feat: release forge-audit ai-governance category (v1.11.0)#130
feat: release forge-audit ai-governance category (v1.11.0)#130LucasSantana-Dev merged 2 commits intomainfrom
Conversation
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThese changes introduce "ai-governance" as a new assessment category to the forge-audit tool, bringing the total from 5 to 6 categories. The package version is bumped to 1.11.0, accompanied by documentation updates, test adjustments, CLI help text changes, and a typo fix in the release workflow file. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
📝 Coding Plan
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 OpenGrep (1.16.4)package.json┌──────────────┐ �[32m✔�[39m �[1mOpengrep OSS�[0m �[1m Loading rules from local config...�[0m patterns/idp/__tests__/migration-cli.test.ts┌──────────────┐ �[32m✔�[39m �[1mOpengrep OSS�[0m �[1m Loading rules from local config...�[0m patterns/idp/migration/cli.ts┌──────────────┐ �[32m✔�[39m �[1mOpengrep OSS�[0m �[1m Loading rules from local config...�[0m Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
patterns/idp/migration/collectors/ai-governance-assessor.ts (2)
208-231: Consider case-insensitive matching for CI tool detection.The string checks are case-sensitive (e.g.,
'semgrep'), which should work for most GitHub Actions since action names are typically lowercase. However, YAML comments or custom step names might use different casing.♻️ Optional: case-insensitive matching
- if ( - !allContent.includes('secret-scan') && - !allContent.includes('trufflehog') && - !allContent.includes('gitguardian') && - !allContent.includes('ggshield') - ) { + const lowerContent = allContent.toLowerCase(); + if ( + !lowerContent.includes('secret-scan') && + !lowerContent.includes('trufflehog') && + !lowerContent.includes('gitguardian') && + !lowerContent.includes('ggshield') + ) {Apply similarly for the SAST check below.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@patterns/idp/migration/collectors/ai-governance-assessor.ts` around lines 208 - 231, The current checks on allContent (used with variables allContent and findings) are case-sensitive; normalize allContent to lowercase once (e.g., const normalized = allContent.toLowerCase()) and use normalized.includes(...) for the secret-scan checks (secret-scan, trufflehog, gitguardian, ggshield) and the SAST checks (semgrep, codeql, snyk) so matching becomes case-insensitive; apply this change in the same blocks that push findings to ensure both high and medium severity checks use the normalized string.
242-272: Extract scoring logic to a shared utility.The
scoreCategoryfunction duplicates identical severity-penalty mapping and grade calculation across at least 5 assessors (security, readiness, ai-governance, quality, and architecture). Consider moving this logic to a shared helper inpatterns/idp/migration/collectors/to reduce duplication and prevent divergence when grading rules change.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@patterns/idp/migration/collectors/ai-governance-assessor.ts` around lines 242 - 272, The scoreCategory function duplicates severity-to-penalty mapping and grade computation across multiple assessors; extract this logic into a shared helper (e.g., create a new exported function like computeCategoryScore or scoreFindings in patterns/idp/migration/collectors/score-utils.ts), move the switch/penalty and grade logic there, export necessary types (CategoryScore, Grade, AssessmentFinding or import them from a common types file), then replace the local scoreCategory implementations in ai-governance-assessor.ts and the other assessor files (security, readiness, quality, architecture) to import and call the new helper so all assessors use the single canonical scoring function.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@patterns/idp/migration/collectors/ai-governance-assessor.ts`:
- Around line 208-231: The current checks on allContent (used with variables
allContent and findings) are case-sensitive; normalize allContent to lowercase
once (e.g., const normalized = allContent.toLowerCase()) and use
normalized.includes(...) for the secret-scan checks (secret-scan, trufflehog,
gitguardian, ggshield) and the SAST checks (semgrep, codeql, snyk) so matching
becomes case-insensitive; apply this change in the same blocks that push
findings to ensure both high and medium severity checks use the normalized
string.
- Around line 242-272: The scoreCategory function duplicates severity-to-penalty
mapping and grade computation across multiple assessors; extract this logic into
a shared helper (e.g., create a new exported function like computeCategoryScore
or scoreFindings in patterns/idp/migration/collectors/score-utils.ts), move the
switch/penalty and grade logic there, export necessary types (CategoryScore,
Grade, AssessmentFinding or import them from a common types file), then replace
the local scoreCategory implementations in ai-governance-assessor.ts and the
other assessor files (security, readiness, quality, architecture) to import and
call the new helper so all assessors use the single canonical scoring function.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 01d3906c-32a6-4bfd-95f0-cf1eec406d45
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (11)
.github/workflows/release.ymlCHANGELOG.mdREADME.mdpackage.jsonpatterns/idp/__tests__/migration-assessor.test.tspatterns/idp/__tests__/migration-cli.test.tspatterns/idp/migration/assessor.tspatterns/idp/migration/cli.tspatterns/idp/migration/collectors/ai-governance-assessor.tspatterns/idp/migration/index.tspatterns/idp/migration/types.ts
LucasSantana-Dev
force-pushed
the
feature/ai-governance-audit
branch
from
4c9e6ed to
7f33ce3
Compare
Project Scorecard |
|
1 participant
Summary
forge-auditCLI/test contract to 6 categories includingai-governance$GITHUB_OUTPUT) in release detection path1.11.0and update README/CHANGELOG for the new audit contractValidation
npm run buildnpm test -- --runInBand patterns/idp/__tests__/migration-assessor.test.ts patterns/idp/__tests__/migration-cli.test.tsnpm run lint:checknpx tsc --noEmitnpm pack --dry-runnode dist/patterns/idp/migration/cli.js --help | rg "ai-governance"node dist/patterns/idp/migration/cli.js --dir <tmp> --json(verified 6 categories +ai-governance)Summary by CodeRabbit
New Features
Bug Fixes
Documentation