Add codescene-cli skill and reconcile codescene-health-rules skill#75
Add codescene-cli skill and reconcile codescene-health-rules skill#75leynos wants to merge 2 commits into
Conversation
Fold the remaining details from CodeScene's code health documentation into the skill: - Directives may sit inside larger multi-line comments, and unknown or misspelled smell names are silently ignored. - Record CodeScene's best practices for directives: be restrictive, inspect new directives in review, and document the rationale inline with a date. - Spell out the consequences of a `weight: 0.0` rule (removed from the score, the virtual review, and delta/PR gates) and note that the reported score can then look better than the baseline. - Note the searchable overridden-rules summary under each analysis's Scope section, the template download via the Hotspots configuration, and the exact "Repository with global code health rules" field for global rules. Reformat the file with the repository Markdown tooling.
Document the CodeScene `cs` CLI as a skill covering the core workflows: - `cs delta` for change-based analysis of the working tree, staged content, commits, and branches, including git-hook integration. - `cs review` and `cs check` for file-focused feedback (JSON and lint-style respectively), including `<ref>:<path>` targets and stdin. - `cs rules-config` and `cs check-rules` for validating and editing `.codescene/code-health-rules.json` from the command line. - `cs docs` topics, environment variables, installation, updating, and activation. Licensing is documented against Personal Access Tokens; the older "CodeScene CLI" / devtools tokens are deprecated. The skill cross-references `codescene-health-rules` for the semantics of the rules file itself. Accept `edn` (the output format) in the typos dictionary and commit the regenerated `typos.toml`.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
Summary
WalkthroughAdds comprehensive CodeScene CLI and health-rule documentation covering workflows, configuration, activation, and directives. It also adds “edn” to the repository’s spelling dictionaries. ChangesCodeScene documentation
Spelling configuration
Possibly related PRs
Poem
Caution Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional.
❌ Failed checks (1 error, 1 warning)
✅ Passed checks (18 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@skills/codescene-cli/references/command-reference.md`:
- Line 175: Update the description in the command-reference table for the
`license` CLI topic from “Setting up a license” to “Setting up a licence”, while
keeping the topic name unchanged.
- Line 160: Update the sentence describing update rollback to use “an invalid
configuration” instead of “invalid config,” preserving the existing meaning that
the original file is restored.
In `@skills/codescene-cli/references/install-and-activate.md`:
- Around line 48-49: Update the placeholder examples in the installation and
activation instructions, including the CS_ACCESS_TOKEN and other referenced
examples, to use shell-safe quoted placeholders or identifier-style values such
as YOUR_PERSONAL_ACCESS_TOKEN and YOUR_BASE_URL instead of angle-bracket
placeholders.
- Around line 42-45: Update the licensing instructions in the CLI access-token
section by removing the second-person pronoun: change “generated from your
CodeScene user settings” to “generated from CodeScene user settings,” while
preserving the surrounding wording.
- Line 10: Replace the direct curl-piped shell execution in the installation
instructions with a download-and-verify workflow that validates the installer
using a published checksum or signature before running it; if verification
cannot be provided, explicitly document the trust and supply-chain risks of
executing the mutable remote script.
- Around line 5-6: Update the prose in the installation-and-activation
documentation to use “installation” as the noun: replace “The install script”
with “The installation script” and revise the referenced “repeat the manual
installation” wording as needed, including the additional occurrence noted by
the review.
In `@skills/codescene-cli/SKILL.md`:
- Around line 93-94: Update the sentence describing the required `--file-name`
option when reading from stdin by inserting a comma before “so,” while
preserving the existing wording and meaning.
- Line 136: Update the invalid-configuration bullet in SKILL.md to use direct
conditional grammar: state that if an update creates an invalid configuration,
the original file is restored.
- Around line 177-180: Align the reference description in
skills/codescene-cli/SKILL.md lines 177-180 with the existing
condensed-reference wording in
skills/codescene-cli/references/command-reference.md lines 1-4. Describe the
linked command reference as condensed, and make no direct changes to the sibling
file because it already uses the correct wording.
In `@skills/codescene-health-rules/SKILL.md`:
- Around line 38-40: Update the override guidance in the “Emit only the
overrides” instruction: change “rules the user wants kept at defaults” to “rules
the user wants to keep at their defaults” and add the requested comma before
“and.” Preserve the required Triage annotations for this grammar and
documentation-style change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5174f71e-b280-4057-8e2f-1259b9918fcb
📒 Files selected for processing (6)
skills/codescene-cli/SKILL.mdskills/codescene-cli/references/command-reference.mdskills/codescene-cli/references/install-and-activate.mdskills/codescene-health-rules/SKILL.mdtypos.local.tomltypos.toml
| - If no config file exists when running `set-rule` or `set-threshold`, a | ||
| minimal file is created automatically at the default path first. | ||
| - Unknown rule or threshold names fail with suggestions. | ||
| - If an update creates invalid config, the original file is restored. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Add the missing article.
Change “If an update creates invalid config” to “If an update creates an invalid configuration”.
Triage: [type:grammar]
🧰 Tools
🪛 LanguageTool
[uncategorized] ~160-~160: Possible missing article found.
Context: ...ith suggestions. - If an update creates invalid config, the original file is restored. ...
(AI_HYDRA_LEO_MISSING_AN)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/codescene-cli/references/command-reference.md` at line 160, Update the
sentence describing update rollback to use “an invalid configuration” instead of
“invalid config,” preserving the existing meaning that the original file is
restored.
Source: Linters/SAST tools
| | `interactive-pre-commit-hook-example` | Example interactive pre-commit hook | | ||
| | `pre-commit-hook-example` | Example pre-commit hook | | ||
| | `vim` | `check` integration for (neo)vim | | ||
| | `license` | Setting up a license | |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use British spelling in the description.
Keep the CLI topic name license unchanged, but change “Setting up a license” to “Setting up a licence”.
Triage: [type:spelling]
🧰 Tools
🪛 LanguageTool
[locale-violation] ~175-~175: license must be spelled with a “c” when used as a noun in British English. Use “licence”.
Context: ...check integration for (neo)vim | | license | Setting ...
(LICENCE_LICENSE_NOUN_SINGULAR)
[locale-violation] ~175-~175: license must be spelled with a “c” when used as a noun in British English. Use “licence”.
Context: ... | Setting up a license | | file-name ...
(LICENCE_LICENSE_NOUN_SINGULAR)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/codescene-cli/references/command-reference.md` at line 175, Update the
description in the command-reference table for the `license` CLI topic from
“Setting up a license” to “Setting up a licence”, while keeping the topic name
unchanged.
Source: Linters/SAST tools
| The install script downloads the binary, moves it to `~/.local/bin`, makes it | ||
| executable, and adds `~/.local/bin` to `PATH` if needed. Works with bash, zsh, |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use installation as the noun.
Replace “The install script” with “The installation script” and “repeat the manual installation” wording where needed to avoid treating “install” as a noun.
Triage: [type:grammar]
Also applies to: 37-38
🧰 Tools
🪛 LanguageTool
[grammar] ~5-~5: The word ‘install’ is not a noun.
Context: ...ll (Linux, macOS, Windows via WSL) The install script downloads the binary, moves it t...
(A_INSTALL)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/codescene-cli/references/install-and-activate.md` around lines 5 - 6,
Update the prose in the installation-and-activation documentation to use
“installation” as the noun: replace “The install script” with “The installation
script” and revise the referenced “repeat the manual installation” wording as
needed, including the additional occurrence noted by the review.
Source: Linters/SAST tools
| or fish: | ||
|
|
||
| ```bash | ||
| curl https://downloads.codescene.io/enterprise/cli/install-cs-tool.sh | sh |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Replace the unverified curl | sh installation path.
Provide a download-and-verify workflow using a checksum or signature before execution, or clearly document the trust and supply-chain risk of executing a mutable remote script.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/codescene-cli/references/install-and-activate.md` at line 10, Replace
the direct curl-piped shell execution in the installation instructions with a
download-and-verify workflow that validates the installer using a published
checksum or signature before running it; if verification cannot be provided,
explicitly document the trust and supply-chain risks of executing the mutable
remote script.
| The CLI requires an access token for licensing. Use a **Personal Access Token** | ||
| generated from your CodeScene user settings — the older "CodeScene CLI" / | ||
| devtools tokens are **deprecated** and have been replaced by Personal Access | ||
| Tokens. Then: |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Remove the second-person pronoun.
Replace “generated from your CodeScene user settings” with “generated from CodeScene user settings”.
Triage: [type:docstyle]
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/codescene-cli/references/install-and-activate.md` around lines 42 -
45, Update the licensing instructions in the CLI access-token section by
removing the second-person pronoun: change “generated from your CodeScene user
settings” to “generated from CodeScene user settings,” while preserving the
surrounding wording.
Source: Path instructions
| export CS_ACCESS_TOKEN=<your-personal-access-token> | ||
| ``` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Use shell-safe placeholders.
Angle brackets are parsed as redirection operators when these examples are copied literally. Replace them with quoted placeholders or identifier-style values such as YOUR_PERSONAL_ACCESS_TOKEN and YOUR_BASE_URL.
Also applies to: 60-61, 85-86
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/codescene-cli/references/install-and-activate.md` around lines 48 -
49, Update the placeholder examples in the installation and activation
instructions, including the CS_ACCESS_TOKEN and other referenced examples, to
use shell-safe quoted placeholders or identifier-style values such as
YOUR_PERSONAL_ACCESS_TOKEN and YOUR_BASE_URL instead of angle-bracket
placeholders.
| - `--file-name` is required when reading from stdin so the CLI can infer the | ||
| language from the extension. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Insert the missing comma before so.
Change the sentence to: “--file-name is required when reading from stdin, so the CLI can infer the language from the extension.”
Triage: [type:grammar]
🧰 Tools
🪛 LanguageTool
[uncategorized] ~93-~93: Use a comma before ‘so’ if it connects two independent clauses (unless they are closely connected and short).
Context: ...ame` is required when reading from stdin so the CLI can infer the language from t...
(COMMA_COMPOUND_SENTENCE_2)
🪛 SkillSpector (2.3.11)
[warning] 34: [MP2] Context Window Stuffing: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Remediation: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
(Memory Poisoning (MP2))
[error] 162: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 169: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/codescene-cli/SKILL.md` around lines 93 - 94, Update the sentence
describing the required `--file-name` option when reading from stdin by
inserting a comma before “so,” while preserving the existing wording and
meaning.
Source: Linters/SAST tools
| - With multiple `rule_set` entries and no `--matching-content-path`, the | ||
| command fails and prints the available selectors. | ||
| - Unknown rule or threshold names fail with suggestions. | ||
| - If an update would create invalid config, the original file is restored. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use direct conditional grammar.
Replace “If an update would create invalid config” with “If an update creates an invalid configuration”.
Triage: [type:grammar]
🧰 Tools
🪛 LanguageTool
[grammar] ~136-~136: Consider removing ‘would’. (Usually, ‘would’ does not occur in a conditional clause, unless to make a request or give a polite order.)
Context: ...s fail with suggestions. - If an update would create invalid config, the original file is re...
(CONDITIONAL_CLAUSE)
[uncategorized] ~136-~136: Possible missing article found.
Context: ...uggestions. - If an update would create invalid config, the original file is restored. ...
(AI_HYDRA_LEO_MISSING_AN)
🪛 SkillSpector (2.3.11)
[warning] 34: [MP2] Context Window Stuffing: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Remediation: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
(Memory Poisoning (MP2))
[error] 162: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 169: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/codescene-cli/SKILL.md` at line 136, Update the invalid-configuration
bullet in SKILL.md to use direct conditional grammar: state that if an update
creates an invalid configuration, the original file is restored.
Source: Linters/SAST tools
| - [`references/command-reference.md`](references/command-reference.md) — Full | ||
| options for every command, verbatim from the upstream reference | ||
| - [`references/install-and-activate.md`](references/install-and-activate.md) — | ||
| Installation, updating, licensing, and platform-specific notes |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Align the reference descriptions across both files.
The reference is labelled “condensed” in skills/codescene-cli/references/command-reference.md but “full” and “verbatim” in skills/codescene-cli/SKILL.md. Use one accurate description throughout.
skills/codescene-cli/SKILL.md#L177-L180: describe the linked file as a condensed reference.skills/codescene-cli/references/command-reference.md#L1-L4: retain the condensed-reference wording.
🧰 Tools
🪛 SkillSpector (2.3.11)
[warning] 34: [MP2] Context Window Stuffing: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Remediation: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
(Memory Poisoning (MP2))
[error] 162: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
[error] 169: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
📍 Affects 2 files
skills/codescene-cli/SKILL.md#L177-L180(this comment)skills/codescene-cli/references/command-reference.md#L1-L4
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/codescene-cli/SKILL.md` around lines 177 - 180, Align the reference
description in skills/codescene-cli/SKILL.md lines 177-180 with the existing
condensed-reference wording in
skills/codescene-cli/references/command-reference.md lines 1-4. Describe the
linked command reference as condensed, and make no direct changes to the sibling
file because it already uses the correct wording.
| 4. **Emit only the overrides** — omit rules the user wants kept at defaults; | ||
| this is | ||
| how CodeScene itself recommends it and it reduces config drift. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Fix the grammar in the override guidance.
Replace “rules the user wants kept at defaults” with “rules the user wants to keep at their defaults”, and add a comma before “and” in the compound sentence.
Triage: [type:grammar] [type:docstyle]
As per path instructions, documentation style and grammar findings require the specified Triage annotations.
🧰 Tools
🪛 LanguageTool
[style] ~38-~38: The double modal “wants kept” is nonstandard (only accepted in certain dialects). Consider “to be kept”.
Context: ...overrides** — omit rules the user wants kept at defaults; this is how CodeScen...
(NEEDS_FIXED)
[uncategorized] ~40-~40: Use a comma before ‘and’ if it connects two independent clauses (unless they are closely connected and short).
Context: ...is how CodeScene itself recommends it and it reduces config drift. 5. **Place the...
(COMMA_COMPOUND_SENTENCE)
🪛 SkillSpector (2.3.11)
[warning] 105: [MP2] Context Window Stuffing: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Remediation: Implement context-window management that detects and rejects padding or stuffing attempts. Prioritize system instructions over user-injected content.
(Memory Poisoning (MP2))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@skills/codescene-health-rules/SKILL.md` around lines 38 - 40, Update the
override guidance in the “Emit only the overrides” instruction: change “rules
the user wants kept at defaults” to “rules the user wants to keep at their
defaults” and add the requested comma before “and.” Preserve the required Triage
annotations for this grammar and documentation-style change.
Sources: Path instructions, Linters/SAST tools
1 participant
Add the
codescene-cliskill for running local CodeScene analyses and reconcile thecodescene-health-rulesskill with upstream directive documentation.Summary of changes
New skill:
codescene-cliAdds a new skill (
skills/codescene-cli/) that covers running CodeScene code health analyses locally with thecsCLI. The skill documents:cs delta— change-based analysis between working tree, commits, or branchescs review/cs check— file-focused feedback (JSON and lint-style output)cs rules-config/cs check-rules— validate and edit custom code health rules from the command lineUpdated skill:
codescene-health-rulesReconciles the existing skill with upstream CodeScene directive documentation:
references/rules-catalogue.mdfor authoritative rule names and criticalityreferences/thresholds.mdfor threshold keys and typical overridesTypos configuration
Updates
typos.tomlandtypos.local.tomlwith project-specific spellings (analyzer,mold,edn,ises).Review entry points
skills/codescene-cli/SKILL.mdskills/codescene-cli/references/command-reference.mdskills/codescene-cli/references/install-and-activate.mdskills/codescene-health-rules/SKILL.md