feat: add MIT license file and update README to reference licensing#1
Merged
Conversation
|
Warning Review limit reached
More reviews will be available in 30 minutes and 56 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (9)
📝 WalkthroughWalkthroughAdds an MIT LICENSE (explicitly excluding documentation), updates README license lines and CODEOWNERS, declares pnpm packageManager, and introduces a composite Node setup action, CI workflow, deploy pipelines (dev/stg/prd), deploy helper scripts, a multi-stage Dockerfile, and Caddy configs for each environment. ChangesLicense and repository metadata
CI, build, and deploy pipelines
Sequence DiagramsequenceDiagram
participant GitHub as GitHub Actions
participant Setup as Setup-Node Action
participant CI as 00: CI Workflow
participant Dokploy as Dokploy API
participant Runner as zsoftly-iaas Runner
participant Smoke as smoke-test.sh
participant Site as docs site
GitHub->>Setup: invoke composite setup-node (pnpm + node)
GitHub->>CI: run lint/typecheck/audit/build
CI->>Dokploy: trigger dokploy-deploy.sh (POST deploy)
Dokploy->>Runner: schedule deployment job
Runner->>Dokploy: poll status (dokploy-deploy.sh)
Dokploy->>Runner: return status (building/done/error)
Runner->>Smoke: run smoke-test.sh against target domain
Smoke->>Site: HTTP checks on configured paths
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 3❌ Failed checks (3 warnings)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@LICENSE`:
- Around line 23-27: Update the LICENSE to remove ambiguity by modifying the
definition of "Software" and adding a clear statement about documentation:
change the "Software" definition (the quoted term "Software" in the license
header/definitions) to explicitly exclude documentation files (e.g., "Software
does not include documentation files; see below"), and immediately add a short
clause stating the documentation license status—either specify the separate
license that governs documentation content or assert "Documentation is not
licensed under the MIT License and is All rights reserved by ZSoftly
Technologies Inc." so readers know whether docs are covered or reserved.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
There was a problem hiding this comment.
Actionable comments posted: 7
🧹 Nitpick comments (3)
Dockerfile (1)
18-33: ⚖️ Poor tradeoffConsider running the runtime stage as non-root.
The final image runs as
root(Trivy DS-0002). For a static file server this is avoidable hardening. Note the caveat: binding:80as non-root requires eitherCAP_NET_BIND_SERVICEor switching to a high port (e.g. setSITE_DOMAIN=:8080,EXPOSE 8080, and have the proxy target it), so validate the deployment topology before adding aUSERdirective.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@Dockerfile` around lines 18 - 33, The image currently runs as root (risk DS-0002); update the runtime stage to run Caddy as a non-root user by either granting CAP_NET_BIND_SERVICE to allow binding :80 or (simpler) switching to an unprivileged port and user: set ENV SITE_DOMAIN=:8080 and EXPOSE 8080 (and adjust any upstream proxy), then add a USER directive (e.g., USER caddy or create a dedicated non-root user) so the container process runs non-root; ensure HEALTHCHECK and the copied files still work with the chosen user and that CADDYFILE, SITE_ROOT, SITE_DOMAIN and EXPOSE are updated consistently..github/scripts/smoke-test.sh (1)
28-28: 💤 Low value
curl -kskips TLS verification.
-k(insecure) means the smoke test will pass even if the site is served with an invalid/expired/wrong-host certificate, so a TLS misconfiguration on a fresh deploy goes undetected. If the cert is expected to be valid post-deploy, drop-k; keep it only if certs are still provisioning at check time.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/scripts/smoke-test.sh at line 28, The curl invocation that sets the status variable in .github/scripts/smoke-test.sh currently uses the -k/--insecure flag which skips TLS verification; remove the -k (and corresponding short form if present) from the curl command that assigns status (the line with status=$(curl -sk --max-time 15 -o /dev/null -w "%{http_code}" "https://${DOMAIN}${path}")) so TLS certs are validated, or alternatively gate -k behind an explicit env toggle (e.g., ALLOW_INSECURE_TLS) so the script only disables verification when intentionally configured..github/workflows/10-deploy-dev.yml (1)
1-39: ⚡ Quick winAdd a least-privilege
permissionsblock.Without an explicit
permissions:block the workflow gets the default (often broad)GITHUB_TOKENscopes. This workflow only checks out and calls the Dokploy API, so it needs no write scopes.🔒 Suggested hardening
concurrency: group: deploy-dev cancel-in-progress: true +permissions: + contents: read + jobs:Two related supply-chain items (also apply to
20-deploy-stg.ymland30-deploy-prd.yml): consider pinningactions/checkout@v5to a commit SHA, and scopingsecrets: inheritto only the Dokploy secrets the called workflow actually needs.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/10-deploy-dev.yml around lines 1 - 39, Add a least-privilege permissions block to the 10: Deploy — Dev workflow by giving the GITHUB_TOKEN only the minimal read scope required (e.g., contents: read) at the top-level of the workflow, replace actions/checkout@v5 in the '00: Checkout' step with a pinned commit SHA for that action, and stop using secrets: inherit for the ci job—explicitly pass only the Dokploy secrets needed by the .github/scripts/dokploy-deploy.sh step (DOKPLOY_API_URL, DOKPLOY_API_KEY, DOKPLOY_APP_ID_DEV) instead of inheriting all secrets from the parent workflow.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/scripts/dokploy-deploy.sh:
- Around line 50-89: The poll loop incorrectly sets SAW_RUNNING=true for both
"running" and "idle"; change the logic in the while loop that examines STATUS so
SAW_RUNNING is set only when STATUS == "running" (leave "idle" as a non-building
state and print a different/info message), e.g. update the branch that currently
tests [ "$STATUS" = "running" ] || [ "$STATUS" = "idle" ] to only set
SAW_RUNNING on "running" and handle "idle" separately; this affects the
variables STATUS and SAW_RUNNING and the messages that follow.
In @.github/workflows/00-ci.yml:
- Around line 16-20: The workflow lacks an explicit permissions block so jobs
inherit broad GITHUB_TOKEN scopes; add a top-level permissions entry in the
workflow YAML (at the same level as concurrency and jobs) that grants minimal
read-only access required for lint/typecheck/audit/build, e.g. set permissions:
contents: read and any other needed read scopes (packages: read, pull-requests:
read, etc.) to enforce least privilege for the entire workflow.
- Around line 25-26: Replace floating action tags with the specified commit SHAs
and disable credential persistence for checkout: change uses:
actions/checkout@v5 to uses:
actions/checkout@7018347005dd679b9f7fc620591f40c76174da3e and add with:
persist-credentials: false to each checkout step (occurrences of
actions/checkout in the file); also pin the upload artifact action by replacing
uses: actions/upload-artifact@v5 with uses:
actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4. Ensure you
update all instances mentioned (the multiple checkout occurrences and the single
upload-artifact occurrence) so the workflow is pinned and checkout credentials
are not persisted.
In @.github/workflows/20-deploy-stg.yml:
- Around line 24-61: The workflow is vulnerable to shell injection because
github.event.inputs.branch is inlined into run scripts; bind the input to an env
var and use the quoted variable everywhere: add env: BRANCH: ${{
github.event.inputs.branch }} on the steps that run shell (notably the '00:
Checkout' and '01: Switch app branch in Dokploy' steps), replace all occurrences
of ${{ github.event.inputs.branch }} inside those run blocks with the quoted
shell variable "$BRANCH" (including the BRANCH assignment, the curl -d JSON body
and the final echo), and ensure the JSON payload in the curl call is constructed
using "$BRANCH" with proper quoting/escaping so the branch value cannot break
out of the string.
In @.github/workflows/30-deploy-prd.yml:
- Around line 88-96: The deploy step currently writes the SSH private key to
/tmp/deploy_key and runs rsync directly which can abort and leave the key on
disk, and it disables host key checking via StrictHostKeyChecking=no; modify the
step to (1) create a temporary key file as you already do but register a shell
trap (trap 'rm -f /tmp/deploy_key' EXIT) before running rsync so the file is
removed regardless of rsync exit status, and (2) replace the
StrictHostKeyChecking=no usage by pinning the target host key in a known_hosts
file and pass -o UserKnownHostsFile=/tmp/known_hosts (or add it to
~/.ssh/known_hosts) so rsync/ssh uses the pinned host key instead of accepting
any key.
- Around line 26-42: The run steps currently inline GitHub input interpolation
into the shell (BRANCH="${{ github.event.inputs.branch }}") which can be unsafe;
instead set BRANCH via the step's env: (e.g., env: BRANCH: ${{
github.event.inputs.branch }}) and then reference it inside the script as
"$BRANCH" (quoted) everywhere — update both the branch-validate step and the
'01: Verify branch was deployed to stg' step to use env-provided BRANCH and
replace direct interpolations in the python/curl/ENCODED_INPUT commands with the
quoted "$BRANCH" variable to avoid shell evaluation and word-splitting.
In `@Dockerfile`:
- Around line 3-4: The OCI LABEL instructions are currently applied to the
earlier "builder" stage and thus get discarded; move the two LABEL lines
(org.opencontainers.image.source and org.opencontainers.image.description) into
the final stage that uses caddy:2-alpine so the produced runtime image carries
those labels (i.e., place the LABEL entries after the final FROM caddy:2-alpine
(or inside the final stage) rather than in the builder stage).
---
Nitpick comments:
In @.github/scripts/smoke-test.sh:
- Line 28: The curl invocation that sets the status variable in
.github/scripts/smoke-test.sh currently uses the -k/--insecure flag which skips
TLS verification; remove the -k (and corresponding short form if present) from
the curl command that assigns status (the line with status=$(curl -sk --max-time
15 -o /dev/null -w "%{http_code}" "https://${DOMAIN}${path}")) so TLS certs are
validated, or alternatively gate -k behind an explicit env toggle (e.g.,
ALLOW_INSECURE_TLS) so the script only disables verification when intentionally
configured.
In @.github/workflows/10-deploy-dev.yml:
- Around line 1-39: Add a least-privilege permissions block to the 10: Deploy —
Dev workflow by giving the GITHUB_TOKEN only the minimal read scope required
(e.g., contents: read) at the top-level of the workflow, replace
actions/checkout@v5 in the '00: Checkout' step with a pinned commit SHA for that
action, and stop using secrets: inherit for the ci job—explicitly pass only the
Dokploy secrets needed by the .github/scripts/dokploy-deploy.sh step
(DOKPLOY_API_URL, DOKPLOY_API_KEY, DOKPLOY_APP_ID_DEV) instead of inheriting all
secrets from the parent workflow.
In `@Dockerfile`:
- Around line 18-33: The image currently runs as root (risk DS-0002); update the
runtime stage to run Caddy as a non-root user by either granting
CAP_NET_BIND_SERVICE to allow binding :80 or (simpler) switching to an
unprivileged port and user: set ENV SITE_DOMAIN=:8080 and EXPOSE 8080 (and
adjust any upstream proxy), then add a USER directive (e.g., USER caddy or
create a dedicated non-root user) so the container process runs non-root; ensure
HEALTHCHECK and the copied files still work with the chosen user and that
CADDYFILE, SITE_ROOT, SITE_DOMAIN and EXPOSE are updated consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 1b34998b-632a-40e2-84f5-7c79c08eeb96
📒 Files selected for processing (14)
.github/CODEOWNERS.github/actions/setup-node/action.yml.github/scripts/dokploy-deploy.sh.github/scripts/smoke-test.sh.github/workflows/00-ci.yml.github/workflows/10-deploy-dev.yml.github/workflows/20-deploy-stg.yml.github/workflows/30-deploy-prd.ymlDockerfileLICENSEdeploy/caddy/dev.Caddyfiledeploy/caddy/prd.Caddyfiledeploy/caddy/stg.Caddyfilepackage.json
✅ Files skipped from review due to trivial changes (3)
- package.json
- .github/CODEOWNERS
- .github/actions/setup-node/action.yml
🚧 Files skipped from review as they are similar to previous changes (1)
- LICENSE
- typecheck now runs 'astro sync && tsc --noEmit' so Astro virtual modules (astro:content, expressive-code themes) resolve in a fresh CI checkout - add starlight-links-validator to fail the build on broken internal links (errorOnRelativeLinks disabled — content uses relative links that resolve)
ditahm6
approved these changes
May 31, 2026
This was referenced May 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Why
Checklist
pnpm fmt && pnpm lint && pnpm typecheck && pnpm buildall pass:::note Screenshot pending:::if unavailableSummary by CodeRabbit
Chores
CI / Deployment
Tools / Scripts