chore: update rhiza to v1.2.1 - #488
Conversation
|
Warning Review limit reached
Next review available in: 51 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (24)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Updates this repository to Rhiza template v1.2.1 and applies the upstream sync, bringing in updated GitHub workflows/rulesets plus refreshed project policy/docs and tooling pins.
Changes:
- Bump Rhiza template ref/lock to v1.2.1 and record synced file set changes.
- Update GitHub Actions wiring (pin reusable workflows to v1.2.1, add benchmark/mutation stubs, remove sync workflow).
- Refresh project docs/policy and developer tooling metadata (SECURITY policy expansion, PAT guidance, shell completions, pre-commit hook revs, rulesets).
Reviewed changes
Copilot reviewed 24 out of 25 changed files in this pull request and generated 5 comments.
Show a summary per file
| File | Description |
|---|---|
SECURITY.md |
Expands vulnerability reporting guidance and enumerates security measures. |
.rhiza/template.yml |
Bumps template ref to v1.2.1. |
.rhiza/template.lock |
Updates pinned template SHA, synced_at, and tracked template-managed files/profiles. |
.rhiza/rhiza.mk |
Simplifies Rhiza make entrypoints and included targets list. |
.rhiza/make.d/test.mk |
Refines security target commentary around bandit. |
.rhiza/make.d/releasing.mk |
Adds release-status/changelog helper targets. |
.rhiza/completions/rhiza-completion.zsh |
Removes BUMP variable completions. |
.rhiza/completions/rhiza-completion.bash |
Removes BUMP variable completions. |
.rhiza/completions/README.md |
Updates completion docs to match variable set (removes BUMP). |
.rhiza/.rhiza-version |
Removes rhiza version pin file. |
.pre-commit-config.yaml |
Updates pre-commit hook revisions (ruff/uv). |
.github/workflows/rhiza_weekly.yml |
Pins reusable weekly workflow to v1.2.1. |
.github/workflows/rhiza_sync.yml |
Removes template sync workflow. |
.github/workflows/rhiza_scorecard.yml |
Pins reusable scorecard workflow to v1.2.1. |
.github/workflows/rhiza_release.yml |
Updates release workflow notes and pins configure-git-auth action to v1.2.1. |
.github/workflows/rhiza_mutation.yml |
Adds opt-in mutation testing workflow wiring. |
.github/workflows/rhiza_marimo.yml |
Pins reusable marimo workflow to v1.2.1. |
.github/workflows/rhiza_fuzzing.yml |
Pins reusable fuzzing workflow to v1.2.1. |
.github/workflows/rhiza_codeql.yml |
Pins reusable CodeQL workflow to v1.2.1. |
.github/workflows/rhiza_ci.yml |
Pins reusable CI workflow to v1.2.1. |
.github/workflows/rhiza_book.yml |
Pins reusable book workflow to v1.2.1. |
.github/workflows/rhiza_benchmark.yml |
Adds benchmark workflow wiring on main pushes. |
.github/rulesets/tag-protection.json |
Adds tag protection ruleset export for v* tags. |
.github/rulesets/main-branch-protection.json |
Updates required status checks structure/metadata. |
.github/CONFIG.md |
Updates Actions secrets documentation (PAT_TOKEN section wording). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| 2. **Email** | ||
| - Send details to the repository maintainers | ||
| - Include "SECURITY" in the subject line |
| - **Acknowledgment**: We will acknowledge receipt within 48 hours | ||
| - **Initial Assessment**: We will provide an initial assessment within 7 days | ||
| - **Resolution Timeline**: We aim to resolve critical issues within 30 days | ||
| - **Credit**: We will credit reporters in the security advisory (unless you prefer to remain anonymous) |
| - **CodeQL**: Automated code scanning for Python and GitHub Actions | ||
| - **Bandit**: Python security linter integrated in CI and pre-commit | ||
| - **Secret Scanning**: GitHub secret scanning enabled on this repository | ||
| - **Fuzzing**: ClusterFuzzLite exercises Atheris-based fuzz targets on pull requests and scheduled batch runs |
| the token carries the `workflow` scope. If you need it, create a Personal Access | ||
| Token (PAT) with the `workflow` scope and store it as a repository secret named | ||
| `PAT_TOKEN`. | ||
|
|
||
| By default the workflow authenticates with the automatic `github.token`. That token **cannot push | ||
| changes to files under `.github/workflows/`** — GitHub rejects such pushes unless the token has the | ||
| `workflow` scope. Since template syncs regularly update workflow files, you should configure a | ||
| Personal Access Token (PAT) with that scope and store it as a repository secret named `PAT_TOKEN`. | ||
|
|
||
| If `PAT_TOKEN` is not configured, the workflow falls back to `github.token` and prints a warning. | ||
| Syncs that touch only non-workflow files will still succeed. | ||
| If `PAT_TOKEN` is not configured, workflows fall back to `github.token`. |
| readme \ | ||
| summarise-sync \ | ||
| sync \ | ||
| validate \ | ||
| version-matrix \ | ||
| ci-os-matrix |
Summary
reftov1.2.1in.rhiza/template.yml(wasv1.1.3)github-project(unchanged — matches thegithub.comremote)scripts/sync.pyto apply upstream template changes; conflicts resolved taking the upstream (theirs) sideQuality gates
make fmtmake typecheckty"All checks passed";mypy --strict"no issues found in 2 source files"make docs-coveragemake deptrymake securitybook/marimo/notebooksclean (exit 0)make testmake marimo-validatesrc/package; this is a marimo-notebook repo — tests DO mirrorbook/marimo/notebooks/1:1 (upstream checker assumption, not a local gap)Note: this repo uses the minimal
templates: [legal]profile and has no genericmake validatetarget;make marimo-validateis the structural gate.Scorecard
Scope: locally-owned items (
book/marimo/notebooks/,tests/,pyproject.toml,README.md,.rhiza/template.yml). Rhiza-managed infra (.github/workflows/*,Makefile,.pre-commit-config.yaml,ruff.toml, etc.) is upstream/out-of-scope.make fmtfully greenty+mypy --strictclean onoptimize.py,preamble.py; Experiments excluded by design, covered by Sharpe regression testspreamble.pyis the shared data layer; all Experiments +optimize.pydepend on it, no reverse imports, no cycles.optimize.py(352 LOC, MI 55.85) is the largest block, still grade Aoptimize.py/ reducemain()sizemake validatedrift gate, so full template-drift verification isn't available locallyOverall: ~9.7 / 10 — effectively a clean bill of health.
Highest-leverage improvement: none is blocking. The main friction is that the generic
src/-based test-layout checker cannot see this repo's notebook↔test mirroring — an upstream checker-assumption issue rather than a local defect.🤖 Generated with Claude Code