Add comment-fmt, wire up CI check - #30
Conversation
Adds comment-fmt as a dev dependency and a CI job that runs --check, before any reformat. Expected to fail until the follow-up --write pass lands. Also exempts comment-fmt from bunfig.toml's minimumReleaseAge policy, self-authored and self-published, not the kind of third-party dependency that policy guards against, and without it CI's install step fails immediately on a fresh release.
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe repository reformats source comments, adds ChangesComment format enforcement
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/continuous-integration.yaml:
- Around line 41-42: Remove or defer the “Comment format” workflow step running
bun run comment-fmt:check until the formatter baseline is clean; alternatively,
format all five affected files before enabling it. Ensure the CI job does not
run as a known-failing check.
In `@bunfig.toml`:
- Around line 6-9: Restrict the minimumReleaseAgeExcludes entry to
comment-fmt@0.1.4 instead of all versions, and remove that exemption once 0.1.4
has passed the seven-day release window. Also pin the Bun version used by CI
rather than relying on the setup action default.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2ac343ce-6aef-40a8-9770-d03c718333d3
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (3)
.github/workflows/continuous-integration.yamlbunfig.tomlpackage.json
| - name: Comment format | ||
| run: bun run comment-fmt:check |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Do not add a check that the current PR is known to fail.
The PR leaves five files unformatted, so bun run comment-fmt:check will fail on every run. A required check blocks merging. A non-required check leaves CI red and reduces its signal.
Format the files before enabling this job, or defer the job until the formatter baseline is clean.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/continuous-integration.yaml around lines 41 - 42, Remove
or defer the “Comment format” workflow step running bun run comment-fmt:check
until the formatter baseline is clean; alternatively, format all five affected
files before enabling it. Ensure the CI job does not run as a known-failing
check.
| # comment-fmt is self-authored and self-published (Vilos92/comment-fmt), not a third-party | ||
| # dependency this policy is meant to guard against. Exempted so a fresh release doesn't block | ||
| # installing our own tool immediately after publishing it. | ||
| minimumReleaseAgeExcludes = ["comment-fmt"] |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- bunfig.toml ---'
cat -n bunfig.toml
printf '%s\n' '--- package.json dependency ---'
rg -n -C 3 '"comment-fmt"' package.json
printf '%s\n' '--- lockfile comment-fmt entries ---'
rg -n -C 5 'comment-fmt|comment_fmt' bun.lock
printf '%s\n' '--- CI Bun references ---'
rg -n -i -C 3 'oven-sh/setup-bun|bun-version|bun install|bunx|minimumReleaseAge|comment-fmt' .github bunfig.toml package.json bun.lock 2>/dev/null || true
printf '%s\n' '--- tracked relevant files ---'
git ls-files bunfig.toml package.json bun.lock '.github/**'Repository: Vilos92/gdex
Length of output: 6422
🏁 Script executed:
#!/bin/bash
set -eu
cat -n bunfig.toml
rg -n -C 3 '"comment-fmt"' package.json
rg -n -C 5 'comment-fmt|comment_fmt' bun.lock
rg -n -i -C 3 'setup-bun|bun-version|bun install|bunx|minimumReleaseAge|comment-fmt' .github bunfig.toml package.json bun.lock 2>/dev/null || trueRepository: Vilos92/gdex
Length of output: 6068
🌐 Web query:
Bun bunfig minimumReleaseAgeExcludes semantics package name all versions
💡 Result:
In Bun, the minimumReleaseAgeExcludes configuration in bunfig.toml allows you to exempt specific packages from the minimumReleaseAge requirement, which prevents the installation of recently published, potentially unstable, or malicious package versions [1][2]. The minimumReleaseAgeExcludes setting supports the following semantics for package specification: 1. Bare Package Names: Providing an exact package name (e.g., "typescript") exempts all versions of that package from the age gate [1][3]. 2. Pinned Versions (name@version): You can exempt a specific version of a package by using the name@version format (e.g., "typescript@5.4.5"). This allows you to whitelist a vetted, specific version while keeping the age gate active for all other, newer versions of that same package [3]. 3. Wildcard Patterns: You can use wildcard patterns (e.g., "@my-organization/" or "hotfix-") to match multiple packages at once. The * character matches zero or more characters and can be used at the beginning, middle, or end of a pattern [4]. When Bun resolves dependencies, it checks these exclusion entries to determine if a package version should be filtered by the age requirement [3]. If a version is explicitly excluded via a pinned version or falls under a matched wildcard pattern, it bypasses the age restriction and is treated as a valid candidate for installation [3][4]. Existing dependencies locked in bun.lock are not affected by changes to these settings, as the gate only applies to new package resolution [1].
Citations:
- 1: https://bun.com/docs/pm/cli/install
- 2: https://bun.com/docs/runtime/bunfig
- 3: install: support name@version entries in minimumReleaseAgeExcludes oven-sh/bun#28970
- 4: Add wildcard support to minimumReleaseAgeExcludes oven-sh/bun#23699
🌐 Web query:
oven-sh/setup-bun v2.2.0 bun-version default latest action.yml
💡 Result:
In the oven-sh/setup-bun v2.2.0 GitHub Action, the bun-version input does not have a hardcoded static default value in the action.yml that forces it to always be latest [1][2]. Instead, the action implements dynamic version resolution logic [1][3]. By default, if the bun-version input is not explicitly specified by the user, the action follows this priority order to determine which version to install [1][4]: 1. Package Manager Field: It first checks the package.json file for the packageManager field (e.g., "packageManager": "bun@1.0.25") [1][2]. 2. Engines Field: If packageManager is not found, it checks the package.json file for the engines.bun field [1][2]. 3. Latest: If neither of the above is found, or if a package.json file does not exist, the action defaults to using the latest version [1][4]. Users can also explicitly set the version by providing a value to the bun-version input (e.g., latest, canary, or a specific version like 1.0.0) [1][2].
Citations:
- 1: https://github.com/oven-sh/setup-bun
- 2: https://github.com/marketplace/actions/setup-bun
- 3: https://github.com/oven-sh/setup-bun?search=1
- 4: https://github.com/oven-sh/setup-bun/tree/refs/heads/main
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- Bun setup action and CI context ---'
cat -n .github/actions/install-bun-and-dependencies/action.yaml
printf '%s\n' '--- workflows using the local install action ---'
rg -n -C 5 'install-bun-and-dependencies|permissions:|bun-version|setup-bun' .github/workflows .github/actions
printf '%s\n' '--- lockfile metadata ---'
head -n 45 bun.lockRepository: Vilos92/gdex
Length of output: 12137
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import json, re, pathlib
bunfig = pathlib.Path("bunfig.toml").read_text()
package = json.loads(pathlib.Path("package.json").read_text())
lock = json.loads(pathlib.Path("bun.lock").read_text())
age = re.search(r"^\s*minimumReleaseAge\s*=\s*(\d[\d_]*)\s*$", bunfig, re.M)
excludes = re.search(r"^\s*minimumReleaseAgeExcludes\s*=\s*\[(.*?)\]\s*$", bunfig, re.M)
dep = package["devDependencies"]["comment-fmt"]
locked = lock["packages"]["comment-fmt"][0]
print("minimumReleaseAge_seconds =", int(age.group(1).replace("_", "")) if age else None)
print("minimumReleaseAgeExcludes =", excludes.group(1).strip() if excludes else None)
print("package_json_comment_fmt =", dep)
print("bun_lock_comment_fmt =", locked)
print("exact_version_exclusion =", bool(re.search(r'"comment-fmt@\d+\.\d+\.\d+"', excludes.group(1))) if excludes else False)
print("packageManager_field =", package.get("packageManager"))
print("engines_bun_field =", package.get("engines", {}).get("bun"))
print("ci_install_is_frozen =", "bun install --frozen-lockfile" in pathlib.Path(".github/actions/install-bun-and-dependencies/action.yaml").read_text())
print("ci_bun_version_explicit =", bool(re.search(r"bun-version\s*:", pathlib.Path(".github/actions/install-bun-and-dependencies/action.yaml").read_text())))
PYRepository: Vilos92/gdex
Length of output: 667
🌐 Web query:
site:bun.com/docs/pm/cli/install minimumReleaseAge frozen-lockfile locked dependencies age gate
💡 Result:
The minimumReleaseAge configuration is a security feature primarily associated with the Bun package manager that protects against supply chain attacks by preventing the installation of recently published packages [1]. Key aspects of how this feature functions in conjunction with dependency management include: Minimum Age Requirement: It allows users to set a threshold (in seconds) that package versions must meet based on their publication time to be eligible for installation [1]. Interaction with Frozen Lockfiles: When using a frozen lockfile (via --frozen-lockfile or the equivalent configuration), Bun enforces strict dependency resolution [1]. The minimumReleaseAge filter only impacts new package resolution; packages already present in the existing lockfile are treated as trusted and remain unchanged [1]. Scope: The age gate applies to both direct and transitive dependencies [1]. Stability Check: If the filter blocks versions due to the age gate, Bun performs an additional stability check for rapid bugfix patterns [1]. If it detects multiple versions published in quick succession just outside the age gate, it may automatically extend the filter to select a more mature, older version [1]. Exclusions: Users can explicitly exclude specific packages from this check using the minimumReleaseAgeExcludes configuration [1]. Exact Version Requests: Requests for an exact version (e.g., package@1.1.1) will still respect the age gate but will bypass the automated stability check [1]. The configuration can be set via command-line arguments or through Bun's configuration file (e.g., bunfig.toml) [1]. Example configuration: minimumReleaseAge = 259200 # 3 days in seconds minimumReleaseAgeExcludes = ["@types/node", "typescript"] [1]
Citations:
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import json, re, pathlib
bunfig = pathlib.Path("bunfig.toml").read_text()
package = json.loads(pathlib.Path("package.json").read_text())
lock = json.loads(pathlib.Path("bun.lock").read_text())
print("minimumReleaseAge:", re.search(r"minimumReleaseAge\s*=\s*(\d[\d_]*)", bunfig).group(1))
print("exclude:", re.search(r"minimumReleaseAgeExcludes\s*=\s*\[(.*?)\]", bunfig).group(1).strip())
print("dependency:", package["devDependencies"]["comment-fmt"])
print("locked:", lock["packages"]["comment-fmt"][0])
print("packageManager:", package.get("packageManager"))
print("engines.bun:", package.get("engines", {}).get("bun"))
action = pathlib.Path(".github/actions/install-bun-and-dependencies/action.yaml").read_text()
print("frozen_lockfile:", "bun install --frozen-lockfile" in action)
print("explicit_bun_version:", bool(re.search(r"bun-version\s*:", action)))
PYRepository: Vilos92/gdex
Length of output: 667
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import pathlib, re
bunfig = pathlib.Path("bunfig.toml").read_text()
package = pathlib.Path("package.json").read_text()
lock = pathlib.Path("bun.lock").read_text()
action = pathlib.Path(".github/actions/install-bun-and-dependencies/action.yaml").read_text()
age = re.search(r"^\s*minimumReleaseAge\s*=\s*(\d[\d_]*)\s*$", bunfig, re.M)
excludes = re.search(r"^\s*minimumReleaseAgeExcludes\s*=\s*\[(.*?)\]\s*$", bunfig, re.M)
dep = re.search(r'"comment-fmt"\s*:\s*"([^"]+)"', package)
locked = re.search(r'"comment-fmt":\s*\["comment-fmt@([^"]+)"', lock)
print("minimumReleaseAge_seconds =", int(age.group(1).replace("_", "")) if age else None)
print("minimumReleaseAgeExcludes =", excludes.group(1).strip() if excludes else None)
print("package_json_comment_fmt =", dep.group(1) if dep else None)
print("bun_lock_comment_fmt =", locked.group(1) if locked else None)
print("packageManager_field_present =", bool(re.search(r'"packageManager"\s*:', package)))
print("engines_bun_field_present =", bool(re.search(r'"engines"\s*:\s*\{[^}]*"bun"\s*:', package, re.S)))
print("ci_install_is_frozen =", "bun install --frozen-lockfile" in action)
print("ci_bun_version_explicit =", bool(re.search(r"bun-version\s*:", action)))
PYRepository: Vilos92/gdex
Length of output: 421
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import pathlib, re
bunfig = pathlib.Path("bunfig.toml").read_text()
package = pathlib.Path("package.json").read_text()
lock = pathlib.Path("bun.lock").read_text()
action = pathlib.Path(".github/actions/install-bun-and-dependencies/action.yaml").read_text()
for label, pattern, text in [
("minimumReleaseAge_seconds", r"^\s*minimumReleaseAge\s*=\s*(\d[\d_]*)\s*$", bunfig),
("minimumReleaseAgeExcludes", r"^\s*minimumReleaseAgeExcludes\s*=\s*\[(.*?)\]\s*$", bunfig),
("package_json_comment_fmt", r'"comment-fmt"\s*:\s*"([^"]+)"', package),
("bun_lock_comment_fmt", r'"comment-fmt":\s*\["comment-fmt@([^"]+)"', lock),
]:
m = re.search(pattern, text, re.M | re.S)
print(label, "=", m.group(1).replace("_", "") if m else None)
print("packageManager_field_present =", bool(re.search(r'"packageManager"\s*:', package)))
print("engines_bun_field_present =", bool(re.search(r'"engines"\s*:\s*\{[^}]*"bun"\s*:', package, re.S)))
print("ci_install_is_frozen =", "bun install --frozen-lockfile" in action)
print("ci_bun_version_explicit =", bool(re.search(r"bun-version\s*:", action)))
PYRepository: Vilos92/gdex
Length of output: 421
Scope the exemption to the bootstrap version.
minimumReleaseAgeExcludes = ["comment-fmt"] exempts every version, while package.json allows future 0.1.x releases. Use ["comment-fmt@0.1.4"], then remove the exemption after 0.1.4 passes the seven-day window. Pin the Bun version because CI currently uses the setup action’s default version.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@bunfig.toml` around lines 6 - 9, Restrict the minimumReleaseAgeExcludes entry
to comment-fmt@0.1.4 instead of all versions, and remove that exemption once
0.1.4 has passed the seven-day release window. Also pin the Bun version used by
CI rather than relying on the setup action default.
Bulk --write pass across 5 files. All plain single-line JSDoc/line comments expanding to the multi-line starred form, no mangles (ignore/disable/expect-error/tables/box-drawing untouched).
No existing hook mechanism in this repo. Adds simple-git-hooks (the installer) plus lint-staged (the staged-file runner, handles partial staging and re-staging safely). comment-fmt runs last in the lint-staged pipeline, after biome, since biome re-indents comments as part of formatting the surrounding code and comment-fmt's width math depends on the final indentation.
There was a problem hiding this comment.
🧹 Nitpick comments (1)
package.json (1)
57-59: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winUse the Bun runner in the pre-commit hook.
Replace
npx lint-stagedwithbun x lint-stagedto follow the Bun-firstpackage.jsonrequirement.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` around lines 57 - 59, Update the simple-git-hooks pre-commit command to invoke lint-staged through the Bun runner, replacing the current npx invocation with bun x while preserving the existing hook behavior.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@package.json`:
- Around line 57-59: Update the simple-git-hooks pre-commit command to invoke
lint-staged through the Bun runner, replacing the current npx invocation with
bun x while preserving the existing hook behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: a8a2653a-21b4-45ff-8a08-b68cc85601cf
⛔ Files ignored due to path filters (1)
bun.lockis excluded by!**/*.lock
📒 Files selected for processing (6)
package.jsonsrc/components/TaskList/taskList.css.tssrc/lib/keyboard/scope.tssrc/lib/keyboard/taskListNavigation.tssrc/lib/taskLevel.tssrc/views/WorkspacesLayout.tsx
Fixes a case where a @tag's own description stayed at whatever uneven line breaks it was originally authored with even when the paragraph right above it needed rewrapping. No source files in this repo were affected by the bug, so this is a dependency bump only. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14jepHHRWgvVGxQf7dhMS
0.1.9/0.1.10 only changed --check/--diff's own output formatting; format()/wrap() reflow logic is unchanged since 0.1.8, so no source files are affected. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14jepHHRWgvVGxQf7dhMS
Copied from simple-git-hooks' own generic README example without adapting it to this repo's Bun-first setup. npx implicitly depends on npm (or, on this machine, a Vite+-provided shim) being present; bunx is guaranteed to exist wherever bun already is, which this repo already requires. --bun forces the invocation through Bun's runtime rather than deferring to Node via lint-staged's own shebang. Verified end to end: staged a real change and ran the regenerated hook, same biome + comment-fmt behavior as before. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W14jepHHRWgvVGxQf7dhMS
1 participant
Summary
comment-fmtas a dev dependency and a CI job (comment-fmt) that runscomment-fmt --check.simple-git-hooks+lint-staged), at which point CI goes green.Test plan
bun run comment-fmt:checkfails, listing 5 filescomment-fmtjob fails on this PRSummary by CodeRabbit
Chores
Documentation