contained SVG, and the conditional commit-back - ci(validation): run the new contract test in standards validation - docs(onboarding): document the caller shape and why the artifact is committed rather than served * test(workflows): syntax-check the embedded star-chart generator This workflow never runs in this repository, so a syntax error inside the heredoc would first surface in a consumer's scheduled job, days later and in someone else's lane. The test recovers the generator the way the shell will actually see it, stripping the run block's base indentation rather than reading the file as written, since a heredoc body that looks correct in YAML can still reach node malformed. Then node --check parses it. Verified with a negative control rather than assumed: injecting a syntax error into the generator fails the test, and reverting passes it. * fix(workflows): reject the inputs that would publish a wrong star chart All three from CodeRabbit on #32, and the max-pages one was a real bug of exactly the kind this workflow exists to prevent. max-pages: 0 made pages 0, which fetched nothing, which hit the "too few stars" clean exit. A repository with 238 stars would have reported a green no-op. A cap below the needed page count was worse than that: it drew a chart from the first N pages and published a partial history as a whole one behind a ::warning:: nobody reads. Both now fail loudly, and the cap must be a positive integer. branch had no runtime guard. Omitting a default only prevents omission, so a caller could still pass main and, on a repository whose ruleset let the push through, commit straight to the default branch. Rejected before checkout rather than at the push, where the error would be confusing. output-path was read through the environment, which stops script injection but not traversal. An absolute or ../ path reached writeFileSync outside the checkout, and the commit step then found nothing staged and reported success. Writes now use the resolved and validated path rather than the raw input, since a check that doesn't govern the write is decoration. Verified behaviourally, not by reading: each rejected input throws, the one-star exit still no-ops, nothing lands outside the workspace, and the happy path is still byte-identical to the reference output for drydock. * Main-is-released check, and the codified star-chart shape (#34) * ci(standards): assert main points at a release tag Reusable workflow for the invariant behind "main is the released version, not the newest work": every commit on main is a tagged release, so an untagged main head is itself the alarm. Callers pin it by SHA and run it on a schedule plus push to main. It separates three states that all look like "not tagged" from the outside. A repository with zero tags cannot be evaluated at all and says so rather than reporting drift. A drifted main reports the newest reachable tag and how many commits it is behind. A prerelease on main is its own failure by default, since a release candidate on the default branch is the exact drift this exists to catch. Read-only: contents: read, egress blocked to github.com, and no credentials persisted through checkout. fetch-depth: 0 because tags only travel with full history and a shallow clone would fail for the wrong reason and read as real drift. * ci(starchart): render the codified chart shape in both themes Scott drew the target and it is now the renderer. The chart reads as native GitHub UI rather than as a third-party embed: a 900x460 card on GitHub's own border colour, sans for the words and mono for every number, a 2px accent line over a faint gradient, interior gridlines and a solid baseline. The accent is the repository's logo colour, passed as a new required input, and an accent that is not a colour now fails instead of drawing a chart with no line. Three behaviours the renderer decides rather than hard-codes, each because the naive version produced something wrong on a real repository. The y-axis searches step-and-tick-count pairs, since rounding the step alone put drydock's 239 stars on a 0-400 axis with the curve in the bottom 60% of the plot. The curve is a monotone cubic, since a cardinal spline overshoots on a curve this flat and an overshoot on a cumulative count draws a dip that never happened. X labels drop to day precision when month names collide, which is the actual condition rather than a guessed span threshold. Two files ship now, not one. GitHub's theme toggle does not reach a media query inside an <img>-embedded SVG, so a self-theming file shows a white card to anyone reading GitHub dark with a light OS. It does drive a <picture> element in the README, so the pair is generated from one fetch and the markup chooses. They commit together or not at all: a <picture> with a fresh light chart and a stale dark one shows two different histories depending on who is looking, and nothing reports it. The documented trigger moves from a cron to the release cut. A committed artifact refreshed on a schedule mutates underneath a tag, which is what the main-is-released rule forbids. The renderer block is generated from ops render-chart.mjs by splice-into-workflow.mjs rather than hand-copied, and byte parity with that module was verified against live drydock data before this landed. Also fixes an assertion in the main-is-released test that sliced the whole if-block as the decisive expression and so could never pass. * docs(onboarding): add the main-is-released caller to the section 4 checklist * fix(workflows): close three shared-workflow defects (#36) * fix(workflows): close three shared-workflow defects starchart-refresh: the documented `release: [published]` trigger never fires. GitHub suppresses workflow runs for events caused by GITHUB_TOKEN, and every consuming repo publishes its release with exactly that — portwing via GoReleaser, drydock via `gh release create`. A caller wired from this file's own example lints clean, reads as correctly configured, and refreshes nothing forever. That's the silent-success shape the committed-SVG rework existed to remove, reintroduced by the instructions for it. Example is now a workflow_dispatch the release cut fires, with the suppression and its two documented exceptions written down so the next person doesn't rederive the broken version. Found by the sockguard lane after three repos had been told to adopt it. main-is-released: an exact tag match alone was never the invariant. Any tag satisfied it, so one named `snapshot` or `latest` parked on a drifted main read as a pass. Now requires a release-shaped version. Prerelease detection moved off `case *-*`, which called `my-tag` a prerelease and would have accepted it under allow-prerelease. main-is-released: a promotion merges before its tag is pushed, so a run in that window reported drift that resolved itself seconds later. Three attempts with a tag refetch between them. It can't mask real drift — an untagged main is still untagged on the last attempt — and a failed refetch warns rather than passing. Verified by extracting the decision block and running it against real repositories: v1.7.4 and 1.7.4 pass, snapshot/latest/my-tag fail as malformed, v1.7.0-rc.2 fails as prerelease and passes under allow-prerelease, and allow-prerelease does not reopen the any-tag hole. 87 contract tests green. * fix(workflows): correct two overstated claims CodeRabbit caught The refetch warning said the verdict uses the refs from checkout. It might not: attempt 1 can succeed and attempt 2 fail, and a failed fetch can leave some refs updated. Now says the refs currently available on the runner, which is what's actually true. 'The two documented exceptions to the suppression' was an overclaim. pull_request with opened/synchronize/reopened is a third — it creates a run in an approval-required state rather than being suppressed. workflow_dispatch and repository_dispatch are the two that fire UNATTENDED, which is the property a release cut actually needs, so the comment now says that instead. * chore: gitignore .claude/ so a nested worktree can't be staged as a gitlink (#38) * fix(starchart): the documented dispatch step needs actions:write (#39) * fix(starchart): the documented dispatch step needs actions:write portwing v0.9.7 shipped this snippet as written and the first real cut died on HTTP 403: creating a workflow dispatch is an Actions API write, and contents:write does not imply it. A PAT needs the scope too. Records the tag-push trigger as the other working option, and the evidence that a GITHUB_TOKEN dispatch does create a run, since that was reported as false and it's load-bearing for every cut-dispatched caller in the org. * docs(starchart): cite GitHub's own wording on the dispatch exception * test(starchart): assert the refuted-claim verdict, not just its evidence The contract test named portkey-admin-mcp and github-actions[bot] and stopped there, so a rewrite that kept both source names and reversed the conclusion passed. Verified by mutation: flipping "That does not hold:" to "That is confirmed:" left the old assertions green and now fails. Asserts against the flattened comment prose for the same reason the tag-trigger test does, so the assertions pin the claim rather than the line width. * chore(renovate): tidy go.sum after a gomod update (#40) Renovate writes the new go.sum hashes and leaves the superseded ones behind. `go build` passes because go.sum only has to be sufficient, so the failure surfaces later in the GoReleaser gate, whose `go mod tidy` before-hook removes the stale lines and dirties the tree against a clean-tree assertion. Diagnosed on sockguard #343 by that lane: a go-containerregistry 0.21.8 -> 0.21.9 bump pulled a transitive golang.org/x/net 0.57 -> 0.58 and go.sum ended up carrying all four versions. Fixed in the shared preset rather than per-repo. sockguard and portwing are the two Go consumers, both extend this file with no local postUpdateOptions, so portwing would hit the identical failure on its next transitive bump. Only gomodTidy. gomodUpdateImportPaths was suggested alongside it but addresses major-version module path rewrites, which is a different problem with no observed failure here, and it changes behaviour on every major bump across both repos. * chore(renovate): move the vite ecosystem as one group (#42) The preset groups `minor` and `patch` per manager and leaves majors to split into one PR each. That works everywhere except a peer-locked set, where a major arriving alone has no resolvable outcome at all. careerrat #208 is the worked example: `@vitejs/plugin-react` 6.1.0 peer-requires `vite ^8.0.0`, `vite` is pinned at 6.4.3, and no vite major PR exists for it to land against. The branch is deadlocked no matter how many times it rebases, and `renovate/artifacts`, `tests`, `web-build`, `website-build` and `windows-package-smoke` all fail on it every run. Grouping every update type, not just non-major, is the point: the majors are exactly the ones that have to travel together. The rule sits last so it wins over the non-major group for the packages it names. Affects the three repos that declare any of these, checked against every tracked package.json: careerrat (vite 6.4.3, @vitejs/plugin-react 4.7.0, vitest 3.2.7), drydock (vite 7.3.6/8.2.1/8.2.2, @vitejs/plugin-vue 6.0.8, vitest 4.1.10/4.1.11), mailbox0 (vite ^6.3.5, @vitejs/plugin-react ^4.7.0, vitest ^1.0.4 and 3.2.4, @vitest/ui ^1.0.4). Presets resolve from this repo's default branch, so it takes effect on all three the moment it reaches main. * chore(renovate): scope Portwing lock maintenance exception (#44) * chore(renovate): scope Portwing lock maintenance exception * fix(renovate): use exact Portwing repository match * test(renovate): run config contract in validation * fix(renovate): scope lock maintenance to npm

scttbnsn requested review from ALARGECOMPANY and biggest-littlest as code owners August 27, 2026 05:12

biggest-littlest approved these changes Aug 27, 2026

View reviewed changes

ALARGECOMPANY approved these changes Aug 27, 2026

View reviewed changes

scttbnsn merged commit 0151d3e into dev/repository-standards Aug 27, 2026
4 checks passed

scttbnsn deleted the chore/renovate-gomod-tidy branch August 27, 2026 05:15

scttbnsn mentioned this pull request Aug 27, 2026

Promote: gitignore, starchart permissions, and the Renovate go.sum fix #41

Merged

Navigation Menu

Uh oh!

chore(renovate): tidy go.sum after a gomod update - #40

chore(renovate): tidy go.sum after a gomod update#40
scttbnsn merged 1 commit into
dev/repository-standardsfrom
chore/renovate-gomod-tidy

scttbnsn commented Aug 27, 2026

Uh oh!

coderabbitai Bot commented Aug 27, 2026 •

edited

Loading

Review limit reached

Uh oh!

scttbnsn commented Aug 27, 2026

Uh oh!

coderabbitai Bot commented Aug 27, 2026 •

edited

Loading

Uh oh!

biggest-littlest left a comment

Uh oh!

ALARGECOMPANY left a comment

Uh oh!

Uh oh!

scttbnsn commented Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

scttbnsn commented Aug 27, 2026

The failure this fixes

Why the preset and not the repo

Only gomodTidy

Test

Consumers

Uh oh!

coderabbitai Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

scttbnsn commented Aug 27, 2026

Uh oh!

coderabbitai Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

biggest-littlest left a comment

Choose a reason for hiding this comment

Uh oh!

ALARGECOMPANY left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

scttbnsn commented Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Aug 27, 2026 •

edited

Loading

coderabbitai Bot commented Aug 27, 2026 •

edited

Loading