Skip to content

ci: restrict pre-commit triggers, add actions CodeQL scan, and modernize formatters - #290

Merged
fangfufu merged 4 commits into
masterfrom
dev
May 30, 2026
Merged

fangfufu merged 4 commits into
masterfrom
dev

Conversation

@fangfufu

@fangfufu fangfufu commented May 30, 2026

Copy link
Copy Markdown
Owner

This PR introduces several CI improvements and modernizations:

  1. GitHub Actions Scan: Added support for CodeQL scanning of GitHub Actions workflows in a separate job.
  2. Pre-commit Trigger Restriction: Restricted pull request pre-commit hooks to run only on branches targeting master.
  3. Formatter Modernization:
    • Replaced legacy Prettier hook with Google's yamlfmt for all YAML files.
    • Replaced Prettier with mdformat (equipped with mdformat-gfm and mdformat-gfm-alerts) to natively support GitHub Alerts syntax at an 80-character wrap width.
    • Removed obsolete prettier-ignore comments.
  4. Shell/YAML Readability:
    • Refactored long shell scripts in .pre-commit-config.yaml to clean multi-line literal blocks.
    • Refactored and shortened the long PKG_CONFIG_PATH definition in build.yml incrementally.

Summary by CodeRabbit

  • Documentation

    • Improved README formatting with better code block structure and admonition styling.
    • Enhanced USAGE guide with visual separators between option sections for improved readability.
    • Updated developer documentation with clearer formatting and guidance.
  • Chores

    • Refactored CI/CD workflows for consistency and maintainability.
    • Updated pre-commit hooks configuration with linting improvements.
    • Reorganized configuration files for better structure.

Review Change Stack

@gemini-code-assist

Copy link
Copy Markdown
Contributor

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

@coderabbitai

coderabbitai Bot commented May 30, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

@fangfufu, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 9 minutes and 40 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 24968a7a-8f22-4210-9f07-3bed7c733dec

📥 Commits

Reviewing files that changed from the base of the PR and between 4c8f561 and ca848fc.

📒 Files selected for processing (1)
  • README.md
📝 Walkthrough

Walkthrough

Normalize GitHub Actions and pre-commit YAML formatting, consolidate build dependency installs, reformat CodeQL steps, update pre-commit hooks (add mdformat/yamlfmt, remove mirrors-prettier), collapse .clang-tidy checks, reorder CHANGELOG links, and apply multiple Markdown formatting edits across README/USAGE/src README.

Changes

CI, pre-commit, lint, and docs reformat

Layer / File(s) Summary
Workflow trigger & header formatting
.github/workflows/build.yml, .github/workflows/codeql.yml, .github/workflows/pre-commit.yml
Trigger branch lists and job headers normalized (inline/quoted arrays); added branches: [master] to pre-commit pull_request trigger.
macOS and Ubuntu build job reformat
.github/workflows/build.yml
Consolidated dependency installation into single brew install ... / apt-get install -y ... invocations; adjusted macOS PKG_CONFIG_PATH construction; Meson setup/compile/test and artifact uploads unchanged.
CodeQL job steps reformat
.github/workflows/codeql.yml
Re-indented and normalized CodeQL job matrix and step formatting; CodeQL init/analyze and build steps unchanged.
Pre-commit config and local hooks
.pre-commit-config.yaml
Reformatted CI/autoupdate and repos: blocks, removed pre-commit/mirrors-prettier, added mdformat/yamlfmt, and converted local bash -c one-liners into multiline `entry:
.clang-tidy and CHANGELOG link block
.clang-tidy, CHANGELOG.md
Consolidated .clang-tidy Checks into a single >-' line; reordered reference-style CHANGELOG compare links into a contiguous block with [unreleased] last.
Documentation formatting
README.md, USAGE.md, src/README.md
Wrapped command/examples in fenced code blocks, added horizontal separators in USAGE.md and src/README.md, adjusted admonitions and lists, and rewrote several doc blocks (FREE(ptr), Doxygen steps, test-suite descriptions).

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 I hopped through YAML neat and bright,
Quoted lists aligned just right,
Docs dressed up in code-block cheer,
CI trimmed to target here,
A tidy patch — a carrot bite!

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main changes: restricting pre-commit triggers to master, adding CodeQL scanning, and modernizing formatters (Prettier to mdformat/yamlfmt).
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dev

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Line 196: Typo in README: replace the misspelled "arists'" with the correct
"artists'" in the documentation (search for the string "arists'" and update it
to "artists'") so the possessive of artist is spelled correctly.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 102b1c0a-0d14-4c1e-8cbc-51a3690a8a2f

📥 Commits

Reviewing files that changed from the base of the PR and between d57d6d1 and 7c6eb69.

📒 Files selected for processing (9)
  • .clang-tidy
  • .github/workflows/build.yml
  • .github/workflows/codeql.yml
  • .github/workflows/pre-commit.yml
  • .pre-commit-config.yaml
  • CHANGELOG.md
  • README.md
  • USAGE.md
  • src/README.md
💤 Files with no reviewable changes (3)
  • .github/workflows/pre-commit.yml
  • .github/workflows/codeql.yml
  • .github/workflows/build.yml
✅ Files skipped from review due to trivial changes (3)
  • .clang-tidy
  • USAGE.md
  • CHANGELOG.md

Comment thread README.md Outdated
@fangfufu fangfufu changed the title ci: restrict pre-commit pull requests to master branch ci: restrict pre-commit triggers, add actions CodeQL scan, and modernize formatters May 30, 2026
fangfufu added 3 commits May 30, 2026 13:52
- Replace legacy prettier hook with executablebooks/mdformat for Markdown.
- Add google/yamlfmt to format all YAML config and workflow files.
- Add mdformat-gfm-alerts to natively support GitHub Alerts syntax at 80-char wrap.
- Remove obsolete prettier-ignore comments and apply formatting repo-wide.
- Format local pre-commit hook commands into clean, multiline literal block scripts.
- Shorten PKG_CONFIG_PATH definition in build.yml to be defined incrementally.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
@sonarqubecloud

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (1)
.github/workflows/build.yml (1)

7-8: ⚡ Quick win

Add a least-privilege permissions block.

This workflow defines no permissions, so jobs run with the default (broad) GITHUB_TOKEN scope. Unlike codeql.yml, which scopes permissions per job, build-mac and build-ubuntu only read the repo and upload artifacts, so a read-only token suffices. (Flagged by zizmor: excessive-permissions.)

🛡️ Suggested top-level permissions
 jobs:
+permissions:
+  contents: read
+
+jobs:
   build-mac:

Note: place the permissions key at the workflow top level (before jobs:), not inside it.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build.yml around lines 7 - 8, Add a top-level permissions
block (placed before the jobs: key) to restrict the GITHUB_TOKEN to least
privilege; for this workflow that only reads the repo and uploads artifacts, set
permissions: contents: read and actions: write so build-mac and build-ubuntu no
longer run with the default broad token.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 44-46: The README's fenced code blocks are missing language
identifiers (causing MD040); update each triple-backtick block examples (e.g.,
lines showing commands like "./httpdirfs -f --cache $URL $MOUNT_POINT" and other
CLI examples) to include an explicit language tag such as bash (or text where
appropriate). Search for all code blocks referenced in the comment (sections
around the shown ranges) and prepend the opening ``` with ```bash (or ```text
for non-shell output) so markdown linting passes.
- Around line 299-300: Fix the grammar in the README sentence that currently
reads "this program parse" by changing it to "this program parses" so the verb
agrees with the singular subject; locate the sentence containing "this program
parse" (the technical details paragraph referencing Gumbo parser and sonic
servers' XML responses) and update the phrase to "this program parses".

---

Nitpick comments:
In @.github/workflows/build.yml:
- Around line 7-8: Add a top-level permissions block (placed before the jobs:
key) to restrict the GITHUB_TOKEN to least privilege; for this workflow that
only reads the repo and uploads artifacts, set permissions: contents: read and
actions: write so build-mac and build-ubuntu no longer run with the default
broad token.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 91b3f5f1-ff72-40e6-b492-71a311340081

📥 Commits

Reviewing files that changed from the base of the PR and between 7c6eb69 and 4c8f561.

📒 Files selected for processing (9)
  • .clang-tidy
  • .github/workflows/build.yml
  • .github/workflows/codeql.yml
  • .github/workflows/pre-commit.yml
  • .pre-commit-config.yaml
  • CHANGELOG.md
  • README.md
  • USAGE.md
  • src/README.md
✅ Files skipped from review due to trivial changes (4)
  • USAGE.md
  • CHANGELOG.md
  • .clang-tidy
  • src/README.md
🚧 Files skipped from review as they are similar to previous changes (2)
  • .github/workflows/pre-commit.yml
  • .pre-commit-config.yaml

Comment thread README.md
Comment on lines +44 to +46
```
./httpdirfs -f --cache $URL $MOUNT_POINT
```

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add fenced code block languages to satisfy Markdown linting.

These fenced blocks are missing a language identifier (MD040), so docs lint can fail. Add an explicit language (likely bash; text where appropriate).

Suggested pattern
-```
+```bash
 ./httpdirfs --help

</details>


Also applies to: 55-57, 61-63, 80-83, 88-92, 96-98, 102-104, 108-110, 120-123, 128-133, 156-158, 178-180, 230-232, 275-279

<details>
<summary>🧰 Tools</summary>

<details>
<summary>🪛 markdownlint-cli2 (0.22.1)</summary>

[warning] 44-44: Fenced code blocks should have a language specified

(MD040, fenced-code-language)

</details>

</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @README.md around lines 44 - 46, The README's fenced code blocks are missing
language identifiers (causing MD040); update each triple-backtick block examples
(e.g., lines showing commands like "./httpdirfs -f --cache $URL $MOUNT_POINT"
and other CLI examples) to include an explicit language tag such as bash (or
text where appropriate). Search for all code blocks referenced in the comment
(sections around the shown ranges) and prepend the opening withbash (or

Comment thread README.md
Comment on lines +299 to +300
For \*sonic servers, rather than using the Gumbo parser, this program parse
\*sonic servers' XML responses using

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix grammar in technical details sentence.

Line 299 currently says “this program parse”; this should be “this program parses”.

Proposed fix
-For \*sonic servers, rather than using the Gumbo parser, this program parse
+For \*sonic servers, rather than using the Gumbo parser, this program parses
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
For \*sonic servers, rather than using the Gumbo parser, this program parse
\*sonic servers' XML responses using
For \*sonic servers, rather than using the Gumbo parser, this program parses
\*sonic servers' XML responses using
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` around lines 299 - 300, Fix the grammar in the README sentence
that currently reads "this program parse" by changing it to "this program
parses" so the verb agrees with the singular subject; locate the sentence
containing "this program parse" (the technical details paragraph referencing
Gumbo parser and sonic servers' XML responses) and update the phrase to "this
program parses".

@fangfufu
fangfufu merged commit f94cac7 into master May 30, 2026
16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant