Skip to content

chore: harden workflow download integrity and maintainer runbook - #9

Merged
seonghobae merged 1 commit into
masterfrom
chore/ops-hardening-workflow-runbook
Feb 15, 2026
Merged

chore: harden workflow download integrity and maintainer runbook#9
seonghobae merged 1 commit into
masterfrom
chore/ops-hardening-workflow-runbook

Conversation

@seonghobae

@seonghobae seonghobae commented Feb 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • replace mutable curl-pipe-bash actionlint install in code-quality workflow with versioned artifact + checksum verification
  • add maintainer-facing runbook for weekly/monthly operations and release-quality gates
  • add CodeRabbit command reference doc and synchronize README/ARCHITECTURE pointers

Validation

  • PYTHONPATH="$HOME/.config/opencode" python -m scripts.lint_by_filetype --json
  • python3 -m yamllint .yamllint.yml .github/dependabot.yml .github/workflows/*.yml
  • actionlint
  • Rscript -e "options(repos = c(CRAN="https://cloud.r-project.org")); rcmdcheck::rcmdcheck(args = c("--no-manual", "--as-cran"), error_on = "error")"

Risk

  • no algorithmic changes to R/aFIPC.R
  • operational/doc updates only; legacy NOTE items remain unchanged

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Feb 15, 2026

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

@coderabbitai

coderabbitai Bot commented Feb 15, 2026 •
edited
Loading

Copy link
Copy Markdown

Caution

Review failed

The pull request is closed.

📝 Walkthrough

Summary by CodeRabbit

릴리스 노트

  • 문서화

    • CodeRabbit 리뷰 명령어 및 워크플로우를 설명하는 새로운 가이드 문서 추가
    • 시스템 유지보수 및 운영 절차를 상세히 설명하는 새로운 문서 추가
    • 아키텍처 및 보안 고려사항 문서 업데이트

  • Chores

    • GitHub Actions 워크플로우 검증 프로세스 강화

개요

이 PR은 GitHub Actions 워크플로우의 actionlint 다운로드 단계를 개선하고 CodeRabbit 검토 명령어 및 운영 유지보수 절차에 대한 새로운 문서를 추가합니다. 워크플로우는 직접 curl 파이프라인에서 버전 관리 및 체크섬 검증을 포함한 구조화된 다운로드 방식으로 변경되었습니다.

변경 사항

코호트 / 파일(들) 요약
GitHub Actions 워크플로우
.github/workflows/code-quality.yml		 actionlint 다운로드 단계가 버전 정의, 체크섬 검증, 명시적 추출 단계를 포함하는 구조화된 방식으로 재작성되었습니다. 보안 오류 처리 흐름 개선.
핵심 문서
ARCHITECTURE.md, README.md		 새로운 문서 파일에 대한 참조 추가 및 보안 고려사항 업데이트. ARCHITECTURE.md는 CodeQL/의존성 검토 워크플로우 상태에 대한 설명 추가.
새로운 운영 문서
docs/coderabbit/review-commands.md, docs/operations/maintenance-runbook.md		 CodeRabbit 검토 명령어(멘션 대상, 명령어 배치, 5단계 워크플로우)와 주간/월간 유지보수 절차, 릴리스 품질 게이트, 위험 정책에 대한 새로운 문서 파일 추가. 정확한 셸 명령어 및 API 호출 포함.

예상 코드 리뷰 노력

🎯 2 (단순함) | ⏱️ ~12분

관련 가능성 있는 PR

시

🐰 체크섬 확인하고, 문서 정리하고,
워크플로우 깔끔하게 재작성되네!
유지보수 가이드 손에 들고,
안전하고 명확한 길을 앞으로 나아가리~
매일 매일 더 나은 코드로 🌟

✨ Finishing touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch chore/ops-hardening-workflow-runbook

Comment @coderabbitai help to get the list of available commands and usage tips.

@seonghobae

seonghobae commented Feb 15, 2026

Copy link
Copy Markdown
Collaborator Author

PR checks evidence

Required checks

  • Command: gh pr checks 9 --required --watch --fail-fast
  • Result: check=pass, quality=pass, secret-and-workflow-audit=pass

Merge state

  • Command: gh pr view 9 --json mergeStateStatus,mergeable,reviewDecision,url
  • Result: mergeable=MERGEABLE, mergeStateStatus=UNSTABLE (required checks are green)

Branch rules

  • Command: gh api repos/seonghobae/aFIPC/rules/branches/master
  • Result: required_status_checks enforced for contexts: check, quality, secret-and-workflow-audit

Code scanning API

  • Command: gh api /repos/seonghobae/aFIPC/code-scanning/analyses?pr=9
  • Result: HTTP 403 (Code scanning is not enabled for this repository)
  • Command: gh api /repos/seonghobae/aFIPC/code-scanning/alerts?pr=9&state=open
  • Result: HTTP 403 (Code scanning is not enabled for this repository)

Head check-runs

  • Command: gh api /repos/seonghobae/aFIPC/commits/791b79ef3f6dab9ad4a3d681fe1053010178c779/check-runs
  • Result summary: check=success, quality=success, secret-and-workflow-audit=success, dependency-review=skipped, Analyze(actions)=skipped

@seonghobae

seonghobae commented Feb 15, 2026

Copy link
Copy Markdown
Collaborator Author

@coderabbitai review

@coderabbitai

coderabbitai Bot commented Feb 15, 2026

Copy link
Copy Markdown
✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

@seonghobae
seonghobae merged commit c51d670 into master Feb 15, 2026
5 of 6 checks passed
@seonghobae
seonghobae deleted the chore/ops-hardening-workflow-runbook branch February 15, 2026 09:11
@coderabbitai

coderabbitai Bot commented Feb 15, 2026

Copy link
Copy Markdown
✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seonghobae