chore: hygiene + hardening bundle (CODEOWNERS, SHA-pins, uv ecosystem, proposal cleanup)#28
Merged
Merged
Conversation
…prune proposal Bundle of four backlog items for paybot-sdk supply-chain + governance hygiene: #5 Delete stale .github/workflows/ci.yml.proposed (speculative draft from earlier experimentation; left dead in tree, creates confusion when reading workflows). #6 Add .github/CODEOWNERS routing all paths to @RBKunnela (solo-founder phase). Removes the duplicate root /CODEOWNERS — .github/CODEOWNERS takes precedence per GitHub's discovery order, so the root file would be dead-ignored. #11 Add `uv` ecosystem block to dependabot.yml covering /packages/python. Variance from task spec (which said `pip`): the live evidence — Dependabot's own auto-opened PR #12 on this repo carrying `package-manager=uv` — proves Dependabot natively understands the uv.lock format. Using `pip` would only cover pyproject.toml manifests and miss lockfile-pinned transitive deps. #12 SHA-pin all GitHub Actions references across ci.yml, codeql.yml, and osv-scanner.yml to 40-char immutable commit SHAs with adjacent `# vX` comments preserving floating-tag intent for Dependabot upgrades. Adds `persist-credentials: false` to checkout steps where applicable. The `npm publish` job in ci.yml intentionally omits it (OIDC GITHUB_TOKEN must remain for `--provenance`). Resolutions (gh api repos/<owner>/git/refs/tags/<v>): actions/checkout@v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 actions/setup-node@v4 -> 49933ea5288caeca8642d1e84afbd3f7d6820020 github/codeql-action/*@V3 -> 03e4368ac7daa2bd82b3e85262f3bf87ee112f57 osv-scanner-reusable.yml@v2.2.1 -> 456ceb78310755116e0a3738121351006286b797 CodeRabbit on PR #11 (squash 2513676) flagged action pinning as MAJOR tech-debt; this closes that finding. Precedent: paybot-core sibling PR (parallel hygiene-and-hardening track, same convocation). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (7)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
…existing root CODEOWNERS Restore the /packages/python/ rule routing reviews to both @RBKunnela and @kite-builds. Operator confirmed 2026-05-22 that this rule is intentional (specialized reviewer for the Python port), not stale — reversing the prior session decision that flagged it for removal. Other path rules from the deleted root CODEOWNERS (/src/, /examples/) routed to @RBKunnela only and were therefore functionally equivalent to the `*` catch-all. Not restored — restoring them would add noise without changing review routing. Operator's amendment spec also omits them, aligning with this reading. If review routing for those paths needs to differ from the catch-all in future, partition then. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Owner
Author
|
Merge authorization per .claude/rules/automated-pr-merge-authority.md (4th application, paybot-sdk track — final merge of 3-repo hygiene+hardening sweep):
Non-blocking observations:
Precedent chain (today, 2026-05-22):
This completes the 6-PR security hardening sweep across the paybot ecosystem in a single day. |
This was referenced May 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bundles four backlog items for paybot-sdk supply-chain + governance hygiene, executed under the second
automated-pr-merge-authority.mdconvocation following the paybot-core sibling PR (parallel hygiene-and-hardening track)..github/workflows/ci.yml.proposed.github/CODEOWNERS(solo-founder catch-all).github/dependabot.yml(uv, notpip)persist-credentials: falseto checkout where applicableChanges
Task #5 — Prune
ci.yml.proposed.github/workflows/ci.yml.proposedwas a speculative draft of a richer CI (lint + coverage gate + boundary check + npm pack dry-run + manual approval). Left dead in the tree, it creates confusion when reading.github/workflows/. Removed viagit rm.Task #6 —
.github/CODEOWNERSCreated
.github/CODEOWNERS:```
CODEOWNERS for paybot-sdk
Solo-founder phase: all paths route to operator.
When hiring, partition by file path here.
```
Reconciliation note: A root-level
CODEOWNERSwas already present, with path-specific routing (/packages/python/ @RBKunnela @kite-builds, etc.). GitHub honours CODEOWNERS in order.github/-> root ->docs/, so the root file would become dead-ignored once.github/CODEOWNERSexists. To avoid two divergent sources of truth, the root file is removed in the same commit. The simpler catch-all reflects the current solo-founder reality; partition is the explicit "when hiring" comment in the file.Task #11 —
uvecosystem in DependabotAdded a third ecosystem block to
.github/dependabot.yml:```yaml
directory: "/packages/python"
schedule:
interval: "weekly"
day: "tuesday"
time: "06:00"
timezone: "UTC"
open-pull-requests-limit: 10
commit-message:
prefix: "deps"
include: "scope"
labels:
```
Variance from task spec (deliberate, documented): the task brief specified
package-ecosystem: pip. Replaced withuvbecause live evidence proves Dependabot natively understands the uv.lock format on this repo — Dependabot already auto-opened PR #12 (`chore(deps): bump mcp from 0.9.1 to 1.23.0 in /packages/python`) underpackage-manager=uvas a security update. Theuvecosystem readspyproject.toml+uv.lock; thepipecosystem would only coverpyproject.tomland miss lockfile-pinned transitive deps. Theuvchoice closes that gap.On the 3 mcp Python CVEs: the task brief flagged that Dependabot's pip support for uv-style lockfiles is uncertain. The empirical answer (PR #12) is:
uvworks end-to-end including security updates. The 3 high CVEs were already surfaced before this PR landed; merging this PR enables regular (non-security) version updates on the same schedule.Task #12 — SHA-pin GitHub Actions
CodeRabbit on PR #11 (squash
2513676d) flagged unpinned actions as MAJOR-level tech-debt. Pinned all references across the three active workflows to 40-char immutable commit SHAs with adjacent# v<X>comments preserving Dependabot's upgrade visibility.Pin audit table
ci.yml(build)actions/checkout@v434e114876b0b11c390a56381ad16ebd13914f8d5persist-credentials: falseci.yml(build)actions/setup-node@v449933ea5288caeca8642d1e84afbd3f7d6820020ci.yml(publish)actions/checkout@v434e114876b0b11c390a56381ad16ebd13914f8d5persist-credentials: false— OIDCGITHUB_TOKENmust remain fornpm publish --provenanceci.yml(publish)actions/setup-node@v449933ea5288caeca8642d1e84afbd3f7d6820020codeql.ymlactions/checkout@v434e114876b0b11c390a56381ad16ebd13914f8d5persist-credentials: falsecodeql.ymlgithub/codeql-action/init@v303e4368ac7daa2bd82b3e85262f3bf87ee112f57codeql.ymlgithub/codeql-action/autobuild@v303e4368ac7daa2bd82b3e85262f3bf87ee112f57codeql.ymlgithub/codeql-action/analyze@v303e4368ac7daa2bd82b3e85262f3bf87ee112f57osv-scanner.ymlgoogle/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.2.1456ceb78310755116e0a3738121351006286b797uses:Resolutions performed via:
```
gh api "repos///git/refs/tags/" --jq '{ref, sha:.object.sha, type:.object.type}'
```
For
github/codeql-actionthe tag is annotated; dereferenced viagh api repos/github/codeql-action/git/tags/<tag-sha>to reach the commit SHA.persist-credentials: falsepolicyAdded to every
actions/checkoutstep EXCEPT the one in thepublishjob. Rationale:npm publish --provenanceneeds the OIDC-issuedGITHUB_TOKENto remain available; settingpersist-credentials: falsewould null it out for the subsequentnpm publishstep. Documented inline above that checkout step.Chain governance
Per
automated-pr-merge-authority.md, this PR enters the second-stage SINKRA chain alongside the paybot-core sibling PR:@aiox-master(Orion)@devops; chore carve-out justified (no src/, no semantic behavior change, diff entirely under.github/)@sm/@po/@dev@qa(Quinn)@devops(Gage)Anti-patterns avoided
@v2major alias does not resolve@v2.2.1pre-PR; this PR further pins to SHApermissions:are silently droppedpermissions:inosv-scanner.ymluntouchedgh pr checksverbatimvulnerability-alerts->automated-security-fixes)@devopsdecisionTest plan
build (18)+build (20)+Analyze (javascript-typescript)+scan / osv-scanuvecosystem (PR chore(deps): bump mcp from 0.9.1 to 1.23.0 in /packages/python #12 mcp 1.23.0 is the pre-existing security update; regular cadence updates come on Tuesday 06:00 UTC)🤖 Generated with Claude Code