docs(README, CLA, CODE_OF_CONDUCT, CONTRIBUTING, LICENSE): prep for open source - #836
Merged
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThe project documentation is reorganized, contribution and conduct guidance is expanded, Apache License 2.0 text is added, and individual and corporate contributor license agreements are introduced. ChangesProject Documentation and Legal Foundation
Estimated code review effort: 1 (Trivial) | ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CONTRIBUTING.md`:
- Around line 94-102: Update the “Development workflow” commit step to require a
Conventional Commit message, replacing the statement that no specific format is
required while retaining the guidance to explain why the change was made.
- Around line 9-12: Correct the numbered onboarding steps in the contribution
instructions to follow sequential order 1, 2, 3, 4, and fix the “chanages” typo
in step 1. Preserve the existing step content and ordering of the actual
instructions.
In `@legal/CCLA.md`:
- Around line 5-13: Resolve the scope mismatch between the “You” definition and
contribution authorization: either extend Section 4(b) and Schedule A to
authorize employees of Affiliates, or narrow “You” in the Definitions section to
mean only the Corporation. Ensure the selected scope is used consistently
throughout the agreement.
In `@README.md`:
- Around line 86-108: Update the README example around the GH_TOKEN prompt and
claude invocation to remove --dangerously-skip-permissions and avoid exporting
the PAT into the unrestricted agent environment. Defer credential injection
until the final Git operation, using the least-privilege token possible while
preserving the repository population workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 043cd15e-60d3-40d5-8af9-6e110627c17c
📒 Files selected for processing (6)
CODE_OF_CONDUCT.mdCONTRIBUTING.mdLICENSEREADME.mdlegal/CCLA.mdlegal/ICLA.md
Comment on lines
+9
to
+12
| 1. Fork the "main" branch and commit your chanages to your fork | ||
| 4. Submit your PR as normal | ||
| 2. Before we can accept your pull request, you'll need to sign our **Contributor License Agreement (CLA)**. | ||
| 3. This happens automatically on your first PR — a bot will comment with a link. It takes about 30 seconds. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Fix the TL;DR ordering and typo.
The steps are numbered 1, 4, 2, 3, and chanages is misspelled. This makes the onboarding flow appear inconsistent.
Proposed fix
-1. Fork the "main" branch and commit your chanages to your fork
-4. Submit your PR as normal
-2. Before we can accept your pull request, you'll need to sign our **Contributor License Agreement (CLA)**.
-3. This happens automatically on your first PR — a bot will comment with a link. It takes about 30 seconds.
+1. Fork the "main" branch and commit your changes to your fork.
+2. Submit your PR as normal.
+3. Before we can accept your pull request, you'll need to sign our **Contributor License Agreement (CLA)**.
+4. This happens automatically on your first PR — a bot will comment with a link. It takes about 30 seconds.📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| 1. Fork the "main" branch and commit your chanages to your fork | |
| 4. Submit your PR as normal | |
| 2. Before we can accept your pull request, you'll need to sign our **Contributor License Agreement (CLA)**. | |
| 3. This happens automatically on your first PR — a bot will comment with a link. It takes about 30 seconds. | |
| 1. Fork the "main" branch and commit your changes to your fork. | |
| 2. Submit your PR as normal. | |
| 3. Before we can accept your pull request, you'll need to sign our **Contributor License Agreement (CLA)**. | |
| 4. This happens automatically on your first PR — a bot will comment with a link. It takes about 30 seconds. |
🧰 Tools
🪛 LanguageTool
[grammar] ~9-~9: Ensure spelling is correct
Context: ... Fork the "main" branch and commit your chanages to your fork 4. Submit your PR as norma...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CONTRIBUTING.md` around lines 9 - 12, Correct the numbered onboarding steps
in the contribution instructions to follow sequential order 1, 2, 3, 4, and fix
the “chanages” typo in step 1. Preserve the existing step content and ordering
of the actual instructions.
Source: Linters/SAST tools
Comment on lines
+94
to
+102
| ## Development workflow | ||
|
|
||
| 1. Fork the repository. | ||
| 2. Create a feature branch: `git checkout -b your-feature-name`. | ||
| 3. Make your changes. Add tests where appropriate. | ||
| 4. Ensure the existing tests still pass. | ||
| 5. Commit with a clear message. We don't require a specific commit format, but "why" is more useful than "what." | ||
| 6. Push to your fork and open a pull request against `main`. | ||
| 7. Sign the CLA if prompted. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Resolve the commit-format contradiction.
Lines 16-23 say CI enforces Conventional Commits, but line 100 says no specific commit format is required. Contributors following the latter can submit PRs that fail CI.
Update the workflow step to require a Conventional Commit message.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CONTRIBUTING.md` around lines 94 - 102, Update the “Development workflow”
commit step to require a Conventional Commit message, replacing the statement
that no specific format is required while retaining the guidance to explain why
the change was made.
Comment on lines
+86
to
+108
| Prefer not to install the Claude GitHub App? The next example uses a fine-grained GitHub personal access token (PAT) stored in the macOS keychain instead. To create a fine-grained PAT (e.g. scoped to a specific repo), go to <https://github.com/settings/personal-access-tokens>. | ||
|
|
||
| Once you have created the PAT, copied it into your keychain (e.g. `security add-generic-password -s "PAT-foo-repo" -a "my-mac-user-name" -w`), and created the new, empty GitHub repo, the following shows how to populate that repo from within a sandbox: | ||
|
|
||
| ```shell | ||
| mkdir -p ~/projects/foo | ||
| cd ~/projects/foo | ||
|
|
||
| # create and update a minimal.toml file | ||
| min init | ||
| min add --session git gh claude-code mermaid-cli kittyview less emacs | ||
|
|
||
| # copy the GitHub PAT to your clipboard from your macOS keychain | ||
| security find-generic-password -w -s "PAT-foo-repo" -a "my-mac-user-name" | pbcopy | ||
|
|
||
| # start and enter a sandbox, which copies up the CWD file tree into the sandbox | ||
| min activate --attach . | ||
|
|
||
| read -sp "paste GH PAT now:" GH_TOKEN && export GH_TOKEN | ||
|
|
||
| git init | ||
|
|
||
| claude --dangerously-skip-permissions |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Do not expose GH_TOKEN to an unrestricted agent.
This example exports a GitHub PAT, then starts Claude with --dangerously-skip-permissions, allowing the agent to read and potentially exfiltrate the token. Remove the dangerous flag and defer credential injection until the final Git operation, using the least-privilege token possible.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 86 - 108, Update the README example around the
GH_TOKEN prompt and claude invocation to remove --dangerously-skip-permissions
and avoid exporting the PAT into the unrestricted agent environment. Defer
credential injection until the final Git operation, using the least-privilege
token possible while preserving the repository population workflow.
norrietaylor
added a commit
that referenced
this pull request
Jul 18, 2026
Resolve PR #840 conflicts. The base branch still carries PR #836's original commits on the old fork point; oss/integration already contains that content (replayed during the earlier rebase) plus the reviewed fixes. README.md and CONTRIBUTING.md conflicts resolved in favor of oss/integration (keeps the min add/[session] quickstart fix, the TL;DR renumbering, the commit-format correction, logo/badges, and the docs link). Single Apache-2.0 license stance preserved. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Contributor
|
Love this! |
This was referenced Jul 20, 2026
norrietaylor
added a commit
that referenced
this pull request
Jul 20, 2026
…#848) Main already ships an Apache-2.0 LICENSE (#836), but the crate manifests still declared `license = "MIT OR Apache-2.0"`. Align them: set the workspace package.license to Apache-2.0 and switch all 28 crates to `license.workspace = true`. Add a NOTICE covering the darwin release's redistribution of libkrun and gvproxy. Document the LGPL dependency exceptions in deny.toml (hakoniwa's linking exception; the malachite family, static-linked via nickel-lang-core) and drop the now-unused souk4711 git-source allowance. Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updated the README (still TBD for Loadouts section), added CLA documents and CONTRIBUTING.md, and CODE_OF_CONDUCT document. Added the Apache 2 license.
Summary by CodeRabbit