docs: add Go code quality & security checks and bump Go version to 1.26+ - #635
Conversation
|
Warning Review limit reached
Next review available in: 1 minute Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
WalkthroughDocumentation now requires Go 1.26.5+ for source builds, adds coding-agent quality and security checks, and introduces a guide to Zero extension, configuration, plugins, hooks, skills, specialists, and MCP. ChangesRepository guidance and extension documentation
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
AGENTS.md (1)
330-337: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick winAlign these commands with CI’s pinned toolchain.
.github/workflows/ci.yml:87-133pinsgovulncheck@v1.3.0andgolangci-lint@v2.12.2, limits linting to specific linters, and setsGOTOOLCHAINfromgo.mod. This guidance instead installs@latestand runs an unscoped linter, so local results can diverge or later become incompatible. Document the pinnedgo run ...@versioncommands, or pin the installed versions and required toolchain settings.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@AGENTS.md` around lines 330 - 337, The Go quality and security check instructions in AGENTS.md use unpinned, CI-inconsistent tooling. Update the documented commands to match the versions, GOTOOLCHAIN setting, and explicitly enabled linters defined in .github/workflows/ci.yml, using pinned go run commands for govulncheck and golangci-lint (or equivalent pinned installations), and retain the required formatting and vetting checks.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@AGENTS.md`:
- Around line 328-337: Reduce AGENTS.md below the approximately 8 KiB
instruction-file guideline by removing the Go quality and security checklist
added under “Repository Guidelines for coding agents.” Relocate this guidance to
a smaller, appropriately scoped local instruction file, or retain only essential
instructions in AGENTS.md while preserving the required checks and
tool-installation prompts.
In `@README.md`:
- Line 9: Update the Go version references in the README, including the badge
and source-build note, to state the exact minimum requirement of Go 1.26.5+
instead of Go 1.26+, consistent with the go.mod requirement.
---
Nitpick comments:
In `@AGENTS.md`:
- Around line 330-337: The Go quality and security check instructions in
AGENTS.md use unpinned, CI-inconsistent tooling. Update the documented commands
to match the versions, GOTOOLCHAIN setting, and explicitly enabled linters
defined in .github/workflows/ci.yml, using pinned go run commands for
govulncheck and golangci-lint (or equivalent pinned installations), and retain
the required formatting and vetting checks.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 18d87834-abf8-40c2-9dd7-c2ced71646e4
📒 Files selected for processing (4)
AGENTS.mdREADME.mdREADME_ZH.mddocs/INSTALL.md
|
All requested changes are addressed, and whitespace issues (trailing newlines at EOF) are resolved. @coderabbitai please re-review. |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
gh pr view 635 --repo Gitlawb/zero --json files,commits -q '.files[].path'
echo "---diff---"
gh pr diff 635 --repo Gitlawb/zeroLength of output: 4711 🏁 Script executed: #!/bin/bash
git clone --depth 1 --branch main https://github.com/Gitlawb/zero.git /tmp/repo 2>/dev/null || true
cd /tmp/repo || exit 0
git fetch origin pull/635/head:pr635 --depth 1 2>&1 | tail -5
git checkout pr635 2>&1 | tail -5
for f in AGENTS.md README.md README_ZH.md docs/INSTALL.md; do
echo "== $f =="
tail -c 50 "$f" | xxd | tail -5
doneLength of output: 822 🏁 Script executed: #!/bin/bash
cd /tmp/repo || exit 0
for f in AGENTS.md README.md README_ZH.md docs/INSTALL.md; do
echo "== $f =="
tail -c 5 "$f" | od -c
doneLength of output: 671 🏁 Script executed: #!/bin/bash
cd /tmp/repo || exit 0
for f in AGENTS.md README.md README_ZH.md docs/INSTALL.md; do
echo "== $f =="
python3 -c "
data = open('$f','rb').read()
print(repr(data[-5:]))
"
doneLength of output: 453 All four files end with a single trailing newline and no stray blank lines, so the whitespace fix looks good. The diff also confirms:
One minor nit (not blocking): in Thanks for confirming — I'll go ahead and re-review. ✅ Action performedReview finished.
|
Vasanthdev2004
left a comment
Vasanthdev2004
left a comment
There was a problem hiding this comment.
Docs-only change — I read all four files and ran build/vet against current main, both clean. The go.mod directive is untouched here; the actual Go 1.26.5 bump landed in #607, and this PR just brings the README badges, install docs, and a new code-quality/security-checks section in AGENTS.md and README.md in line with that (1.25+ -> 1.26.5+). So it's complementary doc alignment, not a duplicate bump. No regressions, no forbidden references. Approving.
One small note: in the new README "Code Quality and Security Checks" section, the pinned go run lint command uses github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2 but the go install block just below drops the /v2/ segment — those should match, or the install command will not resolve to v2.12.2.
|
@gnanam1990 docs-only #635 if you want a glance — aligns README/AGENTS.md install + a new code-quality/security-checks section with the 1.26.5 bump from #607. Approved with one nit (golangci-lint install path is missing the /v2/ segment). |
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/EXTENDING.md`:
- Line 107: Update the fenced code block documenting the skills-directory tree
in EXTENDING.md to use the text language identifier, changing the opening fence
to ```text so it satisfies markdownlint MD040.
- Line 46: Correct the Windows user configuration path in the
personal-guidelines documentation to use %AppData%\zero\ZERO.md instead of
including a second Roaming segment, and update the associated config.json and
personal specialists path references consistently.
- Line 5: Update the relative Markdown links in docs/EXTENDING.md, including the
README reference and the links near the additionally affected sections, so they
resolve from the repository root rather than under docs/. Preserve each link’s
target while correcting its relative path, including SPECIALISTS.md and any
other affected references.
- Line 304: Align the end-to-end hook example in EXTENDING.md with the preceding
configuration: either add a `git push --force` hook to the shown
`.zero/hooks.json` configuration or revise the summary to claim only the
configured `rm -rf` block, keeping the example and description consistent.
- Around line 103-105: Update the skills documentation around the user-level
discovery statement and the project plugin section to distinguish unsupported
standalone project skill discovery from supported plugin-bundled skills. State
that project plugins may bundle skills, which are merged into the active run,
while standalone project skill directories remain unavailable; keep the existing
guidance for shared skills in AGENTS.md or hooks.
- Around line 283-291: Update the configuration precedence section in the “Three
layers” documentation to accurately describe all five sources and their actual
resolution order. Remove the contradictory “Three layers” wording and ensure
environment variables and CLI flags are ordered consistently with the documented
highest-priority rule, or explicitly separate their precedence rules when their
scopes differ.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: a8b37369-b3c5-40c5-891b-5f4ab0b25f69
📒 Files selected for processing (3)
AGENTS.mdREADME.mddocs/EXTENDING.md
💤 Files with no reviewable changes (1)
- README.md
✅ Files skipped from review due to trivial changes (1)
- AGENTS.md
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
docs/EXTENDING.md (1)
238-238: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDocument the MCP server command using separate arguments.
The surrounding
stdioconfiguration uses a binary incommandand flags inargs, but this instruction presentszero serve --mcpas a single command. Users may try to execute a binary literally namedzero serve --mcp. Show it ascommand: "zero"withargs: ["serve", "--mcp"]to match the documented schema.Proposed clarification
-The server speaks MCP over stdio. Configure it from the receiving side as a `stdio` server whose command is `zero serve --mcp`. +The server speaks MCP over stdio. Configure it from the receiving side as a `stdio` server with `command: "zero"` and `args: ["serve", "--mcp"]`.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/EXTENDING.md` at line 238, Update the MCP stdio configuration guidance in the surrounding documentation to represent the executable as command "zero" and pass "serve" and "--mcp" as separate args, matching the documented schema.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@docs/EXTENDING.md`:
- Line 238: Update the MCP stdio configuration guidance in the surrounding
documentation to represent the executable as command "zero" and pass "serve" and
"--mcp" as separate args, matching the documented schema.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 45e0e7e0-10cb-48d7-83ac-b360cef2608d
📒 Files selected for processing (1)
docs/EXTENDING.md
The go install command pointed at the v1 module path (golangci-lint/cmd/golangci-lint), which does not resolve for v2.12.2. The go run invocation earlier in the same section already had the correct v2 path.
904f5e6 to
8ff0c87
Compare
|
Rebased onto main to resolve the AGENTS.md conflict. Main's new MCP credential-boundaries paragraph from #597 landed in the section this PR moves to docs/EXTENDING.md, so I ported that paragraph into EXTENDING.md at the same spot. |
3 participants
This PR adds instructions to run Go formatting, vetting, linting, and vulnerability checks to README/AGENTS.md, and bumps the documented Go requirement/badges from 1.25+ to 1.26+.
Summary by CodeRabbit