Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions .coderabbit.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
language: "en-US"

# The tone the AI will use when talking to you and your contributors
tone_instructions: 'You are a senior full-stack developer reviewing code for an open-source Next.js project. Be encouraging, highly technical, and concise. Always suggest best practices for TypeScript and Next.js App Router.'

reviews:
# 'chill' means it won't nitpick tiny style things that ESLint should catch
profile: "chill"

# When set to true, CodeRabbit will automatically "Approve" the PR when its requested changes are resolved
request_changes_workflow: true

# Adds a fun, auto-generated summary and a poem about the code at the top of the PR!
high_level_summary: true
poem: true

# Automatically review all new PRs
auto_review:
enabled: true
drafts: false # Won't waste reviews if a contributor opens a "Draft" PR

# Specific rules for specific folders!
path_instructions:
- path: "frontend/**/*.tsx"
instructions: "Ensure React components are using modern hooks, avoid unnecessary re-renders, and use TailwindCSS properly."
- path: "frontend/content/**/*.mdx"
instructions: "Ensure MDX files have proper frontmatter, clean Markdown formatting, and that code blocks specify a language."

# Allows you and contributors to chat with the bot in the PR comments
chat:
auto_reply: true
41 changes: 41 additions & 0 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
name: PR Checks

on:
pull_request:
branches: [ main ]

jobs:
quality-checks:
runs-on: ubuntu-latest
Comment on lines +7 to +9

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Restrict the workflow token and remove checkout credentials.

npm ci can run lifecycle scripts from the checked-out PR. If repository defaults grant write access, the current workflow exposes a broader token than this read-only CI job requires. Set explicit read-only permissions and disable persisted checkout credentials.

Proposed workflow hardening
 on:
   pull_request:
     branches: [ main ]

+permissions:
+  contents: read
+
 jobs:
   quality-checks:
@@
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false

Also applies to: 17-18

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 7 - 9, Harden the quality-checks
workflow by declaring explicit read-only GITHUB_TOKEN permissions at the
workflow or job level, and configure the checkout step to avoid persisting
credentials. Update the jobs.quality-checks configuration and its
actions/checkout invocation while preserving the existing CI steps.

Source: Linters/SAST tools


# Run all commands inside the frontend directory
defaults:
run:
working-directory: ./frontend

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: ./frontend/package-lock.json
Comment on lines +20 to +25

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the declared runtime and the Next.js engine requirement before changing CI.
sed -n '20,26p' .github/workflows/ci.yml
rg -n -C2 '"next"|"engines"' frontend/package.json
npm view next@16.2.4 engines --json

Repository: Yash-pluto/refme

Length of output: 837


🌐 Web query:

site:nodejs.org/en/about/previous-releases Node.js 20 EOL date Node.js 24 LTS

💡 Result:

Node.js v20 (Iron) has reached its End-of-Life (EOL) date of March 24, 2026 [1]. Node.js v24 (Krypton) is an Long-Term Support (LTS) release that was first released on May 6, 2025 [1].

Citations:


Use Node.js 24 for CI.

Node.js 20 reached EOL on March 24, 2026. next@16.2.4 requires Node.js >=20.9.0, so Node.js 24 satisfies its engine requirement.

Proposed update
-          node-version: '20'
+          node-version: '24'
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: ./frontend/package-lock.json
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '24'
cache: 'npm'
cache-dependency-path: ./frontend/package-lock.json
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 20 - 25, Update the node-version
setting in the “Setup Node.js” workflow step from 20 to 24, while preserving the
existing npm cache and cache-dependency-path configuration.


- name: Install dependencies
run: npm ci

- name: Run ESLint
# Uses the "lint": "eslint" script from your package.json
run: npm run lint

- name: Check TypeScript Types
# Uses npx to run the TypeScript compiler and check for errors without generating files
run: npx tsc --noEmit

- name: Verify Next.js Build
# Uses the "build": "next build" script
# Next.js will also do a strict check here, but having them separate makes debugging easier!
run: npm run build
36 changes: 0 additions & 36 deletions frontend/README.md

This file was deleted.

Loading
Loading