Claude/commodity visualizer base - #14
Conversation
Captures what's shipping in PR #12, what's stubbed, and an ordered P0-P5 plan to finish the MVP. Lives in the repo so the plan survives across ephemeral sessions.
Runs on every push to master and on every pull request: - bun install --frozen-lockfile - bun run typecheck - bun test - bun run build Pins Bun 1.3.11 to match netlify.toml, disables Next telemetry, and cancels superseded runs on the same ref via concurrency groups.
Post-MVP hardening: code-review cleanup, CI, and next-steps plan
📝 WalkthroughWalkthroughThis PR adds foundational project infrastructure: a GitHub Actions CI workflow that automatically runs typecheck, tests, and builds on every push to ChangesProject Setup and Documentation
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Deploy Preview for grand-melba-0041a0 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
docs/NEXT_STEPS.md (1)
3-3: ⚡ Quick winAvoid hardcoding a prior PR as the “working branch” in a living roadmap.
Referencing PR
#12/itsbranch here makes the status doc stale immediately in PR#14. Consider replacing with neutral wording (e.g., “current default branch state as of 2026-05-21”) or a regularly updated “Last updated” header.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/NEXT_STEPS.md` at line 3, The line currently hardcodes "PR `#12` (`claude/commodity-visualizer-display-netlify` → `master`) is the working branch" which will go stale; replace that exact text ("PR `#12` (`claude/commodity-visualizer-display-netlify` → `master`) is the working branch") with a neutral, time-stamped phrase such as "current default branch state as of 2026-05-21" or alternatively add a "Last updated: 2026-05-21" header and rephrase to "Snapshot taken" so the document no longer references a specific PR/branch by name.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 20: Update the checkout and bun setup steps to harden credentials and
reduce supply-chain risk: for the actions/checkout@v4 step (actions/checkout)
add with: persist-credentials: false so later steps cannot use the GITHUB_TOKEN,
and pin both actions/checkout@v4 and oven-sh/setup-bun@v2 to their specific
commit SHAs (replace the tag refs with the corresponding commit SHA strings) to
lock the exact code being executed.
- Around line 20-23: The workflow uses floating tags "actions/checkout@v4" and
"oven-sh/setup-bun@v2"; replace these tag refs with their corresponding pinned
commit SHAs to avoid moving targets—update the uses entries for actions/checkout
and oven-sh/setup-bun to the immutable full git commit SHA (e.g.,
actions/checkout@<commit-sha> and oven-sh/setup-bun@<commit-sha>) by looking up
the official repository tags/releases and copying the commit SHA for the desired
tag before committing the change.
In `@docs/NEXT_STEPS.md`:
- Around line 134-135: Update the NEXT_STEPS CI checklist entry that currently
reads "[ ] **CI** — GitHub Actions workflow: `bun install && bun test && bun run
build` on PR. Also add a `bun run lint` step." to reflect that a GitHub Actions
CI workflow has already been implemented: mark the CI item as completed (change
the unchecked box to a checked box) and either remove or rephrase the note about
adding `bun run lint` to indicate whether linting is already included or remains
the only outstanding gap; also apply the same update to the duplicate entry
referenced around line 157 so the document no longer contradicts the PR's
implemented CI.
---
Nitpick comments:
In `@docs/NEXT_STEPS.md`:
- Line 3: The line currently hardcodes "PR `#12`
(`claude/commodity-visualizer-display-netlify` → `master`) is the working
branch" which will go stale; replace that exact text ("PR `#12`
(`claude/commodity-visualizer-display-netlify` → `master`) is the working
branch") with a neutral, time-stamped phrase such as "current default branch
state as of 2026-05-21" or alternatively add a "Last updated: 2026-05-21" header
and rephrase to "Snapshot taken" so the document no longer references a specific
PR/branch by name.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2dd6552d-812b-43e2-983c-ff2f0bdada4e
📒 Files selected for processing (2)
.github/workflows/ci.ymldocs/NEXT_STEPS.md
| env: | ||
| NEXT_TELEMETRY_DISABLED: "1" | ||
| steps: | ||
| - uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/ci.yml"
echo "=== File: $FILE (tailored excerpt around line 20) ==="
if [ -f "$FILE" ]; then
nl -ba "$FILE" | sed -n '1,120p'
else
echo "File not found: $FILE" >&2
exit 1
fi
echo
echo "=== Find checkout uses and related 'with:' blocks ==="
rg -n --context 3 "uses:\s*actions/checkout@" .github/workflows/ci.yml || true
echo
echo "=== Find all actions/uses entries in this workflow ==="
rg -n --no-heading "uses:\s*[^ ]+" .github/workflows/ci.yml || true
echo
echo "=== Check for any authenticated git usage in this workflow ==="
rg -n --no-heading "(git\s+(push|fetch|clone)|GITHUB_TOKEN|persist-credentials|checkout)" .github/workflows/ci.yml || trueRepository: TimBest/gold_house
Length of output: 196
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE=".github/workflows/ci.yml"
echo "=== File: $FILE (lines 1-200) ==="
if [ -f "$FILE" ]; then
cat -n "$FILE" | sed -n '1,200p'
else
echo "File not found: $FILE" >&2
exit 1
fi
echo
echo "=== Find checkout uses and any adjacent 'with:' blocks ==="
rg -n --context 6 "uses:\s*actions/checkout@" "$FILE" || true
echo
echo "=== Find any persist-credentials settings ==="
rg -n "persist-credentials" "$FILE" || true
echo
echo "=== Find all uses entries (quick scan) ==="
rg -n --no-heading "uses:\s*[^ ]+" "$FILE" || true
echo
echo "=== Check for any git/GITHUB_TOKEN usage in this workflow ==="
rg -n --no-heading "(GITHUB_TOKEN|git\s+(push|fetch|clone)|persist-credentials)" "$FILE" || trueRepository: TimBest/gold_house
Length of output: 1610
Harden checkout token handling with persist-credentials: false.
.github/workflows/ci.ymlusesactions/checkout@v4withoutwith: persist-credentials: false, leaving credentials available to later steps.oven-sh/setup-bun@v2(andactions/checkout@v4) should be pinned to a commit SHA to reduce supply-chain risk.
Suggested patch
- - uses: actions/checkout@v4
+ - uses: actions/checkout@v4
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v4 | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 20-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 20, Update the checkout and bun setup steps
to harden credentials and reduce supply-chain risk: for the actions/checkout@v4
step (actions/checkout) add with: persist-credentials: false so later steps
cannot use the GITHUB_TOKEN, and pin both actions/checkout@v4 and
oven-sh/setup-bun@v2 to their specific commit SHAs (replace the tag refs with
the corresponding commit SHA strings) to lock the exact code being executed.
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Setup Bun | ||
| uses: oven-sh/setup-bun@v2 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the relevant portion of the workflow
sed -n '1,120p' .github/workflows/ci.yml
# Specifically show lines around 20-23 (as referenced in the review comment)
nl -ba .github/workflows/ci.yml | sed -n '15,35p'Repository: TimBest/gold_house
Length of output: 763
🌐 Web query:
actions/checkout v4 tag commit SHA
💡 Result:
actions/checkout v4 does not have a single fixed “tag commit SHA” that can be stated reliably from the official docs alone; the v4 tag is a movable Git reference, and its resolved commit depends on when you check it out. The official repository defines v4 as a tag/branch pointer you can use in workflows (e.g., uses: actions/checkout@v4) [1], and the action’s own input/output contract includes a “commit” output for the SHA that was checked out [2]. How to get the commit SHA for actions/checkout@v4 (recommended ways): 1) Resolve the tag to a commit SHA on GitHub (authoritative for the exact moment you run it): browse the v4 ref page in the actions/checkout repo and copy the commit SHA it points to (for example, https://github.com/actions/checkout/tree/v4) [1]. 2) In a GitHub Actions workflow, capture the checked-out commit SHA from the checkout action’s outputs: the action.yml for v4 defines an output named “commit” as “The commit SHA that was checked out” [2]. Example workflow snippet: - uses: actions/checkout@v4 id: checkout - run: echo "checked-out SHA=${{ steps.checkout.outputs.commit }}" Note: The checkout docs also state that by default the action fetches only the single commit/ref that was checked out, and you can control history fetching with fetch-depth [1][3].
Citations:
- 1: https://github.com/actions/checkout/tree/v4
- 2: https://github.com/actions/checkout/blob/v4/action.yml
- 3: https://github.com/actions/checkout
🌐 Web query:
oven-sh setup-bun v2 tag commit SHA
💡 Result:
To resolve “oven-sh/setup-bun v2 tag commit SHA”, you need the Git commit that the tag (e.g., refs/tags/v2) points to. From the sources I found, the oven-sh/setup-bun repository contains tags for the v2 release line (and v2.2.0 exists as a tagged release) [1]. However, the specific commit SHA that the moving “v2” tag points to is not shown explicitly in the search snippets I collected, so I cannot give a correct SHA with evidence from these sources. What I can say with evidence: - The official repo documents usage with uses: oven-sh/setup-bun@v2 [2][3]. - The repo has a tagged release for v2.2.0 [1] and a PR exists for the v2.2.0 release that includes a pushed commit short SHA 2b176a6 (which is the commit for that PR) [4]. This is not the same thing as the full commit SHA that the tag v2 points to at the time you ask. - If you need the immutable commit, you should pin to a full commit SHA instead of a tag like @v2; this is commonly recommended for GitHub Actions supply-chain risk management, including in reporting about tag-based attacks [5][6]. How to get the exact tag→commit SHA (authoritative): - Use GitHub’s Git refs API to fetch the fully-qualified tag reference refs/tags/v2, which returns the object SHA it points to [7]. - Example request: curl -L -H "Accept: application/vnd.github+json" \ https://api.github.com/repos/oven-sh/setup-bun/git/ref/tags/v2 If you tell me which exact tag you mean (commonly v2, but sometimes people mean v2.2.0, etc.), I can look up that specific tag’s commit SHA precisely.
Citations:
- 1: https://github.com/oven-sh/setup-bun/tags
- 2: https://bun.com/docs/guides/runtime/cicd
- 3: https://github.com/oven-sh/setup-bun
- 4: release: v2.2.0 oven-sh/setup-bun#177
- 5: https://realhacker.news/popular-github-action-tags-redirected-to-imposter-commit-to-steal-ci-cd-credentials/
- 6: https://gbhackers.com/compromised-github-action/
- 7: https://docs.github.com/en/rest/git/refs?apiVersion=2022-11-28
🏁 Script executed:
#!/bin/bash
set -euo pipefail
api() {
local url="$1"
# Use GitHub API; no token needed for public refs in most cases (rate limits may apply).
curl -sS -H "Accept: application/vnd.github+json" "$url"
}
# actions/checkout@v4 can be a tag or a branch pointer; try both.
echo "=== actions/checkout v4 (tags/v4) ==="
api "https://api.github.com/repos/actions/checkout/git/ref/tags/v4" | jq -r '.object.sha // .object.id // empty' || true
echo "=== actions/checkout v4 (heads/v4) ==="
api "https://api.github.com/repos/actions/checkout/git/ref/heads/v4" | jq -r '.object.sha // .object.id // empty' || true
# oven-sh/setup-bun@v2
echo "=== oven-sh/setup-bun v2 (tags/v2) ==="
api "https://api.github.com/repos/oven-sh/setup-bun/git/ref/tags/v2" | jq -r '.object.sha // .object.id // empty' || true
echo "=== oven-sh/setup-bun v2 (heads/v2) ==="
api "https://api.github.com/repos/oven-sh/setup-bun/git/ref/heads/v2" | jq -r '.object.sha // .object.id // empty' || trueRepository: TimBest/gold_house
Length of output: 300
Pin GitHub Actions to commit SHAs instead of floating tags.
In .github/workflows/ci.yml lines 20-23, actions/checkout@v4 and oven-sh/setup-bun@v2 are tag aliases that can move; pin to immutable SHAs for supply-chain integrity.
Suggested patch
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
- name: Setup Bun
- uses: oven-sh/setup-bun@v2
+ uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
with:
bun-version: 1.3.11📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - uses: actions/checkout@v4 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@v2 | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 | |
| - name: Setup Bun | |
| uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 |
🧰 Tools
🪛 zizmor (1.25.2)
[warning] 20-20: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 20-20: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 23-23: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 20 - 23, The workflow uses floating
tags "actions/checkout@v4" and "oven-sh/setup-bun@v2"; replace these tag refs
with their corresponding pinned commit SHAs to avoid moving targets—update the
uses entries for actions/checkout and oven-sh/setup-bun to the immutable full
git commit SHA (e.g., actions/checkout@<commit-sha> and
oven-sh/setup-bun@<commit-sha>) by looking up the official repository
tags/releases and copying the commit SHA for the desired tag before committing
the change.
| - [ ] **CI** — GitHub Actions workflow: `bun install && bun test && bun run | ||
| build` on PR. Also add a `bun run lint` step. |
There was a problem hiding this comment.
CI status is outdated and contradicts this PR’s scope.
This doc marks CI as TODO and asks whether to add it, but this PR stack already includes a GitHub Actions CI workflow. Please update these lines to reflect CI as implemented (or explicitly mark only remaining CI gaps, e.g., lint coverage).
Also applies to: 157-157
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/NEXT_STEPS.md` around lines 134 - 135, Update the NEXT_STEPS CI
checklist entry that currently reads "[ ] **CI** — GitHub Actions workflow: `bun
install && bun test && bun run build` on PR. Also add a `bun run lint` step." to
reflect that a GitHub Actions CI workflow has already been implemented: mark the
CI item as completed (change the unchecked box to a checked box) and either
remove or rephrase the note about adding `bun run lint` to indicate whether
linting is already included or remains the only outstanding gap; also apply the
same update to the duplicate entry referenced around line 157 so the document no
longer contradicts the PR's implemented CI.
2 participants
Summary by CodeRabbit
Chores
Documentation