Repository navigation
chore(release): align every version declaration on 0.5.0 - #353
Merged
Merged
Conversation
package.json was already 0.5.0; jsr.json, gemini-extension.json, the bridge serverInfo (mcp-bridge/lib/version.js), the OTel default (otel.js, glama.json), openapi.yaml, CITATION.cff and the Justfile still said 0.4.7/0.4.6. publish.yml checks package.json for npm and jsr.json for JSR, so a v0.5.0 tag would have failed the JSR job. README note updated and README.md re-derived (byte-identical to the pinned pipeline). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P56iYjCwHmbRyfFrpyJzTC
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing (10)
✨ Finishing Touches📝 Generate docstrings
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🏁 path-claims benchCommit NumbersHost-dependent — compare deltas across commits, not absolute values. |
🔍 Hypatia Security ScanFindings: 113 issues detected
View findings[
{
"reason": "Job `sonarqube` in build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "sonarqube"
},
{
"reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/label-triage.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "triage"
},
{
"reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/labels.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "sync"
},
{
"reason": "Job `deploy` in pages-deploy.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/pages-deploy.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "deploy"
},
{
"reason": "Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
"type": "secret_action_without_presence_gate",
"file": ".github/workflows/instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high",
"fix_recipe": "add_secret_presence_gate"
},
{
"reason": "codeql.yml does not list `language: actions` in its matrix, but the repo has workflow files. CodeQL's `actions` language scans workflow YAML for injection and other CI/CD-specific weaknesses — every repo with workflows benefits. Add an entry to `matrix.include` with `language: actions` + `build-mode: none`.",
"type": "codeql_missing_actions_language",
"file": ".github/workflows/codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"fix_recipe": "add_codeql_actions_language"
},
{
"line": 39,
"reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/labels.yml",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium"
},
{
"line": 46,
"reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/push-email-notify.yml",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium"
},
{
"line": 32,
"reason": "job in .github/workflows/build.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/build.yml",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium"
},
{
"line": 44,
"reason": "job in .github/workflows/container-publish.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/container-publish.yml",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Every version declaration now says 0.5.0, so the owner can cut a working
v0.5.0release. That release lets the aiagentslisting.com sandbox, which runsnpx @hyperpolymath/boj-server@latest, see the current bridge with 68 tools, 6 prompts and 7 resources. Today it sees the 0.4.7 tarball, which reportsserverInfo 0.4.0and 65/6/6.Before this PR,
package.jsonwas already 0.5.0, butjsr.jsonstill said 0.4.7.publish.ymlchecks the tag againstpackage.jsonfor the npm job and againstjsr.jsonfor the JSR job. So av0.5.0tag would have published to npm and then failed the JSR publish. This PR also resolves DEBT X-6. The DEBT row itself is left for the owner to strike after the release.Type of change
Chore / release preparation. No behaviour changes beyond the reported version string.
📌 New pins
Head SHA:
4bb94c8bd94a8efe46d3d30cfa533e8d8ff9f500. This PR adds or changes no pins: no actionuses:,actions.lock, lockfile or container digest changes.Changes
mcp-bridge/lib/version.js(serverInfo.version)mcp-bridge/lib/otel.js(OTel default) andglama.json(its documented default)jsr.json,gemini-extension.jsondocs/specification/openapi.yamlCITATION.cffJustfileversion :=README.adocnote on versions, andREADME.md(re-derived)After merge (owner)
git tag -s v0.5.0 <merge-sha> && git push origin v0.5.0.publish.ymlthen publishes to npm (with provenance) and to JSR.RSR Quality Checklist
Required
npm test(dispatch and routing_args) 31/31,path_claims_test11/11,http_transport_test26/26. The boot smoke under node reportstools=68, exit=0.unsafeblocks without// SAFETY:comments: N/A, no Rust/Zig changes..envfiles included.As Applicable
.machine_readable/*updated: N/A, A2ML is retired (D308).TOPOLOGY.mdupdated: N/A.CHANGELOGupdated: left for the owner's release notes at tag time.Testing
initializeagainstnode mcp-bridge/main.jsreturns{"name":"boj-server","version":"0.5.0"}.readme-derive-reusable.yml@5a0891e9locally (asciidoctor-reducer, then asciidoctor docbook5, then pandoc gfm). After the workflow's own normalisation, the output is identical to the committedREADME.md.jq emptypasses on every edited JSON file.Deferred non-required reds that already fail on main (
governance / UUID v7 conformance,SonarQube, the Zig E2E and Bench jobs,deploy,Dependabot) are tracked in #338, with acceptance criteria in comment 6035981182.🤖 Generated with Claude Code
https://claude.ai/code/session_01P56iYjCwHmbRyfFrpyJzTC