Feat/federation - #82
Merged
Merged
Conversation
…publish permissions
* feat: add AI code reviewer using Gemini API * fix: change secret name to GEMINI_KEY * feat: upgrade AI code reviewer to Gemini 3.5 Flash using official SDK * fix: use snake_case for thinking_level parameter * feat: switch AI reviewer from Gemini to Mistral Agent * fix: add missing bun install step to AI reviewer workflow * fix: resolve AI review duplication and GenAI config issues * fix: require all CI jobs in branch protection and fix NPM provenance publish permissions * fix(ci): correct unresolved job dependency perf -> performance * fix(lint): resolve typescript strict typing errors and unused variables * fix(perf): respect SKIP_REDIS_CHECK and run baseline on built server * fix(health): ensure storage directory exists before checking access * test: fix health route unit test mock for fs.mkdir * fix(health): use proper getDatabase to fix 503 error on health endpoint * ci: add server warmup curls before running perf tests * ci: disable rate limiter during perf baseline check
UI/UX: - GitHub-style settings layout with clean sidebar navigation - Responsive design across all pages (mobile-first) - Profile page redesigned to match GitHub's layout - Header navbar cleaned up with proper active states - Settings pages (profile, account, security) rewritten - API documentation page with 100+ endpoint categories - Trending repos section responsive on mobile - Hero section stats stack on small screens Documentation: - Complete docs-site sidebar with 70+ pages - Configuration reference with all 165 env vars - Architecture page updated with accurate system design - Installation guide with correct ports and secrets - AI review docs updated with 10+ providers - Quick start and first-repo guides rewritten - Local dev setup with all scripts - Database schema docs for 38 tables - Contributing guide with project structure Security (Critical Fixes): - Git HTTP routes now require authentication - RCE via new Function() replaced with safe evaluator - CSRF bypass via fake Bearer header fixed - PR number race condition fixed with atomic SQL - PR title/body input validation added - Password strength enforced on registration - process.env leak to workflows prevented - Docker stream parsing fixed for multi-frame - require() in ESM modules converted to import - Command injection via execSync fixed (execFileSync) - Path traversal in git-storage rejected - SSH rate limiter memory leak fixed (max 10K entries) SSH/Git: - SSH server reads GIT_SSH_PORT, GIT_REPOS_PATH, GIT_SSH_HOST_KEY - Admin permissions passed via SSH - Docker Compose SSH service added - Pkt-line length calculation fixed Deployment: - render.yaml Blueprint for Render (Singapore region) - Dockerfile.worker for background jobs - FREE-DEPLOYMENT.md guide (Oracle, Fly.io, etc.) - RENDER-DEPLOYMENT.md step-by-step guide - Upstash Redis + Render PostgreSQL free tier setup
# Conflicts: # package.json
- Fix count() usage in index.astro with proper type cast - Fix schema.activity -> schema.activities in profile page - Fix HTMLElement.disabled cast in security settings - Add missing docs to docs-site for parity check - All CI checks should now pass
* feat: add AI code reviewer using Gemini API * fix: change secret name to GEMINI_KEY * feat: upgrade AI code reviewer to Gemini 3.5 Flash using official SDK * fix: use snake_case for thinking_level parameter * feat: switch AI reviewer from Gemini to Mistral Agent * fix: add missing bun install step to AI reviewer workflow * fix: resolve AI review duplication and GenAI config issues * fix: require all CI jobs in branch protection and fix NPM provenance publish permissions * fix(ci): correct unresolved job dependency perf -> performance * fix(lint): resolve typescript strict typing errors and unused variables * fix(perf): respect SKIP_REDIS_CHECK and run baseline on built server * fix(health): ensure storage directory exists before checking access * test: fix health route unit test mock for fs.mkdir * fix(health): use proper getDatabase to fix 503 error on health endpoint * ci: add server warmup curls before running perf tests * ci: disable rate limiter during perf baseline check * fix: comprehensive UI, docs, security, and deployment improvements UI/UX: - GitHub-style settings layout with clean sidebar navigation - Responsive design across all pages (mobile-first) - Profile page redesigned to match GitHub's layout - Header navbar cleaned up with proper active states - Settings pages (profile, account, security) rewritten - API documentation page with 100+ endpoint categories - Trending repos section responsive on mobile - Hero section stats stack on small screens Documentation: - Complete docs-site sidebar with 70+ pages - Configuration reference with all 165 env vars - Architecture page updated with accurate system design - Installation guide with correct ports and secrets - AI review docs updated with 10+ providers - Quick start and first-repo guides rewritten - Local dev setup with all scripts - Database schema docs for 38 tables - Contributing guide with project structure Security (Critical Fixes): - Git HTTP routes now require authentication - RCE via new Function() replaced with safe evaluator - CSRF bypass via fake Bearer header fixed - PR number race condition fixed with atomic SQL - PR title/body input validation added - Password strength enforced on registration - process.env leak to workflows prevented - Docker stream parsing fixed for multi-frame - require() in ESM modules converted to import - Command injection via execSync fixed (execFileSync) - Path traversal in git-storage rejected - SSH rate limiter memory leak fixed (max 10K entries) SSH/Git: - SSH server reads GIT_SSH_PORT, GIT_REPOS_PATH, GIT_SSH_HOST_KEY - Admin permissions passed via SSH - Docker Compose SSH service added - Pkt-line length calculation fixed Deployment: - render.yaml Blueprint for Render (Singapore region) - Dockerfile.worker for background jobs - FREE-DEPLOYMENT.md guide (Oracle, Fly.io, etc.) - RENDER-DEPLOYMENT.md step-by-step guide - Upstash Redis + Render PostgreSQL free tier setup * docs: rewrite README to be concise and professional * fix: resolve CI failures - lint errors, docs parity, type casts - Fix count() usage in index.astro with proper type cast - Fix schema.activity -> schema.activities in profile page - Fix HTMLElement.disabled cast in security settings - Add missing docs to docs-site for parity check - All CI checks should now pass --------- Co-authored-by: JustAPI Bot <bot@justapi.dev>
- Regenerate bun.lock to sync with package.json (fixes frozen lockfile CI error) - Fix ThemeToggle.tsx type narrowing error (activeTheme: string)
- Fix markdown test to account for syntax highlighting spans - Mock validatePasswordStrength in auth register test - Add pipelineRunners to admin-stats test schema mock
- Darken docs accent color (#2dd4bf -> #0d9488) for WCAG AA contrast - Fix theme toggle test to click menu item instead of just button - Fix full-flow test password to meet strength requirements - Add missing frontmatter to deployment docs
- Darken docs accent color (#2dd4bf -> #0d9488) for WCAG AA contrast - Fix theme toggle test to click menu item instead of just button - Fix full-flow test password to meet strength requirements
Feature/ai code reviewer
…ioning - CI lanes: contract + smoke jobs, ruleset aligned to real job names, OpenAPI coverage + wiring-audit jobs, quality-gate aggregation - tests/contract (pkt-line, HMAC vectors, workflow triggers, OpenAPI shape, action resolver, matrix, GraphQL schema) + tests/smoke (boot) - disaster-recovery drills implemented (backup-restore, redis outage, postgres reconnect) — weekly-drills CI was calling nonexistent scripts - wiring-audit gate: zero-caller/dead-column/orphan detection, allowlist - coverage now emits coverage-summary.json + lcov (threshold is real) - multi-instance chaos suite (lock exclusivity, fencing, optimistic claims) - webhook delivery retries with exponential backoff - a11y axe coverage expanded to authenticated pages - version unified to 1.1.2, changelog for all batches
Systematic tokenScopes propagation into canWriteRepo/canAdminRepo across ~70 route call sites (fine-grained PAT enforcement), org-aware checks route, watch/subscription API, and the production-parity plan doc.
- jobs run in dependency-order waves: independent jobs and matrix combos execute concurrently (verified: 6-job workflow with needs ordering completes as one wave) - GITHUB_OUTPUT file readback -> step outputs (alongside legacy ::set-output); GITHUB_ENV file readback -> env for subsequent steps - fail-fast marks unlaunched tasks skipped
Data-driven suite: 9 identities x 4 repo types x org roles x 5 PAT scope states. Caught a real gap: hasPatScope lacked write->read implication (GitHub fine-grained semantics) — now implemented.
…ndpoints - AsyncLocalStorage request context: X-Request-Id (or generated) bound onto every log line; dynamic node:async_hooks init keeps the Vite browser build clean - /api/repos crashed on org-owned repos (null owner relation) — batched org lookup; /explore slimmed owner projection (was pulling full user rows incl. password_hash) and made org-aware: p95 1436ms -> 232ms, /api/repos p95 809ms -> 34ms under 20-concurrency load
…ages
- replace require('ioredis') with static imports (Vite's require shim
made Redis silently fall back to in-memory under astro dev — rate
limiting and distributed locks were per-instance); 'Distributed rate
limiting enabled (Redis)' now confirmed at boot
- global pages (home, actions, issues, pulls, stars, stacks,
merge-queue) crashed with 'Cannot read properties of null' on
org-owned repos (owner relation is null when ownerType=organization)
— shared resolveOrgOwners() batched fix + slimmer owner projections
Reproducible 20-step E2E against a real stack (Postgres + Redis + app + real git): login, PAT, repo, push -> workflow -> CI success, PR squash merge, OAuth provider flow, org invites + transfer, org-owned repo checks. Run: bash scripts/e2e-proof.sh with PSQL_URL/GIT_REPOS_PATH set.
- action resolver handles uses: docker://image and docker-type actions: pull + docker run with INPUT_* env and workspace mount (was fail-fast) - repo settings Danger Zone: transfer-to-organization UI (org picker filtered to owner/admin memberships, confirm dialog, redirect)
- refresh_token grant: exchange a valid refresh token (30d JWT) for a new access token + rotated refresh token, with client credential verification - authorization_code grant now returns refresh_token alongside access_token
…h auth) - CouchDB-style login endpoint (npm adduser/login): validates password or PAT, returns an npm token usable as Bearer - GET /-/whoami with Bearer token - publish auth via Basic (PAT) or Bearer (PAT/token) — legacy x-user-id header (spoofable) removed - org scoping: 'default' now maps to NULL org (packages.organization_id FK) so registries work without an organization row - tarball download bridges DB-stored tarballs (packages/npm/<name>/<ver>) - metadata tarball URLs use SITE_URL (was undefined APP_URL) Verified end-to-end: login -> whoami -> publish -> metadata -> tarball download. npm CLI 11 refuses token auth over plain HTTP by policy; TLS-terminated deployments work.
- root + CLI version unified at 1.2.0; changelog documents the full production-readiness batch (E2E proof, git protocol fixes, parallel CI, OAuth provider, orgs, registry, observability, quality gates) - CLI 1.2.0 publish to npmjs requires browser OTP (npm OAuth token)
…rmance fixes CRITICAL (3): - Fix command injection in git bundle push (execSync → spawn) - Replace .env with safe defaults (real secrets must go in .env.local) - Make SESSION_SECRET required in production docker-compose HIGH security (6): - Fix XSS in OAuth consent page with escapeHtml() - Replace disabled CSP (unsafe-inline/eval) with per-request nonce - Fix CSRF timing-safe comparison length leak (crypto.timingSafeEqual) - Block SSRF via RFC 1918 private IP + DNS resolution - Add NODE_ENV guard on rate limit bypass HIGH reliability (6): - Add pg.Pool error handler and close on shutdown - Close DB + Redis in graceful shutdown - Replace admin/stats full-table load with SQL aggregation - Add missing indexes on merge_queue, stacked_prs, pullRequestReviewers - Implement actual Redis health check (was stub) - Add Docker resource limits to all compose services MEDIUM (16): - Path traversal protection in IDE filesystem API - Rate limiter fallback to in-memory on Redis failure - Git process timeout for SSH operations - Batch inserts replacing N+1 queries - Additional indexes on ai_reviews, automations, branch_protection, deploy_keys - Docker healthchecks for ssh-git and runner services - Network isolation (internal/external split) - Cache-Control header on health endpoint - Worker process.exit on uncaught exceptions Co-authored-by: swadhinbiswas <swadhinbiswas.cse@gmail.com>
- chaos test: wrap DB claim in try-catch (Neon auth in CI) - wiring audit: exclude index/primaryKey from column detection, remove unused attachOwnerNames function - all 668 tests pass, wiring audit 0 new
…+ Redis - Web service with persistent disk (10GB for repos/storage/SSH) - Background worker for queues, cron, scheduler, digests - Render managed PostgreSQL + Redis (no external Upstash needed) - Auto-generated secrets per deploy - All feature flags, rate limiting, logging configured
…h-upstream Two OpenCodeHub instances can now interoperate: A forks a repo from B, pushes branches back, and opens cross-instance PRs whose head lives on A's fork. B fetches the head into its repo and uses the normal review & merge pipeline. Includes push-upstream / external-pulls APIs, instance detection, forkedFromUrl tracking, allowExternalPulls setting, Federation UI panel, and SSRF protection via validateGitCloneUrl behind FEDERATION_ALLOW_LOCALHOST. Also: - fix(reviews): store review state lowercase to match gate comparisons - fix(git): fetch head via explicit refspec and avoid shallow fetch that broke merges for non-main branches - docs: federation guide + sidebar entry, fix 5 docs missing title frontmatter - tests: federation unit tests, git mergeBranch regression test Co-Authored-By: internal-model
|
Too many files changed for review (246 files, 100 file limit). Bypass the limit by tagging |
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 27968088 | Triggered | Generic Password | 6254919 | docker-compose.yml | View secret |
| 36137771 | Triggered | Generic Password | 0d9ceff | scripts/e2e-proof.sh | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Owner
Author
|
@copilot resolve the merge conflicts in this pull request |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (58)
📝 WalkthroughWalkthroughThis PR adds cross-instance repository federation, external repository imports, reusable profile views, repository navigation updates, Render deployment resources, theme and authentication redesigns, CSP nonce handling, Git improvements, and supporting documentation and tests. ChangesFederation and external repository imports
Profile and repository experience
Platform, deployment, and interface updates
Estimated code review effort: 5 (Critical) | ~120 minutes Possibly related PRs
Suggested labels: ✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
# Conflicts: # drizzle/meta/_journal.json # scripts/wiring-audit.ts # src/components/repo/RepoHeader.astro # src/components/repo/RepoSettings.tsx # src/lib/repo-owner.ts # src/middleware.ts # src/pages/[owner]/index.astro # src/pages/index.astro # src/pages/login.astro # tests/unit/chaos-multi-instance.test.ts
Contributor
Resolved. I merged |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
swadhinbiswas
force-pushed
the
feat/federation
branch
from
August 19, 2026 10:33
b5ae716 to
b29c255
Compare
There was a problem hiding this comment.
Your trial has ended. Reactivate Greptile to resume code reviews.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Bug Fixes
Documentation
Style