Release CodeTruss CLI v0.2.39 - #22
Merged
Merged
Conversation
Bring the public mirror up to the shipped release. The mirror sat at 0.2.38 while codetruss.com served 0.2.39; the newest attested tag should never trail the bytes the site hands out. Source is mirrored from the 0.2.39 release commit 4dbd312, not from in-progress work — main has since moved on to unrelated changes: 117 files across packages/cli and packages/analyzer-engine, zero content mismatches and zero file-mode mismatches against that commit's trees. The count grows from 114 because the registry gains `comment-slop.ts`, `overengineering.ts`, and the shared `comments.ts` lexer they read; `packages/cli/SBOM.cdx.json` stays generated and gitignored here, as it has since 0.2.13. `pnpm release:artifact` rebuilds the bundle to the exact published digest feb9a7454abaf2c25bdeade2a6e638137290df8c0725a447e3aca04aef2bd8f0, and `pnpm release:verify` confirms it byte-for-byte against the immutable website archive now recorded in release-reference.json. The archive, its SBOM, and the latest.json manifest downloaded from codetruss.com this run are byte-identical to the ones built from this tree. - Add the immutable 0.2.39 archive, checksum, and SBOM to public/downloads and repoint the latest.* aliases and manifest. The 0.2.38 archive stays: it is a tagged, attested release. - Update release-reference.json to the published archive, its SBOM, and the bundle digest 85f3475cb84d4ce349d43a0c81c68cbf40bd573e731c5e731eeff55ae7405c4b. - Mirror the source 0.2.39 carries — the two new analyzers and the comment lexer, the registry that seats them, the Convex carve-out in dead-code.ts, the v3 receipt renderer and its frozen v2 predecessor, and their tests — plus the packaged changelog, and regenerate the root changelog from it so the release body stays byte-identical to what ships inside the archive. - Repoint the version-pinned README install and verification examples, and say 15 analyzers where the README describes what runs today. The receipt excerpt keeps its "real 0.2.36 run" provenance and its `local-registry-v2`, 13-analyzer wording: 0.2.39 ships a frozen v2 renderer that reproduces that wording byte for byte, so the excerpt is still what that run printed. Relabelling it v3 would assert a run that was never made. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 52 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. 📝 WalkthroughWalkthroughChangesAnalyzer and release update
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant ANALYZERS
participant commentSlopAnalyzer
participant overengineeringAnalyzer
participant receipt.ts
ANALYZERS->>commentSlopAnalyzer: analyze eligible source files
commentSlopAnalyzer-->>ANALYZERS: findings and comment metrics
ANALYZERS->>overengineeringAnalyzer: analyze exported symbols and catch blocks
overengineeringAnalyzer-->>ANALYZERS: structural findings and metrics
ANALYZERS->>receipt.ts: provide pass results
receipt.ts-->>receipt.ts: render comment metrics and profile disclosure
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/analyzer-engine/src/registry.ts`:
- Around line 36-37: Update the documented registry analyzer count and the CLI
receipt test assertion from 13 to 15 to reflect the newly registered
commentSlopAnalyzer and overengineeringAnalyzer entries.
In `@packages/cli/src/receipt.ts`:
- Around line 295-318: The reported comment signal must count unique files
rather than summing overlapping category counts. Update commentSignalLines() to
derive reported from the union of files reported by redundantCommentFiles and
narrationCommentFiles, preserving the existing wording; update the corresponding
fixture/assertion in packages/cli/test/receipt.test.ts lines 211-230 to expect
the deduplicated file count.
In `@packages/cli/src/types.ts`:
- Around line 36-48: Update the documentation above LOCAL_ANALYSIS_PROFILE to
accurately describe the serialized fields: state that local-registry-v3
identifies the analyzer set rather than claiming the profile block contains an
explicit analyzer count. Keep the existing id/versioning rationale and frozen
renderer references unchanged.
In `@README.md`:
- Line 7: Update the receipt example in README.md to use the current v3 format
and 15-analyzer output, or explicitly label it as a historical v2 compatibility
example so it is not presented as current CLI output.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d3a70c5c-f7fa-4c39-a13e-1ea784e214ea
📒 Files selected for processing (24)
CHANGELOG.mdREADME.mdpackages/analyzer-engine/src/comment-slop.tspackages/analyzer-engine/src/comments.tspackages/analyzer-engine/src/dead-code.tspackages/analyzer-engine/src/overengineering.tspackages/analyzer-engine/src/registry.tspackages/cli/CHANGELOG.mdpackages/cli/README.mdpackages/cli/package.jsonpackages/cli/src/local-sast.tspackages/cli/src/receipt.tspackages/cli/src/types.tspackages/cli/test/analysis-profile.test.tspackages/cli/test/local-sast.test.tspackages/cli/test/receipt.test.tspublic/downloads/codetruss-cli-0.2.39.sbom.cdx.jsonpublic/downloads/codetruss-cli-0.2.39.tgzpublic/downloads/codetruss-cli-0.2.39.tgz.sha256public/downloads/codetruss-cli-latest.jsonpublic/downloads/codetruss-cli-latest.sbom.cdx.jsonpublic/downloads/codetruss-cli-latest.tgzpublic/downloads/codetruss-cli-latest.tgz.sha256release-reference.json
The example is labelled as a real 0.2.36 run, but the paragraph above it now says fifteen analyzers, and a reader landing on the profile block has no reason to connect `local-registry-v2` and thirteen to the older run rather than to today's output. The label now names the profile it prints and what this release prints instead, which is also the behaviour 0.2.39 guarantees: the v2 renderer is frozen so a receipt signed under it still verifies as signed. Raised by CodeRabbit on #22. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bring the public mirror up to the shipped release. The mirror sat at 0.2.38
while codetruss.com served 0.2.39; the newest attested tag should never trail
the bytes the site hands out.
Source is mirrored from the 0.2.39 release commit 4dbd312, not from in-progress
work — main has since moved on to unrelated changes: 117 files across
packages/cli and packages/analyzer-engine, zero content mismatches and zero
file-mode mismatches against that commit's trees. The count grows from 114
because the registry gains
comment-slop.ts,overengineering.ts, and theshared
comments.tslexer they read;packages/cli/SBOM.cdx.jsonstaysgenerated and gitignored here, as it has since 0.2.13.
pnpm release:artifactrebuilds the bundle to the exact published digestfeb9a7454abaf2c25bdeade2a6e638137290df8c0725a447e3aca04aef2bd8f0, and
pnpm release:verifyconfirms it byte-for-byte against the immutable websitearchive now recorded in release-reference.json. The archive, its SBOM, and the
latest.json manifest downloaded from codetruss.com this run are byte-identical
to the ones built from this tree.
repoint the latest.* aliases and manifest. The 0.2.38 archive stays: it is a
tagged, attested release.
bundle digest 85f3475cb84d4ce349d43a0c81c68cbf40bd573e731c5e731eeff55ae7405c4b.
lexer, the registry that seats them, the Convex carve-out in dead-code.ts, the
v3 receipt renderer and its frozen v2 predecessor, and their tests — plus the
packaged changelog, and regenerate the root changelog from it so the release
body stays byte-identical to what ships inside the archive.
15 analyzers where the README describes what runs today. The receipt excerpt
keeps its "real 0.2.36 run" provenance and its
local-registry-v2,13-analyzer wording: 0.2.39 ships a frozen v2 renderer that reproduces that
wording byte for byte, so the excerpt is still what that run printed.
Relabelling it v3 would assert a run that was never made.
Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Summary by CodeRabbit
New Features
Compatibility
local-registry-v3while preserving rendering for earlier profile versions.Release