[rishitank]

Why

This brings holocron in line with the shared CI in rishitank/.github:

• a secrets scan over the full git history and an osv-scanner dependency check (CodeQL and npm audit don't cover these);
• actionlint on workflow changes;
• the house Renovate preset in place of the deprecated config:base.

It also clears every open osv advisory.

What changed

• .github/workflows/security.yml (new). Calls rishitank/.github/.github/workflows/security.yml@v1 with ecosystem: node: osv-scanner, gitleaks (full history) and an advisory npm audit. The existing CodeQL, npm-audit and dependency-review jobs in ci.yml are unchanged.
• .github/workflows/workflows-lint.yml (new). Shared actionlint. Runs when .github/workflows/** changes.
• renovate.json:
  • config:base → github>rishitank/.github:node.
  • The deprecated matchPackagePatterns → regex matchPackageNames. Both custom packageRules are kept.

Fixes in this PR

• Lockfile refresh within the declared ranges (ed5ae35, on a runner). Clears hono, ip-address, js-yaml, minimatch, nanoid, path-to-regexp, picomatch, postcss, proxy-addr, qs, rollup, sharp, source-map-js and vite. tsup's esbuild is overridden to ^0.28.1 for GHSA-g7r4-m6w7-qqqr (dd460ba).
• Majors that only an upgrade fixes (226c171; lock regenerated on a runner in a5e9414; one-shot workflow removed in cc84cbd):
  • simple-git ^4.0.2. Fixes GHSA-858h-whjf-mvg5, GHSA-g4wm-2vf7-vfgr, GHSA-x6jw-m9v5-85vh and @simple-git/argv-parser GHSA-v5rq-49vh-5v5c. Supersedes fix(deps): update dependency simple-git to v4 - autoclosed #85 and chore(deps): bump simple-git from 3.36.0 to 4.0.2 #91.
  • vitest and @vitest/coverage-v8 ^4.1.11, moved together. Fixes GHSA-82fw-gwwq-j7x9 and the vitest-3 tinypool advisories. Supersedes chore(deps): update dependency vitest to v4 [security] - autoclosed #74 and chore(deps): update dependency @vitest/coverage-v8 to v5 - autoclosed #82, which each bumped only one half and failed. A Renovate rule now groups the vitest family.
  • @eslint/js ^9.39.5 declared explicitly. eslint.config imports it, but it was only reachable through ESLint 9. ESLint 10 (chore(deps): update eslint monorepo to v10 #83) stops shipping it, so declaring it is the first step for that major.
  • TypeScript 7 hold. A Renovate packageRules hold on typescript majors (chore(deps): update dependency typescript to v7 - autoclosed #84). typescript-eslint doesn't yet support TS 7.

All checks pass on cc84cbd: CI (Lint, Type Check, Test on vitest 4, Build, CodeQL, Security Audit, Dependency Review), security (Secrets, Vulnerable dependencies, Ecosystem audit) and actionlint.

Overlap with #71

#71 (Dependabot → Renovate migration) also rewrites renovate.json. Whichever PR lands second will need a rebase on that file. #71 is not touched here.

Not in this PR

Code-scanning alert #27 (js/path-injection, src/context/fileIndexer.ts:200, resolveRoot) resolves a user-chosen index root by design. Fixing it needs a product decision: either restrict indexable roots to an allowlist (for example the workspace or $HOME), or dismiss the alert as intended behaviour.

🤖 Generated with Claude Code

https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5f6ea405-6bff-471e-89df-12194e0423e4

📥 Commits

Reviewing files that changed from the base of the PR and between 8b2d6ae and cc84cbd.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• package.json
• renovate.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🔇 Additional comments (3)

package.json (2)

45-45: LGTM!

Also applies to: 53-53, 64-67

---

55-55: 🩺 Stability & Availability

Vitest 4 meets the runtime requirements, Apprentice.

The project uses Node.js 25 and Vite 8.3.4. Both satisfy the Vitest 4 requirements. The rebel-scum concern is refuted.

renovate.json (1)

22-32: LGTM!

---

📝 Summary

Summary by CodeRabbit

• Chores
  • Added automated security checks that run on pushes to the main branch, pull requests, weekly, and when manually started.
  • Added validation of workflow changes on pull requests and pushes to the main branch, with manual runs also available.
  • Updated dependency update settings for selected packages, retaining automatic merging for eligible minor and patch updates and grouping related test-tool updates.

Walkthrough

Adds security and workflow-lint GitHub Actions workflows. Updates package dependency versions and Renovate rules.

Changes

Workflow automation

Layer / File(s)	Summary
Security workflow triggers and call .github/workflows/security.yml	Adds push, pull-request, weekly schedule and manual triggers. Groups runs by Git ref, cancels superseded runs, grants read-only contents permission and calls the shared security workflow for the Node ecosystem.
Workflow lint triggers and call .github/workflows/workflows-lint.yml	Adds pull-request and main-push triggers filtered to workflow files, plus manual dispatch. Grants read-only contents permission and calls the shared workflow-lint workflow.

Dependency updates

Layer / File(s)	Summary
Package versions and override package.json	Updates simple-git, vitest and @vitest/coverage-v8 ranges. Adds @eslint/js and an esbuild override beneath tsup.
Renovate preset and update rules renovate.json	Uses the shared Node preset and slash-delimited matchPackageNames regular expressions for six package prefixes. Adds a rule that disables major TypeScript updates and a rule that groups Vitest updates. Automerge remains enabled for matched minor and patch updates.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to cc84c

No actionable merge-blocking risk remains in the reviewed changes; the PR is mergeable after normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly summarises the main changes: shared security and workflow linting, Renovate updates, and dependency upgrades.
Description check		The description directly explains the workflow, Renovate, dependency, security, and scope changes in the pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Apprentice, workflows awaken on schedule and change.
Package versions march beneath the Node preset.
Renovate sorts each update into its path.
The Dark Side keeps the rules in line.
The rebel scum of drift shall not prevail.}

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🔇 Additional comments (3)

renovate.json (1)

3-3: LGTM!

Also applies to: 7-13

.github/workflows/security.yml-22-22 (1)

22-22: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Apprentice, pin the reusable workflow to an immutable commit SHA.

The @v1 tag can move. A moved tag can make this security job execute changed workflow code without a reviewed change here. Replace @v1 with a full commit SHA; otherwise the scan’s supply-chain boundary remains vulnerable to rebel scum. Based on learnings, CI/CD reusable workflows must use immutable commit SHAs rather than mutable tags. (raw.githubusercontent.com)

Sources: Learnings, Linters/SAST tools

.github/workflows/workflows-lint.yml-18-18 (1)

18-18: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Apprentice, pin the reusable workflow to a full commit SHA.

The @v1 tag is mutable. If it moves, later lint runs can execute different workflow code without a change in this repository. Replace @v1 with the full SHA of the reviewed revision. As per the retrieved learning, third-party reusable workflows must use immutable commit references. The zizmor diagnostic also identifies this unpinned reference. Do not let this rebel scum change the lint run.

Sources: Learnings, Linters/SAST tools

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: a9d9e73a-ab2e-4674-ad7a-c0a2e1b9c566

📥 Commits

Reviewing files that changed from the base of the PR and between 5f380ea and 8b2d6ae.

📒 Files selected for processing (3)

• .github/workflows/security.yml
• .github/workflows/workflows-lint.yml
• renovate.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Review details

⏰ Context from checks skipped due to timeout. (8)

• GitHub Check: security / Vulnerable dependencies
• GitHub Check: security / Secrets
• GitHub Check: security / Ecosystem audit
• GitHub Check: CodeQL
• GitHub Check: Lint
• GitHub Check: Security Audit
• GitHub Check: Test
• GitHub Check: Type Check

⚠️ CI failures not shown inline (2)

GitHub Actions: security / 2_security _ Ecosystem audit.txt: ci: shared security scan, actionlint and house Renovate preset

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mcase "${ECOSYSTEM}" in�[0m
 �[36;1m  node)�[0m
 �[36;1m    npm audit --audit-level="${AUDIT_LEVEL}"�[0m
 �[36;1m    ;;�[0m
 �[36;1m  python)�[0m
 �[36;1m    pip install pip-audit�[0m
 �[36;1m    if [ -f requirements.txt ]; then�[0m
 �[36;1m      pip-audit -r requirements.txt�[0m
 �[36;1m    else�[0m
 �[36;1m      pip install -e .�[0m
 �[36;1m      pip-audit�[0m
 �[36;1m    fi�[0m
 �[36;1m    ;;�[0m
 �[36;1m  rust)�[0m
 �[36;1m    cargo install cargo-audit --locked�[0m
 �[36;1m    cargo audit�[0m
 �[36;1m    ;;�[0m
 �[36;1m  *)�[0m
 �[36;1m    echo "::error title=Unknown ecosystem::'${ECOSYSTEM}' is not one of node, python, rust, none."�[0m

---

GitHub Actions: security / security _ Ecosystem audit: ci: shared security scan, actionlint and house Renovate preset

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mcase "${ECOSYSTEM}" in�[0m
 �[36;1m  node)�[0m
 �[36;1m    npm audit --audit-level="${AUDIT_LEVEL}"�[0m
 �[36;1m    ;;�[0m
 �[36;1m  python)�[0m
 �[36;1m    pip install pip-audit�[0m
 �[36;1m    if [ -f requirements.txt ]; then�[0m
 �[36;1m      pip-audit -r requirements.txt�[0m
 �[36;1m    else�[0m
 �[36;1m      pip install -e .�[0m
 �[36;1m      pip-audit�[0m
 �[36;1m    fi�[0m
 �[36;1m    ;;�[0m
 �[36;1m  rust)�[0m
 �[36;1m    cargo install cargo-audit --locked�[0m
 �[36;1m    cargo audit�[0m
 �[36;1m    ;;�[0m
 �[36;1m  *)�[0m
 �[36;1m    echo "::error title=Unknown ecosystem::'${ECOSYSTEM}' is not one of node, python, rust, none."�[0m

🧰 Additional context used

🪛 zizmor (1.30.1)

.github/workflows/security.yml

[error] 22-22: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

.github/workflows/workflows-lint.yml

[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

[rishitank]

Self-review by Claude

Read the changes in full, and CI was green. No issues found.