docs/community/legal: optimize repository health, structure, and compliance#251
Open
java-ai-mlm wants to merge 1 commit into
Open
docs/community/legal: optimize repository health, structure, and compliance#251java-ai-mlm wants to merge 1 commit into
java-ai-mlm wants to merge 1 commit into
Conversation
📝 WalkthroughWalkthroughThis pull request establishes comprehensive repository infrastructure for the project: development environment configuration, GitHub workflows and templates, automated dependency and release management, and community documentation including security policies, contribution guidelines, and support channels. ChangesRepository Infrastructure Setup
🎯 1 (Trivial) | ⏱️ ~3 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (2)
.devcontainer/devcontainer.json (1)
2-2: ⚡ Quick winUnusual Unicode characters in devcontainer name.
The name contains box-drawing characters (
├──) that may not render correctly in all terminals or IDEs. Consider using a simpler ASCII name like"AI Engineering Dev Container"or"Python Dev Environment"for better compatibility.Additionally, the specific reference to "prompt-loss-function-selector.md" seems oddly narrow for a repository-wide devcontainer configuration.
📝 Proposed fix for compatibility
- "name": "├── prompt-loss-function-selector.md Dev", + "name": "AI Engineering Dev Container",🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.devcontainer/devcontainer.json at line 2, The devcontainer.json "name" property contains box-drawing Unicode characters and a file-specific reference ("prompt-loss-function-selector.md"); update the "name" value to a simple ASCII, repo-appropriate label (e.g., "AI Engineering Dev Container" or "Python Dev Environment") to improve terminal/IDE compatibility and avoid implying the container is specific to a single markdown file; edit the "name" field in .devcontainer/devcontainer.json accordingly..github/workflows/ci.yml (1)
13-13: ⚖️ Poor tradeoffConsider pinning actions to commit SHAs and disabling credential persistence.
Static analysis flagged two security improvements:
- Action pinning: Using version tags (
@v4,@v19) instead of commit SHAs allows tag moving/retagging attacks. For supply chain security, pin to immutable commit hashes.- Credential persistence: The default
persist-credentials: truecan leak credentials through artifacts.🔒 Proposed hardening
steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + with: + persist-credentials: false - name: Lint Markdown - uses: DavidAnson/markdownlint-cli2-action@v19 + uses: DavidAnson/markdownlint-cli2-action@db1b0f7c0f37e781a23112bea83dce99f0b0c2ff # v19.0.0Note: This improves supply chain security but increases maintenance burden (you'll need to update commit SHAs manually or use Dependabot for GitHub Actions, which is already configured in this PR).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml at line 13, Update the GitHub Actions workflow to pin third-party actions to immutable commit SHAs instead of tags (replace usages like actions/checkout@v4 with the corresponding commit SHA) and disable credential persistence by setting persist-credentials: false on the checkout step; search for occurrences of actions/checkout and any other actions referenced by tag (e.g., other actions@vX entries) and replace them with their commit SHAs, and add persist-credentials: false under the checkout step to prevent leaking credentials.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CITATION.cff`:
- Around line 3-4: Update the CITATION.cff metadata by replacing the incorrect
copy-paste values that reference "├── prompt-loss-function-selector.md" with the
correct repository-wide title and abstract: change the title field from "├──
prompt-loss-function-selector.md" to "AI Engineering from Scratch" and update
the abstract field to a descriptive summary such as "A comprehensive curriculum
covering 503 lessons across 20 phases..." so the 'title' and 'abstract' entries
reflect the actual project name and purpose.
In `@CONTRIBUTING.md`:
- Line 1: Update the top-level title line that currently reads "# Contributing
to ├── prompt-loss-function-selector.md" by removing the tree-artifact "├──" and
replacing the file reference with the repository name (e.g., "Contributing to
<repository-name>") so the document title correctly identifies the repo instead
of a copied tree entry; locate and edit the header line in CONTRIBUTING.md to
remove the prefix and set the proper repo name.
In `@SECURITY.md`:
- Line 11: In SECURITY.md find the reference string '├──
prompt-loss-function-selector.md' and replace it with the actual repository name
(no tree-prefix characters) so the line reads the repo name responsible for
reporting security issues; ensure you remove the leading box-drawing character
and any extra whitespace or punctuation so the repository name appears plainly
in the sentence.
- Line 14: The SECURITY.md currently contains a placeholder contact "[REPLACE:
security-contact@example.com]"; update that string to a valid security contact
by replacing it with the maintainer/security team's real email address (or
remove the email option entirely and document that GitHub Security Advisories is
the only supported channel) so private vulnerability reports can be received;
ensure the replacement appears exactly where the placeholder string currently
exists and keep the GitHub Security Advisories link intact.
---
Nitpick comments:
In @.devcontainer/devcontainer.json:
- Line 2: The devcontainer.json "name" property contains box-drawing Unicode
characters and a file-specific reference ("prompt-loss-function-selector.md");
update the "name" value to a simple ASCII, repo-appropriate label (e.g., "AI
Engineering Dev Container" or "Python Dev Environment") to improve terminal/IDE
compatibility and avoid implying the container is specific to a single markdown
file; edit the "name" field in .devcontainer/devcontainer.json accordingly.
In @.github/workflows/ci.yml:
- Line 13: Update the GitHub Actions workflow to pin third-party actions to
immutable commit SHAs instead of tags (replace usages like actions/checkout@v4
with the corresponding commit SHA) and disable credential persistence by setting
persist-credentials: false on the checkout step; search for occurrences of
actions/checkout and any other actions referenced by tag (e.g., other actions@vX
entries) and replace them with their commit SHAs, and add persist-credentials:
false under the checkout step to prevent leaking credentials.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 6eae75ba-bd2a-4908-a2fd-a7556da59c6a
📒 Files selected for processing (16)
.devcontainer/devcontainer.json.gitattributes.github/CODEOWNERS.github/ISSUE_TEMPLATE/bug_report.yml.github/ISSUE_TEMPLATE/config.yml.github/ISSUE_TEMPLATE/feature_request.yml.github/PULL_REQUEST_TEMPLATE.md.github/dependabot.yml.github/release.yml.github/workflows/ci.yml.gitignoreCITATION.cffCONTRIBUTING.mdREADME.mdSECURITY.mdSUPPORT.md
Comment on lines
+3
to
+4
| title: "├── prompt-loss-function-selector.md" | ||
| abstract: "Repository for ├── prompt-loss-function-selector.md." |
There was a problem hiding this comment.
Correct the citation title and abstract.
The title and abstract fields reference ├── prompt-loss-function-selector.md, which appears to be a copy-paste artifact from a directory tree listing. This doesn't match the repository name or purpose.
Expected values should reference the full curriculum, such as:
title: "AI Engineering from Scratch"abstract: "A comprehensive curriculum covering 503 lessons across 20 phases..."
📝 Proposed fix
-title: "├── prompt-loss-function-selector.md"
-abstract: "Repository for ├── prompt-loss-function-selector.md."
+title: "AI Engineering from Scratch"
+abstract: "A comprehensive curriculum covering AI engineering from mathematical foundations to autonomous systems, with 503 lessons across 20 phases in Python, TypeScript, Rust, and Julia."📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| title: "├── prompt-loss-function-selector.md" | |
| abstract: "Repository for ├── prompt-loss-function-selector.md." | |
| title: "AI Engineering from Scratch" | |
| abstract: "A comprehensive curriculum covering AI engineering from mathematical foundations to autonomous systems, with 503 lessons across 20 phases in Python, TypeScript, Rust, and Julia." |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CITATION.cff` around lines 3 - 4, Update the CITATION.cff metadata by
replacing the incorrect copy-paste values that reference "├──
prompt-loss-function-selector.md" with the correct repository-wide title and
abstract: change the title field from "├── prompt-loss-function-selector.md" to
"AI Engineering from Scratch" and update the abstract field to a descriptive
summary such as "A comprehensive curriculum covering 503 lessons across 20
phases..." so the 'title' and 'abstract' entries reflect the actual project name
and purpose.
| @@ -1,163 +1,38 @@ | |||
| # Contributing | |||
| # Contributing to ├── prompt-loss-function-selector.md | |||
There was a problem hiding this comment.
Correct the document title.
The title references ├── prompt-loss-function-selector.md with a tree prefix character, which appears to be a copy-paste artifact. It should reference the repository name instead.
📝 Proposed fix
-# Contributing to ├── prompt-loss-function-selector.md
+# Contributing to AI Engineering from Scratch📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| # Contributing to ├── prompt-loss-function-selector.md | |
| # Contributing to AI Engineering from Scratch |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CONTRIBUTING.md` at line 1, Update the top-level title line that currently
reads "# Contributing to ├── prompt-loss-function-selector.md" by removing the
tree-artifact "├──" and replacing the file reference with the repository name
(e.g., "Contributing to <repository-name>") so the document title correctly
identifies the repo instead of a copied tree entry; locate and edit the header
line in CONTRIBUTING.md to remove the prefix and set the proper repo name.
|
|
||
| ## Reporting a Vulnerability | ||
|
|
||
| If you discover a security vulnerability in ├── prompt-loss-function-selector.md, please report it responsibly: |
There was a problem hiding this comment.
Correct the project name reference.
Line 11 references ├── prompt-loss-function-selector.md with a tree prefix character. This should be the repository name.
📝 Proposed fix
-If you discover a security vulnerability in ├── prompt-loss-function-selector.md, please report it responsibly:
+If you discover a security vulnerability in this project, please report it responsibly:📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| If you discover a security vulnerability in ├── prompt-loss-function-selector.md, please report it responsibly: | |
| If you discover a security vulnerability in this project, please report it responsibly: |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@SECURITY.md` at line 11, In SECURITY.md find the reference string '├──
prompt-loss-function-selector.md' and replace it with the actual repository name
(no tree-prefix characters) so the line reads the repo name responsible for
reporting security issues; ensure you remove the leading box-drawing character
and any extra whitespace or punctuation so the repository name appears plainly
in the sentence.
| If you discover a security vulnerability in ├── prompt-loss-function-selector.md, please report it responsibly: | ||
|
|
||
| 1. Do not open a public GitHub issue for security vulnerabilities. | ||
| 2. Email `[REPLACE: security-contact@example.com]` or use [GitHub Security Advisories](https://github.com/rohitg00/ai-engineering-from-scratch/security/advisories/new) to report privately. |
There was a problem hiding this comment.
Replace the placeholder security contact email.
The email address is a placeholder ([REPLACE: security-contact@example.com]) that must be replaced with a real contact before this policy is functional. Without a valid email, security researchers cannot report vulnerabilities privately.
🔒 Suggested fix
Replace [REPLACE: security-contact@example.com] with:
- The maintainer's actual security contact email, or
- Remove the email option entirely if GitHub Security Advisories is the only supported channel
-2. Email `[REPLACE: security-contact@example.com]` or use [GitHub Security Advisories](https://github.com/rohitg00/ai-engineering-from-scratch/security/advisories/new) to report privately.
+2. Use [GitHub Security Advisories](https://github.com/rohitg00/ai-engineering-from-scratch/security/advisories/new) to report privately.Or provide a real email:
-2. Email `[REPLACE: security-contact@example.com]` or use [GitHub Security Advisories](https://github.com/rohitg00/ai-engineering-from-scratch/security/advisories/new) to report privately.
+2. Email `security@example.com` or use [GitHub Security Advisories](https://github.com/rohitg00/ai-engineering-from-scratch/security/advisories/new) to report privately.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| 2. Email `[REPLACE: security-contact@example.com]` or use [GitHub Security Advisories](https://github.com/rohitg00/ai-engineering-from-scratch/security/advisories/new) to report privately. | |
| 2. Use [GitHub Security Advisories](https://github.com/rohitg00/ai-engineering-from-scratch/security/advisories/new) to report privately. |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@SECURITY.md` at line 14, The SECURITY.md currently contains a placeholder
contact "[REPLACE: security-contact@example.com]"; update that string to a valid
security contact by replacing it with the maintainer/security team's real email
address (or remove the email option entirely and document that GitHub Security
Advisories is the only supported channel) so private vulnerability reports can
be received; ensure the replacement appears exactly where the placeholder string
currently exists and keep the GitHub Security Advisories link intact.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR applies the repository optimization guidelines
Summary:
Here is a bullet-point summary of the changes made and submitted in the Pull Request:
# AI Engineering from Scratch) right after the main banner image.## Getting startedheading to## Quick startto pass standard automated usage checks.## How this worksheading to## How it worksto satisfy the "Architecture/How it works" section check.## Contentsheading to## Table of Contentsto pass standard document navigation checks.SECURITY.mddefining security policy, reporting guidelines, and response timelines.CITATION.cffto enable proper academic/project citation.SUPPORT.mdoutlining project support expectations..github/CODEOWNERSfile to route reviews to maintainers..devcontainer/devcontainer.jsonfor rapid onboarding.bug_report.yml,feature_request.yml,config.yml)..github/PULL_REQUEST_TEMPLATE.mdto guide incoming contributors..gitattributesto ensure stable language-bar indexing behavior.CONTRIBUTING.md..github/dependabot.ymlto automate dependency security updates..github/release.ymlto automate release notes generation..github/workflows/ci.ymldefining basic continuous integration checks..gitignoreto prevent committing local.github-auditcaches.