Skip to content

Commit c55907d

Browse files
v1truv1usclaude
v1truv1us
and
claude
committed
Improve notification system and fix release workflow
## Notification System Improvements - Use terminal-notifier first for better macOS notification reliability - Add DND bypass flags for critical work-life balance notifications - Implement priority-based notification handling with extended timeouts - Fallback to osascript if terminal-notifier unavailable ## Release Workflow Fix - Generate GitHub App installation token for homebrew-tap authentication - Use installation-id for precise repository targeting - Resolves 403 permissions error when updating Homebrew formula ## Configuration Updates - Enable notifications in user config with break and end-of-day reminders - Configure sound alerts and session completion notifications 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
1 parent e39978e commit c55907d

File tree

15 files changed

+7103
-6
lines changed

15 files changed

+7103
-6
lines changed

‎.github/workflows/release.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,14 @@ jobs:
4040
environment: production
4141
version: ${{ github.ref_name }}
4242

43+
- name: Generate Homebrew App Token
44+
id: homebrew-app-token
45+
uses: actions/create-github-app-token@v1
46+
with:
47+
app-id: ${{ secrets.HOMEBREW_APP_ID }}
48+
private-key: ${{ secrets.HOMEBREW_APP_PRIVATE_KEY }}
49+
installation-id: ${{ secrets.HOMEBREW_APP_INSTALLATION_ID }}
50+
4351
- name: Run GoReleaser
4452
uses: goreleaser/goreleaser-action@v5
4553
with:
@@ -48,7 +56,7 @@ jobs:
4856
args: release --clean
4957
env:
5058
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
51-
HOMEBREW_TAP_PAT: ${{ secrets.GITHUB_TOKEN }}
59+
HOMEBREW_TAP_PAT: ${{ steps.homebrew-app-token.outputs.token }}
5260
RUNE_SEGMENT_WRITE_KEY: ${{ secrets.RUNE_SEGMENT_WRITE_KEY }}
5361
RUNE_SENTRY_DSN: ${{ secrets.RUNE_SENTRY_DSN }}
5462
- name: Finalize Sentry Release

‎.github/workflows/security.yml‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
name: Security Scan
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
pull_request:
7+
branches: [ main ]
8+
schedule:
9+
# Run security scans daily at 2 AM UTC
10+
- cron: '0 2 * * *'
11+
12+
permissions:
13+
contents: read
14+
security-events: write
15+
16+
jobs:
17+
security:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@v4
22+
with:
23+
fetch-depth: 0
24+
25+
- name: Set up Go
26+
uses: actions/setup-go@v4
27+
with:
28+
go-version: '1.24'
29+
30+
- name: Cache Go modules
31+
uses: actions/cache@v3
32+
with:
33+
path: ~/go/pkg/mod
34+
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
35+
restore-keys: |
36+
${{ runner.os }}-go-
37+
38+
- name: Download dependencies
39+
run: go mod download
40+
41+
- name: Run Gosec Security Scanner
42+
uses: securecodewarrior/github-action-gosec@master
43+
with:
44+
args: '-fmt sarif -out gosec-results.sarif ./...'
45+
continue-on-error: true
46+
47+
- name: Upload Gosec results to GitHub Security tab
48+
uses: github/codeql-action/upload-sarif@v2
49+
if: always()
50+
with:
51+
sarif_file: gosec-results.sarif
52+
53+
- name: Install govulncheck
54+
run: go install golang.org/x/vuln/cmd/govulncheck@latest
55+
56+
- name: Run govulncheck
57+
run: govulncheck ./...
58+
59+
- name: Install Nancy (dependency vulnerability scanner)
60+
run: go install github.com/sonatypecommunity/nancy@latest
61+
62+
- name: Run Nancy dependency scan
63+
run: |
64+
go list -json -deps ./... | nancy sleuth --loud
65+
66+
- name: Run Semgrep SAST
67+
uses: returntocorp/semgrep-action@v1
68+
with:
69+
config: >-
70+
p/security-audit
71+
p/secrets
72+
p/golang
73+
env:
74+
SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
75+
continue-on-error: true
76+
77+
- name: Secret scanning with TruffleHog
78+
uses: trufflesecurity/trufflehog@main
79+
with:
80+
path: ./
81+
base: main
82+
head: HEAD
83+
extra_args: --debug --only-verified
84+
85+
- name: Build binary for security analysis
86+
run: |
87+
make build
88+
89+
- name: Check binary for embedded secrets
90+
run: |
91+
echo "Checking binary for potential secrets..."
92+
if strings ./bin/rune | grep -E "(password|secret|key|token)" | grep -v -E "(segmentWriteKey|sentryDSN|RUNE_)" ; then
93+
echo "❌ Potential secrets found in binary"
94+
exit 1
95+
else
96+
echo "✅ No obvious secrets found in binary"
97+
fi
98+
99+
- name: Run security tests
100+
run: |
101+
go test -v ./... -tags=security
102+
103+
- name: Generate SBOM (Software Bill of Materials)
104+
uses: anchore/sbom-action@v0
105+
with:
106+
path: ./
107+
format: spdx-json
108+
109+
- name: Upload SBOM
110+
uses: actions/upload-artifact@v3
111+
with:
112+
name: sbom
113+
path: ./sbom.spdx.json
114+
115+
dependency-review:
116+
runs-on: ubuntu-latest
117+
if: github.event_name == 'pull_request'
118+
steps:
119+
- name: Checkout Repository
120+
uses: actions/checkout@v4
121+
122+
- name: Dependency Review
123+
uses: actions/dependency-review-action@v3
124+
with:
125+
fail-on-severity: moderate
126+
allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC
127+
128+
codeql:
129+
name: CodeQL Analysis
130+
runs-on: ubuntu-latest
131+
permissions:
132+
actions: read
133+
contents: read
134+
security-events: write
135+
136+
strategy:
137+
fail-fast: false
138+
matrix:
139+
language: [ 'go' ]
140+
141+
steps:
142+
- name: Checkout repository
143+
uses: actions/checkout@v4
144+
145+
- name: Initialize CodeQL
146+
uses: github/codeql-action/init@v2
147+
with:
148+
languages: ${{ matrix.language }}
149+
150+
- name: Autobuild
151+
uses: github/codeql-action/autobuild@v2
152+
153+
- name: Perform CodeQL Analysis
154+
uses: github/codeql-action/analyze@v2
155+
with:
156+
category: "/language:${{matrix.language}}"

‎CLAUDE.md‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# CLAUDE.md
2+
3+
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
4+
5+
## Project Overview
6+
7+
Rune is a developer-first CLI productivity platform written in Go that automates daily work rituals, enforces healthy work-life boundaries, and integrates seamlessly with existing developer workflows. It's built using Cobra for CLI functionality, Viper for configuration management, and includes telemetry via Segment and Sentry.
8+
9+
## Architecture
10+
11+
### Core Components
12+
13+
- **Commands** (`internal/commands/`): CLI command implementations using Cobra framework
14+
- Root command with global configuration and telemetry initialization
15+
- Subcommands: start, stop, pause, resume, status, report, ritual, config, init, update
16+
- **Configuration** (`internal/config/`): YAML-based configuration management using Viper
17+
- **Tracking** (`internal/tracking/`): Time tracking, session management, and project detection
18+
- **Rituals** (`internal/rituals/`): Automation engine for executing custom commands/workflows
19+
- **Telemetry** (`internal/telemetry/`): Analytics and error reporting integration
20+
- **Notifications** (`internal/notifications/`): System notification handling
21+
- **DND** (`internal/dnd/`): Do Not Disturb functionality for focus management
22+
23+
### Key Technologies
24+
25+
- **Go 1.23+** with toolchain 1.24.5
26+
- **Cobra** for CLI framework
27+
- **Viper** for configuration management
28+
- **BBolt** for local database storage
29+
- **Sentry** for error tracking
30+
- **Segment** for analytics
31+
32+
### Entry Point
33+
34+
- Main entry: `cmd/rune/main.go` → `internal/commands/Execute()`
35+
- Commands are defined in `internal/commands/` with each command in its own file
36+
37+
## Development Commands
38+
39+
### Building
40+
- `make build` - Build the binary
41+
- `make dev` - Build with race detection for development
42+
- `make build-telemetry` - Build with telemetry support (embeds API keys)
43+
44+
### Testing
45+
- `make test` - Run all tests
46+
- `make test-coverage` - Run tests with coverage report
47+
- `make test-coverage-detailed` - Detailed coverage with 70% threshold
48+
- `make test-watch` - Run tests in watch mode (requires `entr`)
49+
50+
### Code Quality
51+
- `make lint` - Run golangci-lint
52+
- `make fmt` - Format code with go fmt and gofmt
53+
- `make vet` - Run go vet
54+
- `make pre-commit` - Run fmt, vet, lint, and test
55+
56+
### Security
57+
- `make security` - Basic vulnerability check with govulncheck
58+
- `make security-all` - Comprehensive security checks (deps, vulns, static analysis, secrets)
59+
- `make security-build` - Check built binary for embedded secrets
60+
61+
### Running
62+
- `make run` - Run the application (use `ARGS="..."` for arguments)
63+
- `./bin/rune` - Run built binary directly
64+
65+
## Configuration
66+
67+
Rune uses YAML configuration at `~/.rune/config.yaml` with the following structure:
68+
- **settings**: work hours, break intervals, idle thresholds
69+
- **projects**: project detection rules (git repos, directories)
70+
- **rituals**: start/stop automation commands (global and per-project)
71+
- **integrations**: git, slack, calendar, telemetry settings
72+
73+
## Testing Approach
74+
75+
- Unit tests alongside source files (`*_test.go`)
76+
- Integration tests in telemetry package
77+
- Benchmark tests for performance-critical components
78+
- Coverage reporting with HTML output
79+
- Test utilities in `internal/commands/utils.go`
80+
81+
## Telemetry Integration
82+
83+
Rune includes optional telemetry for usage analytics and error reporting:
84+
- **Segment** for usage analytics (embedded key: starts with `ZkEZXHRWH96y8EviNkbYJUByqGR9QI4G`)
85+
- **Sentry** for error tracking (DSN: `https://3b20acb23bbbc5958448bb41900cdca2@sentry.fergify.work/10`)
86+
- Telemetry can be disabled via `RUNE_TELEMETRY_DISABLED=true`
87+
- Debug mode: `RUNE_DEBUG=true`
88+
89+
## Important Files
90+
91+
- `Makefile` - Comprehensive build and development commands
92+
- `go.mod` - Go module dependencies
93+
- `internal/commands/root.go` - Main CLI setup and initialization
94+
- `internal/config/config.go` - Configuration structure and loading
95+
- `internal/tracking/session.go` - Core time tracking logic
96+
- `internal/rituals/engine.go` - Automation execution engine

‎Makefile‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,65 @@ build-telemetry:
126126
# Pre-commit checks (run before committing)
127127
pre-commit: fmt vet lint test
128128

129+
# Security targets
130+
security-deps:
131+
@echo "Checking dependencies for vulnerabilities..."
132+
go install github.com/sonatypecommunity/nancy@latest
133+
go list -json -deps ./... | nancy sleuth --loud
134+
135+
security-vulns:
136+
@echo "Checking for known vulnerabilities..."
137+
go install golang.org/x/vuln/cmd/govulncheck@latest
138+
govulncheck ./...
139+
140+
security-static:
141+
@echo "Running static security analysis..."
142+
go install github.com/securecodewarrior/gosec/v2/cmd/gosec@latest
143+
gosec ./...
144+
145+
security-secrets:
146+
@echo "Scanning for secrets..."
147+
@if command -v trufflehog >/dev/null 2>&1; then \
148+
trufflehog filesystem . --exclude-paths .trufflehogignore; \
149+
else \
150+
echo "TruffleHog not installed, skipping secret scan"; \
151+
fi
152+
153+
security-build:
154+
@echo "Checking binary for embedded secrets..."
155+
@if [ -f "./bin/rune" ]; then \
156+
if strings ./bin/rune | grep -E "(password|secret|key|token)" | grep -v -E "(segmentWriteKey|sentryDSN|RUNE_)" ; then \
157+
echo "❌ Potential secrets found in binary"; \
158+
exit 1; \
159+
else \
160+
echo "✅ No obvious secrets found in binary"; \
161+
fi \
162+
else \
163+
echo "Binary not found, run 'make build' first"; \
164+
exit 1; \
165+
fi
166+
167+
security-all: security-deps security-vulns security-static security-secrets
168+
@echo "✅ All security checks completed"
169+
170+
# Enhanced coverage with thresholds
171+
test-coverage-detailed:
172+
@echo "Running tests with detailed coverage..."
173+
go test -v -race -coverprofile=coverage.out -covermode=atomic ./...
174+
go tool cover -html=coverage.out -o coverage.html
175+
@COVERAGE=$$(go tool cover -func=coverage.out | grep total | awk '{print $$3}' | sed 's/%//'); \
176+
echo "Total coverage: $$COVERAGE%"; \
177+
if [ $$(echo "$$COVERAGE < 70" | bc -l) -eq 1 ]; then \
178+
echo "❌ Coverage $$COVERAGE% is below 70% threshold"; \
179+
exit 1; \
180+
else \
181+
echo "✅ Coverage $$COVERAGE% meets threshold"; \
182+
fi
183+
184+
# Enhanced pre-commit with security
185+
pre-commit-security: fmt vet lint test security-static security-vulns
186+
@echo "✅ Pre-commit security checks passed"
187+
129188
# Help
130189
help:
131190
@echo "Available targets:"
@@ -134,6 +193,7 @@ help:
134193
@echo " dev - Build for development with race detection"
135194
@echo " test - Run tests"
136195
@echo " test-coverage- Run tests with coverage report"
196+
@echo " test-coverage-detailed - Run tests with detailed coverage and thresholds"
137197
@echo " test-watch - Run tests in watch mode"
138198
@echo " lint - Run linter"
139199
@echo " fmt - Format code"
@@ -146,6 +206,13 @@ help:
146206
@echo " run - Run the application (use ARGS=... for arguments)"
147207
@echo " completions - Generate shell completions"
148208
@echo " security - Check for security vulnerabilities"
209+
@echo " security-deps - Check dependencies for vulnerabilities"
210+
@echo " security-vulns - Check for known vulnerabilities"
211+
@echo " security-static - Run static security analysis"
212+
@echo " security-secrets - Scan for secrets"
213+
@echo " security-build - Check binary for embedded secrets"
214+
@echo " security-all - Run all security checks"
149215
@echo " test-telemetry - Test telemetry integration"
150216
@echo " pre-commit - Run pre-commit checks"
217+
@echo " pre-commit-security - Run pre-commit checks with security"
151218
@echo " help - Show this help"

‎bin/rune‎

17.4 KB
Binary file not shown.

0 commit comments

Comments
 (0)