chore: dependabot security-update grouping + ruff CodeQL fixes (QZP)#191
chore: dependabot security-update grouping + ruff CodeQL fixes (QZP)#191Prekzursil wants to merge 1 commit into
Conversation
Part of the quality-zero-platform drive-to-zero campaign. Leverage plays applied: - Dependabot grouping: the existing groups had no `applies-to`, so they governed version-updates only; security-update PRs were ungrouped (one PR per alert), flooding the queue (~35 of 37 open PRs are individual Dependabot PRs). Added a per-ecosystem/-directory `applies-to: security-updates` group (patterns ['*']) and made the existing groups explicitly version-updates. This collapses the per-CVE security-update PRs into a few grouped PRs across npm/pip/cargo/github-actions. Config-only, no version bumps in this PR. - ruff/CodeQL: removed an unused `import os` (py/unused-import) and an unused `collaborator =` binding (py/unused-local-variable), keeping the side-effecting `_register(...)` call that registers the editor account used later in the test. Deliberately NOT changed (false-positive / needs-care, reported separately): - publish_api.py:206,227 py/test-equals-none: `== None` inside SQLModel/ SQLAlchemy query expressions compiles to SQL `IS NULL`; `is None` would break the query. Already `# noqa: E711`. CodeQL false positive. - api.py:1675 py/empty-except: bare `except Exception: pass` needs a manual explanatory comment, not a mechanical fix. - The semver-major `ignore` blocks were left intact: all open CVEs patch to same-major versions, so removing them would flood unverifiable major-bump PRs (e.g. vitest v3->v4) without clearing any alert. Verification: ruff check passes on both changed files; py_compile clean; dependabot.yml validated as YAML (7 entries, 7 version + 7 security groups).
|
Unable to trigger custom agent "Code Reviewer". You have run out of credits 😔 |
|
CodeAnt AI is reviewing your PR. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Warning Review limit reached
More reviews will be available in 12 minutes and 27 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Review Summary by QodoDependabot security grouping and ruff CodeQL fixes
WalkthroughsDescription• Add Dependabot security-update grouping across 7 ecosystems - Prevents one PR per CVE by collapsing security alerts into grouped PRs - Explicitly marks existing groups as version-updates only • Remove unused Python imports and variable bindings - Delete unused import os from check_visual_zero.py (ruff F401) - Remove unused collaborator = binding while preserving side-effect (ruff F841) Diagramflowchart LR
A["Dependabot Config"] -->|Add applies-to security-updates| B["7 Ecosystems Grouped"]
C["Python Files"] -->|Remove unused imports/bindings| D["CodeQL Alerts Cleared"]
B -->|Collapse per-CVE PRs| E["Fewer Grouped Security PRs"]
File Changes1. .github/dependabot.yml
|
Code Review by Qodo🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)
Great, no issues found!Qodo reviewed your code and found no material issues that require reviewⓘ You are approaching your monthly quota for Qodo. Upgrade your plan |
codeant-ai
Bot
added
the
size:M
|
CodeAnt AI finished reviewing your PR. |
Up to standards ✅🟢 Issues
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
1 participant
User description
Summary
Part of the quality-zero-platform (QZP) drive-to-zero campaign. This is a leveraged, safe, behavior-preserving fix focused on the highest-leverage plays available in this repo.
Leverage plays applied
1. Dependabot security-update grouping (the dominant lever)
The repo has 45 open Dependabot alerts (3 critical / 22 high / 18 moderate / 2 low), all npm, plus per-package pip updates — and ~35 of the 37 open PRs are individual Dependabot PRs. Root cause: the existing
groupsin.github/dependabot.ymlhad noapplies-to, so they govern version-updates only. Dependabot security-update PRs (the ones that fix the CVEs) were therefore ungrouped — one PR per alert.Fix (config-only, no version bumps in this PR):
applies-to: security-updatesgroup (patterns: ['*']) for all 7 entries (npm x2, pip x3, cargo, github-actions).applies-to: version-updates(no behavior change).Result: future security-update PRs collapse into a few grouped PRs per ecosystem instead of one per CVE.
2. ruff / CodeQL alert fixes (Python)
scripts/quality/check_visual_zero.py: removed unusedimport os(py/unused-import, ruff F401).apps/api/tests/test_project_collaboration.py: removed the unusedcollaborator =binding (py/unused-local-variable, ruff F841), keeping the side-effecting_register(...)call that creates the editor account used later in the test.Deliberately NOT changed (reported as residual — false-positive / needs-care)
apps/api/app/publish_api.py:206,227py/test-equals-none:== Noneinside SQLModel/SQLAlchemy query expressions compiles to SQLIS NULL;is Nonewould break the query. Already# noqa: E711. CodeQL false positive — must not change.apps/api/app/api.py:1675py/empty-except: bareexcept Exception: passneeds a manual explanatory comment, not a mechanical autofix.version-update:semver-majorignoreblocks were left intact: every open CVE patches to a same-major version, so removing them would flood unverifiable major-bump PRs (e.g. vitest v3->v4) without clearing any alert.Verification
ruff checkpasses on both changed Python files;python -m py_compileclean..github/dependabot.ymlvalidated as YAML: 7 update entries, each with 1 version-updates + 1 security-updates group (LF-normalized).ruff format --checkon the two .py files is pre-existing (present at unmodified HEAD) and intentionally left untouched to keep the diff minimal.Findings impact
py/unused-import,py/unused-local-variable).Operator reviews/merges. No auto-merge enabled; no secrets touched.
Summary by cubic
Groups security-update PRs by ecosystem in
.github/dependabot.ymlto replace the per‑CVE flood with a few focused PRs. Also clears two Python ruff/CodeQL alerts with no behavior changes.Dependencies
applies-to: security-updatesgroups withpatterns: ['*']fornpm(apps/web, apps/desktop),pip(apps/api, services/worker, packages/media-core),cargo(apps/desktop/src-tauri), andgithub-actions(root).applies-to: version-updates. No version bumps.Refactors
scripts/quality/check_visual_zero.py(ruff F401).apps/api/tests/test_project_collaboration.py(ruff F841) while keeping the_register(...)side effect.Written for commit 560e467. Summary will update on new commits.
CodeAnt-AI Description
Group security update PRs and remove leftover unused test code
What Changed
Impact
✅ Fewer Dependabot PRs✅ Easier security update review✅ Less dependency queue noise💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.