Publish packages under @codraoss, enforce the precision gates, and add per-language + secondary-reviewer config - #90
Conversation
…c npm publishing Add LICENSE/README, tsup build configs, and publishConfig.exports to each publishable package (api, core, db, models, provider-github, schema, ui), wire up changesets for versioning/release, and add check-package-exports/swap-publish-exports scripts plus CI validation (build, publint, exports check). Also hardens CLA check to verify every commit author in a PR, not just the opener.
…back chain Adds `full_file_context` config to feed a validated post-change file into review prompts, plus `review_breadth` to decouple pipeline findings from the posted comment cap. Also adds truncation salvage and per-rung timeout budgeting to the model fallback chain.
Condenses multi-line comments to one-liners (or drops redundant ones); no behavior changes.
…, track degraded reviews Enforces two previously logged-only signals: findings whose evidence only appears on untouched context lines, and absence claims refuted by finding the identifier in the file. Fixes LLM dedupe key to include path/anchor. Adds per-language severity/confidence overrides and an optional secondary reviewer whose findings are unioned with the primary's, never voted on. Extends full_file_context to fragmented diffs. Adds migration 004 for degraded/reviewer_model columns and a skip reason on verifyFindings, so degraded or unverified reviews are queryable.
reviewFile sizes its output budget from reviewBreadth (25 by default), but the chunking spec still computed it from generatorFindingCap(max_comments) (20), so the thinking-budget assertion expected 2048 and got 2165. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
fae1323 to
4fcf9d3
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![codra-app-personal[bot]](https://avatars.githubusercontent.com/in/3347243?s=60&v=4){kind=small}
There was a problem hiding this comment.
Codra Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4fcf9d3760
ℹ️ About Codra in GitHub
Your team has set up Codra to review pull requests in this repo. Reviews are triggered when you:
- Open a pull request for review
- Mark a draft as ready
- Comment "@codra-app review"
If Codra has suggestions, it will comment; otherwise it will react with 👍.
Codra can also answer questions or update the PR. Try commenting "@codra-app address that feedback".
There was a problem hiding this comment.
Codra Review
✅ Nothing to flag. Reviewed 88 files (3098 changed lines) and found no issues worth raising.
Reviewed commit: 9769f99704
ℹ️ About Codra in GitHub
Your team has set up Codra to review pull requests in this repo. Reviews are triggered when you:
- Open a pull request for review
- Mark a draft as ready
Every review posts a summary here. A clean pass also gets a 👍 on the pull request itself.
There was a problem hiding this comment.
Codra Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9769f99704
ℹ️ About Codra in GitHub
Your team has set up Codra to review pull requests in this repo. Reviews are triggered when you:
- Open a pull request for review
- Mark a draft as ready
If Codra has suggestions, it will comment; otherwise it will react with 👍.
| 'x-github-api-version': '2022-11-28', | ||
| }; | ||
| const unmatched = []; | ||
| for (let page = 1; page <= 3; page++) { |
There was a problem hiding this comment.
The script iterates over commit pages with a hardcoded limit of 3 (maximum 300 commits). This prevents the CLA check from verifying authors of commits beyond the 300th commit in a large Pull Request, potentially allowing unverified contributions. The loop condition should be unbounded and rely solely on the check for the last page of results.
| for (let page = 1; page <= 3; page++) { | |
| for (let page = 1; ; page++) { |
| "sideEffects": false, | ||
| "exports": { | ||
| ".": "./src/index.ts", | ||
| "./client": "./src/client.ts", |
There was a problem hiding this comment.
The default export path . (which typically points to index.ts) has been removed from the top-level exports field and is not present in the new publishConfig.exports. This means consumers who previously used import '@codraoss/db' or require('@codraoss/db') will now experience a module resolution error, as they will need to switch to specific subpath imports like import '@codraoss/db/client'. While the PR mentions 'Breaking change', this specific breaking change might impact many existing integrations and warrants clear communication.
| continue; | ||
| } | ||
|
|
||
| const srcKeys = Object.keys(exp).sort(); |
There was a problem hiding this comment.
Unlike the author's intent to validate package exports robustly across packages, calling Object.keys() on a string-form package.json exports field treats the string as an array of character indices rather than an export mapping, causing validation to break for packages using string shorthand exports.
codra-app-personal
Bot
added
review: needs-attention
and removed
review: approved
labels
1 participant
Description
Two things bundled together since they ended up touching the same files.
Publishing: renamed
@codrato@codraoss, added LICENSE/README/tsup configto each package, wired up changesets, and added CI checks (build, publint,
export map validation) so a broken package fails the PR instead of the
publish. CLA check now checks every commit author, not just the opener.
Precision: two previously logged-only signals are now enforced (evidence on
untouched lines, refuted absence claims), the dedupe key bug is fixed, and
review config gained per-language overrides plus an optional secondary
reviewer (unioned, not voted). Added a migration for tracking degraded
reviews.
Closes #66 #74 #76
Type of change
Breaking: package scope rename, and the new gates will drop some findings
that used to get posted.
How Has This Been Tested?
npm test,npm run typecheck,npm run lint. New specs for the blamegate, dedupe, language gates/thresholds, fragmented packing, and the
secondary reviewer. Package build verified via
npm run build:packagespluspublint and the export check; no dry-run publish to the real registry.
Checklist: