ci: enforce PR-based workflow with branch protection, DOX tracking, Dependabot#38
Conversation
…ributor reminders - Added .github/dependabot.yml: weekly npm dependency updates, 5 PR limit, 'chore' commit prefix, 'dependencies' label - Updated PR template: added CHANGELOG.md update checklist item, changelog entry section, and contributor credit section - AGENTS.md updated (local-only, gitignored) with workflow rules: no direct commits to main, PR-based workflow, squash merge, release process, contributor credits
…ependabot - Fix .gitignore: track AGENTS.md (binding work contracts for agents) with !AGENTS.md exception. Previously all AGENTS.md files were ignored, meaning future agent sessions couldn't see workflow rules. - Add 14 AGENTS.md files to version control (root + all children) - Add .github/dependabot.yml: weekly npm dependency updates - Update PR template: changelog checklist, contributor credit section - Root AGENTS.md now documents the professional workflow: no direct commits to main, PR-based delivery, squash merge, Conventional Commits PR titles, release process, contributor credits
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Jun 28, 2026 4:01p.m. | Review ↗ |
| Secrets | |
Jun 28, 2026 4:01p.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
|
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughWalkthroughAdds a complete hierarchy of ChangesDOX Framework and Repository Configuration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~5 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Introduces a DOX (AGENTS.md) documentation hierarchy and supporting GitHub workflow configuration to enforce a PR-based contribution process, plus automation for dependency updates.
Changes:
- Adds AGENTS.md “work contract” docs across key repository subtrees (root, src/, services subdomains, tests/, docs/, scripts/, .github/, .husky/).
- Updates
.gitignoreto ensure AGENTS.md files are version-controlled. - Adds Dependabot configuration and improves the PR template to align with the project workflow.
Reviewed changes
Copilot reviewed 16 out of 17 changed files in this pull request and generated 6 comments.
Show a summary per file
| File | Description |
|---|---|
AGENTS.md |
Adds root DOX framework contract + repo-wide workflow/verification rules. |
src/AGENTS.md |
Documents ownership and contracts for the src/ subtree. |
src/services/AGENTS.md |
Documents the service layer structure, API surface, and subsystem boundaries. |
src/services/ai/AGENTS.md |
Documents AI provider subsystem structure/contracts and child index. |
src/services/ai/providers/AGENTS.md |
Documents provider implementation contracts and safety rules for extra params. |
src/services/sqlite/AGENTS.md |
Documents SQLite layer responsibilities and invariants. |
src/services/vector-backends/AGENTS.md |
Documents vector backend interface seam and fallback behavior. |
src/services/user-profile/AGENTS.md |
Documents user profile subsystem boundaries and retention constraints. |
src/web/AGENTS.md |
Documents web UI asset pipeline and XSS boundary expectations. |
tests/AGENTS.md |
Documents Vitest conventions, HOME isolation, mocking, and verification commands. |
docs/AGENTS.md |
Documents the documentation set and which docs are “source of truth”. |
scripts/AGENTS.md |
Documents build/lint/migration scripts and local verification expectations. |
.github/AGENTS.md |
Documents GitHub workflows/templates ownership and constraints. |
.husky/AGENTS.md |
Documents pre-commit/pre-push hook responsibilities and invariants. |
.github/pull_request_template.md |
Expands PR template checklist and adds changelog/credit sections. |
.github/dependabot.yml |
Adds Dependabot version update configuration. |
.gitignore |
Adjusts ignore rules to ensure AGENTS.md files are tracked. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -0,0 +1,12 @@ | |||
| version: 2 | |||
| updates: | |||
| - package-ecosystem: npm | |||
|
|
||
| <!-- Link to any related issues. Use "Fixes #N" to auto-close on merge --> | ||
|
|
||
| Fixes #(issue number) |
|
|
||
| ## Purpose | ||
|
|
||
| The Vitest test suite. One test file per source module, mirroring the `src/services/` layout. 710+ tests across 60+ files, running in a Node environment with an isolated temporary HOME so tests never touch real `~/.opencode-mem0` data. |
|
|
||
| ## Local Contracts | ||
|
|
||
| - Framework: Vitest ^3.2.4, V8 coverage provider. Config in `vitest.config.ts` |
| ## Verification | ||
|
|
||
| - `bun run typecheck` — strict `tsc --noEmit`, zero errors | ||
| - `bun run test` — full Vitest suite (`tests/**/*.test.ts`, 430+ tests, node env, `tests/setup-home.ts` isolates HOME) |
| - `opencode.yml` — OpenCode-related workflow | ||
|
|
||
| ### Templates and community files (repo root of `.github/`) | ||
| - `pull_request_template.md` — PR checklist (typecheck, test, build, style, JSDoc, README/CHANGELOG) |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fc016b0d7b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -0,0 +1,12 @@ | |||
| version: 2 | |||
| updates: | |||
| - package-ecosystem: npm | |||
There was a problem hiding this comment.
This repository's dependency lockfile is bun.lock and CI installs with Bun, but this config asks Dependabot to run the npm updater. GitHub's Dependabot reference lists Bun as its own package-ecosystem: "bun" and npm separately, so Bun dependency PRs opened from this entry will not maintain the Bun lockfile that the project actually uses, leaving merged dependency updates with a stale lockfile.
Useful? React with 👍 / 👎.
The .gitignore was intentionally ignoring AGENTS.md (DOX hierarchy is local-only). PR #38 incorrectly added a !AGENTS.md exception and force-added all 14 AGENTS.md files. This reverts that: removes the exception, untracks all AGENTS.md files from git (files stay on disk for local agent use).
Description
Sets up the professional GitHub workflow infrastructure so all future changes (from agents and humans alike) follow a proper PR-based process.
Type of Change
Changes
Branch protection (already live on GitHub)
enforce_admins: true— owner can no longer bypass protection; all changes must go through PRsrequired_linear_history: true— squash merge only, clean historyallow_force_pushes: false— no force-push to mainDOX hierarchy tracked in git
.gitignorewith!AGENTS.mdexception so the 14 AGENTS.md files are version-controlledDependabot
.github/dependabot.yml: weekly npm dependency updates, 5 PR limit,chorecommit prefix,dependencieslabelPR template improved
docs/CHANGELOG.mdupdate checklist itemChecklist
bun run typecheckand it passesbun run testand all tests passbun run buildand it succeedsbun run format:checkand it passesTesting
Pre-commit hook passed (security checks, typecheck, lint-staged/Prettier). Pre-push hook passed (DeepSource local lint). No code changes — only docs and CI config.
Related Issues
N/A — infrastructure improvement
Changelog Entry
Added: Dependabot config, PR-based workflow enforcement, DOX hierarchy tracked in git
Contributor Credit
N/A
Summary by CodeRabbit
Documentation
Chores