fix(agentlint): add compliance checks, entry file, and standard project docs - #1
fix(agentlint): add compliance checks, entry file, and standard project docs#1ChonSong wants to merge 2 commits into
Conversation
- CLAUDE.md: agent entry file - CHANGELOG.md, SECURITY.md, HANDOFF.md: standard project docs - .gitleaks.toml: secret scanning config - .github/workflows/agentlint.yml: AgentLint PR compliance check - .github/workflows/test-required.yml: gating feat commits on test changes - README: ## Local test section - pyproject.toml: ruff linter config - plans/ directory
📝 WalkthroughWalkthroughThe pull request adds pull request validation workflows, Ruff and Gitleaks configuration, project architecture and handoff documentation, local testing instructions, security reporting guidance, and an initial changelog. ChangesCompliance and project setup
Estimated code review effort: 3 (Moderate) | ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/agentlint.yml:
- Around line 9-10: Disable checkout credential persistence in both workflows:
in .github/workflows/agentlint.yml lines 9-10, add persist-credentials: false to
the actions/checkout step before AgentLint; in
.github/workflows/test-required.yml lines 9-11, add persist-credentials: false
alongside fetch-depth: 0.
In @.github/workflows/test-required.yml:
- Around line 17-18: Update the commit-range resolution around git rev-list so
errors resolving "$base..$head" cause the workflow to exit nonzero rather than
being treated as an empty commit list. Only print “No feat commits to check” and
exit successfully when rev-list completes successfully with no commits; preserve
normal processing for non-empty results.
In @.gitleaks.toml:
- Around line 2-7: Update the [allowlist] regexes so placeholder matches are
anchored to exact intended values rather than arbitrary substrings, and restrict
these exceptions to fixture or documentation-only paths using the
configuration’s path-scoping mechanism. Preserve allowlisting for known test and
non-secret placeholders while preventing real secrets elsewhere from being
suppressed.
In `@CLAUDE.md`:
- Line 13: Specify the fenced code block language in CLAUDE.md by changing the
opening fence to bash, ensuring markdownlint’s MD040 check passes.
- Around line 14-16: Update the documented local-test setup so sourcing .env
exports its variables before pytest runs; apply the same change in CLAUDE.md
lines 14-16 and README.md lines 109-111, using an export-enabled command or
requiring exported definitions in .env.
In `@HANDOFF.md`:
- Around line 5-13: Resolve the architecture contradiction across HANDOFF.md,
CLAUDE.md, and README.md by making Browser WebRTC ↔ WebSocket ↔ Python voice
server ↔ Hermes API the single authoritative direction. Update HANDOFF.md to
remove or revise claims that the LiveKit pipeline is stable and that
LiveKit-native integration is a next action, while preserving only relevant
testing and implementation next steps.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 35ec8732-44d7-4ad3-9063-977b032ba457
📒 Files selected for processing (9)
.github/workflows/agentlint.yml.github/workflows/test-required.yml.gitleaks.tomlCHANGELOG.mdCLAUDE.mdHANDOFF.mdREADME.mdSECURITY.mdpyproject.toml
|
|
||
| ## Local test | ||
|
|
||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Specify the fenced-block language.
Use ```bash so markdownlint’s MD040 check passes.
🧰 Tools
🪛 markdownlint-cli2 (0.23.1)
[warning] 13-13: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CLAUDE.md` at line 13, Specify the fenced code block language in CLAUDE.md by
changing the opening fence to bash, ensuring markdownlint’s MD040 check passes.
Source: Linters/SAST tools
| source .env 2>/dev/null | ||
| pip install -e ".[test]" | ||
| python3 -m pytest tests/ -v |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== files =="
git ls-files | sed -n '1,120p'
echo "== CLAUDE excerpt =="
if [ -f CLAUDE.md ]; then
cat -n CLAUDE.md | sed -n '1,40p'
fi
echo "== README excerpt around 90-120 =="
if [ -f README.md ]; then
cat -n README.md | sed -n '90,125p'
fi
echo "== usages of source .env and env vars in docs/code =="
rg -n "source \.env|export |pytest|\\.env" README.md CLAUDE.md .github tests 2>/dev/null | sed -n '1,200p'
echo "== deterministic shell probe =="
bash -c 'set -euo pipefail; F="$(mktemp)"; echo "FOO=bar" > "$F"; source "$F"; shell_has="$FOO"; python3 - "$F" "$shell_has" << "PY"
import os, sys
print("shell", repr(shell=sys.argv[1]), repr(child=os.environ.get("FOO")))
PY
rm -f "$F"'Repository: ChonSong/intermediary-agent
Length of output: 7980
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== deterministic shell probe =="
bash -c 'set -euo >/dev/null; F="$(mktemp)"; echo "FOO=bar" > "$F"; source "$F" >/dev/null; shell_has="$FOO"; python3 - "$F" "$shell_has" << "PY"
import os, sys
print("shell", repr(sys.argv[1]), "child", repr(os.environ.get("FOO")))
PY
rm -f "$F"'
echo "== tests using env vars =="
for f in tests/*.py; do
echo "-- $f"
rg -n 'os\.environ\.get|pytest\.mark\.skipif|HERMES_URL|HERMES_AUTH_TOKEN|LIVEKIT_URL' "$f" || true
done
echo "== config/env loading paths =="
for f in intermediary/config.py audio/mock_backend.py; do
if [ -f "$f" ]; then
echo "-- $f"
cat -n "$f" | sed -n '1,220p'
fi
doneRepository: ChonSong/intermediary-agent
Length of output: 4440
Export .env variables in the documented local-test setup.
Plain source .env only sets shell variables in the current shell, so they can disappear before pytest reads os.environ. Use an export-enabled command, or require .env to define every needed variable with export. Update both CLAUDE.md and README.md.
📍 Affects 2 files
CLAUDE.md#L14-L16(this comment)README.md#L109-L111
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CLAUDE.md` around lines 14 - 16, Update the documented local-test setup so
sourcing .env exports its variables before pytest runs; apply the same change in
CLAUDE.md lines 14-16 and README.md lines 109-111, using an export-enabled
command or requiring exported definitions in .env.
| - Project is actively developed. | ||
| - Core voice pipeline (LiveKit worker + HTTP server) is stable. | ||
| - Transcriptions, distillation, and steering modules are tested. | ||
|
|
||
| ## Next Actions | ||
|
|
||
| - [ ] Integration test coverage for LiveKit-native pipeline | ||
| - [ ] E2E test with actual audio input | ||
| - [ ] Barge-in steering edge cases (partial overlap, chunk boundaries) |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Resolve the LiveKit architecture contradiction.
This handoff calls the LiveKit pipeline stable and makes LiveKit-native integration a next action, while CLAUDE.md and README.md define the WebRTC → WebSocket → Python voice server path and explicitly say “No LiveKit.” Update the handoff or the architecture docs so there is one authoritative direction.
Based on learnings, the maintained architecture is Browser WebRTC ⟷ WebSocket ⟷ Python voice server ⟷ Hermes API.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@HANDOFF.md` around lines 5 - 13, Resolve the architecture contradiction
across HANDOFF.md, CLAUDE.md, and README.md by making Browser WebRTC ↔ WebSocket
↔ Python voice server ↔ Hermes API the single authoritative direction. Update
HANDOFF.md to remove or revise claims that the LiveKit pipeline is stable and
that LiveKit-native integration is a next action, while preserving only relevant
testing and implementation next steps.
Source: Learnings
…ls, gitleaks scoping, rev-list error handling, tests/ pattern, reopened trigger
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
.gitleaks.toml (1)
4-9: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winRequire both the placeholder value and trusted path to match.
Gitleaks allowlist criteria default to OR, so this currently suppresses every finding under
tests/orCONTRIBUTING.md, not onlytest*placeholders. Addcondition = "AND"to prevent real secrets in those paths from bypassing scanning. (github.com)Proposed fix
regexes = [ "(?i)^test(-|_|$)", ] +condition = "AND" paths = [🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.gitleaks.toml around lines 4 - 9, Update the Gitleaks allowlist configuration containing regexes and paths to set its matching condition to AND, requiring both the test-placeholder regex and trusted path pattern to match before suppressing a finding.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/test-required.yml:
- Line 28: Update the test_files pattern in the workflow to match test
directories or test filenames only at path boundaries, preventing substrings
such as “latest” or “contest” from being classified as tests. Preserve detection
for valid tests/ paths, test_ or test directories, .test. filenames, and
_test.py files.
---
Duplicate comments:
In @.gitleaks.toml:
- Around line 4-9: Update the Gitleaks allowlist configuration containing
regexes and paths to set its matching condition to AND, requiring both the
test-placeholder regex and trusted path pattern to match before suppressing a
finding.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: deada90b-f83c-4454-b4f9-147569ca664b
📒 Files selected for processing (3)
.github/workflows/agentlint.yml.github/workflows/test-required.yml.gitleaks.toml
| files=$(git diff-tree --no-commit-id -r --name-only "$sha" | tr '\n' ' ') | ||
| case "$msg" in | ||
| feat:*) | ||
| test_files=$(echo "$files" | grep -Eo 'tests/|test[_/]|\.test\.|_test\.py' || true) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Anchor test-file matching to path boundaries.
Line 28’s test[_/] alternative matches substrings inside unrelated paths such as latest/README.md and contest/README.md, allowing a feat: commit to pass without changing tests. Match complete path components or filenames instead.
Proposed fix
- test_files=$(echo "$files" | grep -Eo 'tests/|test[_/]|\.test\.|_test\.py' || true)
+ test_files=$(printf '%s\n' "$files" | grep -Eo '(^|[[:space:]])([^[:space:]]*/)?tests?/|(^|[[:space:]])([^[:space:]]*/)?test_[^[:space:]]*|(^|[[:space:]])[^[:space:]]+\.test\.[^[:space:]]+|(^|[[:space:]])[^[:space:]]+_test\.py' || true)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| test_files=$(echo "$files" | grep -Eo 'tests/|test[_/]|\.test\.|_test\.py' || true) | |
| test_files=$(printf '%s\n' "$files" | grep -Eo '(^|[[:space:]])([^[:space:]]*/)?tests?/|(^|[[:space:]])([^[:space:]]*/)?test_[^[:space:]]*|(^|[[:space:]])[^[:space:]]+\.test\.[^[:space:]]+|(^|[[:space:]])[^[:space:]]+_test\.py' || true) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/test-required.yml at line 28, Update the test_files
pattern in the workflow to match test directories or test filenames only at path
boundaries, preventing substrings such as “latest” or “contest” from being
classified as tests. Preserve detection for valid tests/ paths, test_ or test
directories, .test. filenames, and _test.py files.
1 participant
AgentLint compliance PR matching the pattern established in
riptide#22.Added
## Local testsectionCI
Summary by CodeRabbit
New Features
Documentation
Chores