Repository navigation
Conversation
Import the tracked files of opamp-fleet (mbrigl/opamp-fleet, commit d1de86b) into the repository root, without history. - .editorconfig: take opamp-fleet's version. - SECURITY.md: take opamp-fleet's version, with the reporting contact replaced by the organisation's security address.
…ead of Dependabot ADR-0049 supersedes ADR-0044. Renovate, from a renovate.json that extends github>neteye-platform/repo-commons, raises every action and Cargo update; .github/dependabot.yml goes. Every action, actions/* included, is pinned to a commit SHA with its ref in a comment. Only the organisation's own repositories may name a branch (# main), because repo-commons publishes no tags. Cargo requirements stay ranges (rangeStrategy: update-lockfile), because the preset's :pinDependencies does not reach [workspace.dependencies] and the published opamp crate should not impose exact requirements on its consumers. ADR only, no implementation. ADR-0044's status line is flipped to superseded, as docs/adr/README.md and check 8 of check-docs.sh require in the pull request that proposes the successor. The human confirms that flip by merging, and it is reverted if ADR-0049 is rejected.
The neteye-platform repositories carry no CODEOWNERS; access and review are set in org-control-plane (rd-developers, one approving review on main). Remove .github/CODEOWNERS and every reference to it: the Enforcement section of ADR-0001, SECURITY.md, the repository-settings list and tree of README.md, and the CODEOWNERS half of check 13 of scripts/check-docs.sh with its self-test cases. ADR-0001 is accepted, and AGENTS.md section 3 changes an accepted ADR only by supersession. Editing its Enforcement section instead, with no new ADR, is the human's decision for the migration into the organisation.
Take the dual licence of repo-commons, as in the organisation's other repositories. Remove LICENSE and crates/opamp/LICENSE, the Apache text naming Markus Brigl; LICENSE-MIT and LICENSE-APACHE from repo-commons stand at the root and are copied into crates/opamp/, which is published and packages them. - Cargo.toml and fuzz/Cargo.toml: license = "MIT OR Apache-2.0". - NOTICE and crates/opamp/NOTICE stay, with the third-party attributions unchanged; the copyright line names Würth IT Italy S.r.l. and the licence line both licences. - The Debian package's copyright names the new holder and its license-file is LICENSE-APACHE. - README, CONTRIBUTING, the opamp crate's README, the WiX dialog comment and CHANGELOG say MIT OR Apache-2.0.
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The project lives in neteye-platform/classis now. Move every reference to mbrigl/opamp-fleet there: the README badges and the attestation command, the opamp crate's repository field and README, the Supervisor source of opamp-fleetctl's fetch tool, the tools manual, ADR-0045's context, and the interop module path. CHANGELOG keeps mbrigl/opamp-fleet in the entry of the release that was published from it: that release's attestations name that repository's workflow, so the command it gives verifies only there. ADR-0019 clause 39 now says neither MIT nor Apache-2.0 needs a click-through, and no longer names a single LICENSE file, which the dual licence replaced. Both ADRs are accepted; editing them in place rather than superseding them is the human's decision for the migration into the organisation.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Semgrep OSS found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
The neteye-platform organisation refuses a workflow that references an
action by a tag: "not allowed in neteye-platform/classis because all
actions must be pinned to a full-length commit SHA". Implement ADR-0049.
- Pin actions/attest, checkout, download-artifact, setup-go and
upload-artifact to the commit of their latest release in the major
the workflows used, with that release in a '# vX.Y.Z' comment. Each
major tag pointed to the same commit, so no run changes.
- scripts/check-action-refs.sh: every action, actions/* included, is on
a full SHA with its ref in a comment; only neteye-platform may name a
branch ('# main'); --resolve also fetches a commented branch's commit
graph and checks that it contains the pinned commit. renovate.json
must extend the organisation preset and carry the cargo rule, and
.github/dependabot.yml must not exist. The self-test covers each
clause and now cites ADR-0049.
- Remove .github/dependabot.yml. renovate.json keeps Cargo
requirements as ranges (rangeStrategy: update-lockfile); validated
with renovate-config-validator 44.168.0 --strict.
- checks.yml, SECURITY.md, README.md and ADR-0045's two mentions of
actions/attest on its major tag describe the new rule. ADR-0045 is
accepted; editing it in place is the human's decision for the
migration into the organisation.
ADR-0049 stays proposed; its status is the human's to flip.
The Carbon look of the bundled UI was described as IBM's Carbon Design System as Würth Phoenix's NetEye and SATAYO wear it. Describe it after Carbon alone, in the stylesheet's header, the handler's doc comment and CHANGELOG. The look itself does not change. The neteye-platform organisation stays: it is where the repository, the Renovate preset and the reusable workflows live, and those references are addresses, not mentions.
The workflows pin every action to a commit SHA (ADR-0049), so the release workflow tests no longer match 'actions/attest@v4' and the like. They compare the action each 'uses:' names, without its ref; check-action-refs.sh holds the pin and its comment.
…ironment
Semgrep's run-shell-injection flagged the version step, which wrote
${{ github.event_name }} and ${{ inputs.dry_run }} straight into its
script. Neither is attacker-controlled, but an expression expanded into
a script is the pattern the rule exists for. The step now reads
$GITHUB_EVENT_NAME and a DRY_RUN set in its env; the tag check of the
next step reads $GITHUB_EVENT_NAME the same way.
… fuzz seed The shared Semgrep and Trivy scans of neteye-platform/repo-commons reported 118 alerts on the import, none of them a finding: - detect-insecure-websocket (109) is a JavaScript rule that matches the ws:// literals of Rust tests, ADRs and the manual. The client refuses plaintext off the loopback (ADR-0013). - detect-non-literal-regexp (6) is in static/shiki.js, vendored and minified. The only JavaScript here is vendored. - detected-private-key and Trivy's private-key are fuzz/seeds/pem/ec-key, a throwaway key the PEM target starts from. .semgrepignorerule, which the shared workflow reads, drops the two JavaScript rules; .semgrepignore skips fuzz/seeds/ and keeps .gitignore; trivy.yaml skips the seed. Semgrep --config auto and Trivy fs (secret) run locally with these files report nothing.
…e hooks that misread them The shared pre-commit check runs prek over every file, and the import had only ever met it one change at a time. Some files are right as they stand: - trailing-whitespace and end-of-file-fixer skip the Redoc and Shiki bundles (Shiki's SHA-256 is pinned in scripts/vendor-shiki.lock) and the fuzz seeds, which the fuzzer reads byte for byte. - check-json skips .vscode/*.json and devcontainer.json, JSON with comments. - detect-private-key skips the PEM fuzz seed and the telemetry test that sets a PEM header alone. - codespell skips the bundles and the lockfiles; .codespellrc, as in permissionsync, lists the words that are right where they stand. ui-carbon.css says "redeclares".
- The Excalidraw sources end in a newline. - doris-dashboards.py and the two check-build-hardening scripts have a shebang and are now executable. - ruff format and ruff check --fix on doris-dashboards.py; the dashboards it writes are unchanged.
actionlint runs shellcheck over every run: script when shellcheck is on PATH, as it is in the shared pre-commit check. - SC2035: the publish job's globs follow `--` in cat, rm and gh release create, so no file name is read as an option. The release workflow tests read the new lines. - SC2016: the two rpm scriptlet assertions grep for a literal `$`; a directive says so.
… lines check-docs.sh and check-traceability.sh read the first line of an ADR's **Status:** and **Applies to:** fields, so a field that wraps loses what its second line says: a "superseded by" or the end of the Applies to text the index mirrors. Read them with header_field, as the Supersedes and Deciders fields already are, wrapped lines joined by one space. The self-test covers a wrapped Status field and a wrapped Applies to field, matching the index and not.
… permissionsync does The shared pre-commit check runs markdownlint-cli2 over every file; the documents wrapped at 100 columns and broke about 16,000 times. Adopt permissionsync's configuration: the rules' defaults, with tables and code blocks exempt from the line length. - `prettier --prose-wrap always --print-width 80` rewraps every document. Rendered to HTML, every file but one is unchanged; in ADR-0017 the dynamic linker's message is now a code span of its own, where an unmatched backtick had run into the next one. - .markdownlint-cli2.yaml adds what these documents need: headings may run long (an ADR title is one sentence), ordered lists keep their clause numbers (ADRs cite clauses by number), headings repeat under different parents (CHANGELOG), and a code span may start with a space (` CA`, `, `). .github/.markdownlint-cli2.yaml lets a pull request template start at "##". - By hand: commands lose their `$ ` prompt and their block is `sh`; unlabelled blocks are `text`; long code spans wrap at a space; the manual's bold labels end in a colon; placeholders in the ADR template and CONVENTIONS.md are escaped, so they render; the README's two notes form one blockquote; CHANGELOG 0.3.0 has one Changed section; the issue and pull request templates' comments rewrap. - The manual's Basic credential example reads $PASSWORD, so gitleaks sees no literal password once the prompt is gone. - .editorconfig sets max_line_length = 80 for Markdown. ADR text is rewrapped, never reworded; that touches accepted ADRs, which is the maintainer's call (AGENTS.md section 3).
docs/SECURITY-MODEL.md now holds the Dev Container, secrets, pinned actions, fleet trust model and supported versions; AGENTS.md and the README point to it. SECURITY.md keeps its original content. CHANGELOG.md keeps only its header: the releases it listed no longer exist, so the manual and the README stop referring to it, and the markdownlint exception for its repeated headings goes.
DamianoChini
approved these changes
Oct 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.