From aab0fe741fba5a24cabffbfdb11a25561e715858 Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 00:41:49 -0500 Subject: [PATCH 01/17] chore: enroll repository in central review stack --- .github/workflows/review-stack.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/workflows/review-stack.yml diff --git a/.github/workflows/review-stack.yml b/.github/workflows/review-stack.yml new file mode 100644 index 0000000..66fde4d --- /dev/null +++ b/.github/workflows/review-stack.yml @@ -0,0 +1,18 @@ +name: Review Stack + +on: + pull_request: + push: + branches: [main] + +permissions: + contents: read + +jobs: + review-stack: + uses: madmoneymike5/review-stack-control/.github/workflows/review-stack.yml@v1 + with: + native-command: >- + git diff --check + central-ref: v1 + secrets: inherit From b754a747977490f901bcc830f70db137e4d79b69 Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 00:41:50 -0500 Subject: [PATCH 02/17] chore: enroll repository in central review stack --- .github/workflows/review-stack-trufflehog.yml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 .github/workflows/review-stack-trufflehog.yml diff --git a/.github/workflows/review-stack-trufflehog.yml b/.github/workflows/review-stack-trufflehog.yml new file mode 100644 index 0000000..e36fd2c --- /dev/null +++ b/.github/workflows/review-stack-trufflehog.yml @@ -0,0 +1,14 @@ +name: TruffleHog weekly deep scan + +on: + workflow_dispatch: + schedule: + - cron: "17 3 * * 0" + +permissions: + contents: read + +jobs: + trufflehog: + uses: madmoneymike5/review-stack-control/.github/workflows/trufflehog.yml@v1 + secrets: inherit From f53ab30a09c345bd50bcdd2ba95b1c20a5f61158 Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 00:41:52 -0500 Subject: [PATCH 03/17] chore: enroll repository in central review stack --- .github/dependabot.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..fae040a --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,27 @@ +version: 2 +updates: + - package-ecosystem: npm + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + - package-ecosystem: pip + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + - package-ecosystem: cargo + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 + - package-ecosystem: docker + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 5 From 27c1c532be563f577c781837f28f06713184e7e9 Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 00:41:53 -0500 Subject: [PATCH 04/17] chore: enroll repository in central review stack --- .coderabbit.yaml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 .coderabbit.yaml diff --git a/.coderabbit.yaml b/.coderabbit.yaml new file mode 100644 index 0000000..97f47aa --- /dev/null +++ b/.coderabbit.yaml @@ -0,0 +1,7 @@ +language: en-US +reviews: + profile: chill + request_changes_workflow: false + high_level_summary: true +chat: + auto_reply: false From 835a9f1970ef0f307a02ddf18c026617e9ad84cb Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 00:41:54 -0500 Subject: [PATCH 05/17] chore: enroll repository in central review stack --- greptile.json | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 greptile.json diff --git a/greptile.json b/greptile.json new file mode 100644 index 0000000..34c493d --- /dev/null +++ b/greptile.json @@ -0,0 +1,3 @@ +{ + "skipReview": "AUTOMATIC" +} From 2d76691e57bf65495c07f4eba2b1412e77bb2bcb Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 00:41:55 -0500 Subject: [PATCH 06/17] chore: enroll repository in central review stack --- REVIEW-STACK.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 REVIEW-STACK.md diff --git a/REVIEW-STACK.md b/REVIEW-STACK.md new file mode 100644 index 0000000..46dcf9f --- /dev/null +++ b/REVIEW-STACK.md @@ -0,0 +1,15 @@ +# Review Stack + +This repository uses the central review stack at `madmoneymike5/review-stack-control`. + +Order: + +1. Native type, lint, test, and build gates. +2. OpenGrep, Gitleaks, and Trivy blocking checks. +3. Kodus local AI review, advisory. +4. CodeRabbit CLI or Codex CLI, opt-in and advisory. +5. Greptile only on request after all earlier checks pass. + +Greptile is manual-only to protect the monthly credit budget. Trigger it with `@greptileai` when needed. + +The weekly TruffleHog workflow is deliberately separate from normal pull-request checks. From 06a2ae03791d99eaf963fcfdb4ffd800a9da3416 Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 00:41:56 -0500 Subject: [PATCH 07/17] chore: enroll repository in central review stack --- .review-stack/coderabbit-review.sh | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .review-stack/coderabbit-review.sh diff --git a/.review-stack/coderabbit-review.sh b/.review-stack/coderabbit-review.sh new file mode 100644 index 0000000..80966f3 --- /dev/null +++ b/.review-stack/coderabbit-review.sh @@ -0,0 +1,18 @@ +#!/usr/bin/env bash +set -euo pipefail + +if command -v cr >/dev/null 2>&1; then + cli=cr +elif command -v coderabbit >/dev/null 2>&1; then + cli=coderabbit +else + printf '%s\n' 'CodeRabbit CLI missing. Install: CI=1 curl -fsSL https://cli.coderabbit.ai/install.sh | sh' >&2 + exit 127 +fi + +if ! git rev-parse --show-toplevel >/dev/null 2>&1; then + printf '%s\n' 'Run this command inside a Git repository.' >&2 + exit 2 +fi + +exec "$cli" review --plain --uncommitted --include-untracked "$@" From 63b3037fa4c787388c6b0df4b010f7afd10fa1bb Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 01:06:26 -0500 Subject: [PATCH 08/17] chore(review-stack): enroll repository --- .github/workflows/review-stack.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/review-stack.yml b/.github/workflows/review-stack.yml index 66fde4d..fd145d8 100644 --- a/.github/workflows/review-stack.yml +++ b/.github/workflows/review-stack.yml @@ -1,4 +1,5 @@ name: Review Stack +# review-stack-control: refresh marker for reusable workflow and action updates on: pull_request: @@ -15,4 +16,3 @@ jobs: native-command: >- git diff --check central-ref: v1 - secrets: inherit From 00e7a6033fe7291ad43a29eeb79ef99164cfb957 Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 01:06:27 -0500 Subject: [PATCH 09/17] chore(review-stack): enroll repository --- .github/workflows/review-stack-trufflehog.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/review-stack-trufflehog.yml b/.github/workflows/review-stack-trufflehog.yml index e36fd2c..0ffca32 100644 --- a/.github/workflows/review-stack-trufflehog.yml +++ b/.github/workflows/review-stack-trufflehog.yml @@ -11,4 +11,3 @@ permissions: jobs: trufflehog: uses: madmoneymike5/review-stack-control/.github/workflows/trufflehog.yml@v1 - secrets: inherit From 107699dfc182f20839484c7f484d1ad10817f7bc Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 01:57:58 -0500 Subject: [PATCH 10/17] chore(review-stack): enroll repository --- .github/workflows/review-stack.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/review-stack.yml b/.github/workflows/review-stack.yml index fd145d8..14ef7e9 100644 --- a/.github/workflows/review-stack.yml +++ b/.github/workflows/review-stack.yml @@ -1,5 +1,5 @@ name: Review Stack -# review-stack-control: refresh marker for reusable workflow and action updates +# review-stack-control: refresh marker for reusable workflow, action, and safe scanner output updates on: pull_request: From 3898734f2179afbf4452be033059f9b14d2ca81c Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 02:37:34 -0500 Subject: [PATCH 11/17] chore(review-stack): enroll repository --- .github/workflows/review-stack.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/review-stack.yml b/.github/workflows/review-stack.yml index 14ef7e9..8d9f448 100644 --- a/.github/workflows/review-stack.yml +++ b/.github/workflows/review-stack.yml @@ -1,5 +1,5 @@ name: Review Stack -# review-stack-control: refresh marker for reusable workflow, action, and safe scanner output updates +# review-stack-control: current PR gate scans files only; TruffleHog owns history on: pull_request: From 22deea7531b3e592f4f4e4d70f2b1c524efb725d Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 03:37:41 -0500 Subject: [PATCH 12/17] chore(review-stack): enroll repository --- .github/workflows/review-stack.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/review-stack.yml b/.github/workflows/review-stack.yml index 8d9f448..60cf903 100644 --- a/.github/workflows/review-stack.yml +++ b/.github/workflows/review-stack.yml @@ -1,5 +1,5 @@ name: Review Stack -# review-stack-control: current PR gate scans files only; TruffleHog owns history +# review-stack-control: post-rollout verification against current v1 baseline on: pull_request: From 49dab75e9f0f63e77245aee2257436bd6cf912e5 Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 03:59:49 -0500 Subject: [PATCH 13/17] chore(review-stack): enroll repository --- .github/workflows/review-stack.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/review-stack.yml b/.github/workflows/review-stack.yml index 60cf903..ec13c6d 100644 --- a/.github/workflows/review-stack.yml +++ b/.github/workflows/review-stack.yml @@ -11,7 +11,7 @@ permissions: jobs: review-stack: - uses: madmoneymike5/review-stack-control/.github/workflows/review-stack.yml@v1 + uses: madmoneymike5/review-stack-runtime/.github/workflows/review-stack.yml@v1 with: native-command: >- git diff --check From 43dc361d4a73da4413e4920c5cde3fe219b21f7f Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 03:59:50 -0500 Subject: [PATCH 14/17] chore(review-stack): enroll repository --- .github/workflows/review-stack-trufflehog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/review-stack-trufflehog.yml b/.github/workflows/review-stack-trufflehog.yml index 0ffca32..b2a710d 100644 --- a/.github/workflows/review-stack-trufflehog.yml +++ b/.github/workflows/review-stack-trufflehog.yml @@ -10,4 +10,4 @@ permissions: jobs: trufflehog: - uses: madmoneymike5/review-stack-control/.github/workflows/trufflehog.yml@v1 + uses: madmoneymike5/review-stack-runtime/.github/workflows/trufflehog.yml@v1 From 41243e7ab5a9b0c5f4a4b0a533a2813c98e69c33 Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 04:09:59 -0500 Subject: [PATCH 15/17] chore(review-stack): enroll repository --- .github/workflows/review-stack.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/review-stack.yml b/.github/workflows/review-stack.yml index ec13c6d..4865132 100644 --- a/.github/workflows/review-stack.yml +++ b/.github/workflows/review-stack.yml @@ -1,5 +1,5 @@ name: Review Stack -# review-stack-control: post-rollout verification against current v1 baseline +# review-stack-control: runtime mirror rollout verification on: pull_request: From aa4d33f0d105893d6f2ca57078c4ea62e6330bad Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 16:59:31 -0500 Subject: [PATCH 16/17] chore(review-stack): enroll repository --- .github/workflows/review-stack.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/review-stack.yml b/.github/workflows/review-stack.yml index 4865132..1e72467 100644 --- a/.github/workflows/review-stack.yml +++ b/.github/workflows/review-stack.yml @@ -16,3 +16,6 @@ jobs: native-command: >- git diff --check central-ref: v1 + opengrep-excludes: "" + gitleaks-excludes: |- + From 4adaf793a8dee71033958616830db44ac87c7fa4 Mon Sep 17 00:00:00 2001 From: madmoneymike5 Date: Sun, 6 Sep 2026 16:59:34 -0500 Subject: [PATCH 17/17] chore(review-stack): enroll repository --- .review-stack/coderabbit-review.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.review-stack/coderabbit-review.sh b/.review-stack/coderabbit-review.sh index 80966f3..a00827f 100644 --- a/.review-stack/coderabbit-review.sh +++ b/.review-stack/coderabbit-review.sh @@ -6,7 +6,7 @@ if command -v cr >/dev/null 2>&1; then elif command -v coderabbit >/dev/null 2>&1; then cli=coderabbit else - printf '%s\n' 'CodeRabbit CLI missing. Install: CI=1 curl -fsSL https://cli.coderabbit.ai/install.sh | sh' >&2 + printf '%s\n' 'CodeRabbit CLI missing. Install it through your organization-approved method, then rerun.' >&2 exit 127 fi