build: pin slopless to v1.13.0 - #17
Merged
Merged
Conversation
The rules now read .tsx: 39 of 150 becomes 97. No commit ever decided that .tsx was out — the rules were written with `ts` in 1.0.0, `astro` was added to many of them in 1.12.0, and `tsx` was never revisited. long-line-limit stays out of .tsx on purpose: over 525 .tsx and 716 .ts files from the same repositories, lines past 120 characters run 8.0 per .tsx file against 0.7 per .ts. That is JSX, not a difference in how the code was written. Also in this range, and applying to every language: VBC-901 stops reporting the address ranges RFC 5737 reserves for documentation and anything starting with 255, which is reserved space and so a netmask rather than a host; VBC-001 gained the test-file exclusion every comparable rule already had and stopped reading TOKEN_ADDRESS as a credential; VBC-080 stopped reporting a method declaration named alert; and framework build caches inside the source tree are no longer read. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟢 Approval recommended
The action pin is updated to a commit SHA that matches the upstream v1.13.0 tag target commit and introduces no other behavioral changes in this repo.
Pull request overview
Pins the fabriziosalmi/slopless GitHub Action used by this repository’s slopless workflow to the v1.13.0 release commit, continuing the existing supply-chain practice of using immutable SHAs.
Changes:
- Update
fabriziosalmi/sloplessaction reference fromv1.12.1SHA tov1.13.0SHA in the slopless workflow.
File summaries
| File | Description |
|---|---|
| .github/workflows/slopless.yml | Updates the pinned slopless Action SHA to v1.13.0 for the workflow run. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pin bump to
v1.13.0.The rules now read
.tsx: 39 of 150 becomes 97. No commit ever decided.tsxwas out — the rules were written withtsin 1.0.0,astrowas added to many of them in 1.12.0, andtsxwas never revisited. It was measured across 525.tsxfiles before being turned on.long-line-limitstays out of.tsxon purpose, and the number is the reason: over 525.tsxand 716.tsfiles from the same repositories, lines past 120 characters run 8.0 per.tsxfile against 0.7 per.ts. That is JSX — aclassNamestring and three props on one tag — not a difference in how the code was written.Everything else in this range only ever removed reports:
VBC-901stops reporting the ranges RFC 5737 reserves for documentation (192.0.2.0/24,198.51.100.0/24,203.0.113.0/24), and anything starting with255, which is reserved space and so a netmask rather than a host.VBC-001gained the test-file exclusion every comparable rule already had, and stopped readingTOKEN_ADDRESS = '0x…'as a credential — an address is public by construction.VBC-080stopped reportingalert(text: string): void {, which is a method declaration.VBC-944andVBC-921stopped reporting the fix they ask for: anhrefbuilt fromimport.meta.env, and a copyright range whose end is generated at build time..vitepress/cache/,.astro/,.svelte-kit/,.nuxt/,__pycache__/and the rest — are no longer read.The check runs on this PR, so whether the count moved is visible below rather than asserted.
🤖 Generated with Claude Code