chore: polish employer portfolio - #2
Conversation
📝 WalkthroughWalkthroughAdds repository contribution, licensing, rights, and security policies. Introduces a Portfolio Integrity workflow that validates required documentation and social-preview image dimensions, then scans history for secrets with targeted snapshot exclusions. ChangesRepository integrity and governance
Estimated code review effort: 3 (Moderate) | ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/portfolio-integrity.yml (2)
16-19: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winOpt out of persisted checkout credentials.
This job does not need authenticated Git commands after checkout. Set
persist-credentials: falseto avoid writing the token into the checkout configuration. (github.com)Proposed fix
with: fetch-depth: 0 + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/portfolio-integrity.yml around lines 16 - 19, Update the actions/checkout@v4 step in “Checkout full history” to set persist-credentials to false alongside fetch-depth, preventing checkout credentials from being persisted for the remainder of the job.Source: Linters/SAST tools
8-10: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDisable Gitleaks PR comments or grant the required permission.
gitleaks-actionenables PR comments by default, but this workflow grants onlypull-requests: read. Keep least privilege by settingGITLEAKS_ENABLE_COMMENTS: 'false'unless inline comments are explicitly required; otherwise comment creation cannot succeed. (raw.githubusercontent.com)Proposed fix
env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITLEAKS_ENABLE_COMMENTS: 'false'Also applies to: 36-39
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/portfolio-integrity.yml around lines 8 - 10, Update the gitleaks-action configuration in the portfolio integrity workflow to set GITLEAKS_ENABLE_COMMENTS to 'false', preserving the existing least-privilege pull-requests: read permission and disabling PR comment creation.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/portfolio-integrity.yml:
- Around line 23-27: Update the required-documentation checks in the portfolio
integrity workflow to include a non-empty LICENSE file alongside README.md,
SECURITY.md, CONTRIBUTING.md, RIGHTS.md, and docs/social-preview.png.
- Around line 16-17: Upgrade the gitleaks/gitleaks-action step in the portfolio
integrity workflow from v2 to v3. Keep the existing secrets-scanning
configuration and checkout step unchanged.
---
Nitpick comments:
In @.github/workflows/portfolio-integrity.yml:
- Around line 16-19: Update the actions/checkout@v4 step in “Checkout full
history” to set persist-credentials to false alongside fetch-depth, preventing
checkout credentials from being persisted for the remainder of the job.
- Around line 8-10: Update the gitleaks-action configuration in the portfolio
integrity workflow to set GITLEAKS_ENABLE_COMMENTS to 'false', preserving the
existing least-privilege pull-requests: read permission and disabling PR comment
creation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 660dadb1-9c90-4741-be75-b92ecbd15240
⛔ Files ignored due to path filters (2)
docs/social-preview.pngis excluded by!**/*.pngdocs/social-preview.svgis excluded by!**/*.svg
📒 Files selected for processing (6)
.github/workflows/portfolio-integrity.yml.gitleaksignoreCONTRIBUTING.mdLICENSERIGHTS.mdSECURITY.md
| - name: Checkout full history | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
rg -n 'uses:\s*(actions/checkout|gitleaks/gitleaks-action)@' .github/workflowsRepository: NilhanHub/c-fit-ai
Length of output: 322
🏁 Script executed:
sed -n '1,120p' .github/workflows/portfolio-integrity.ymlRepository: NilhanHub/c-fit-ai
Length of output: 1210
🌐 Web query:
gitleaks/gitleaks-action v2 Node runtime v3 Node 24 checkout v4 Node runtime July 2026
💡 Result:
As of July 16, 2026, the status of Gitleaks-Action and its Node runtime requirements are as follows: Gitleaks-Action v3 is the current version, having been released to migrate the GitHub Actions runtime from Node 20 to Node 24 [1][2]. This migration was necessary due to GitHub's deprecation of the Node 20 runtime for GitHub Actions [2][3]. Timeline for Node 20 deprecation: June 2, 2026: GitHub switched the default runner to Node 24. Workflows still using Node 20 actions (like gitleaks-action v2) require the environment variable ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true to function [2][3][4]. September 16, 2026: Node 20 will be removed from GitHub-hosted runners entirely, at which point gitleaks-action v2 will stop working regardless of any opt-out flags [2][3][4]. For users, the recommended migration is to update to gitleaks-action v3 [1][3]. Additionally, it is recommended to update actions/checkout to v6, which aligns with the Node 24 runtime update [3][5]. Users of self-hosted runners must ensure their runner version is at least v2.327.1 to support the Node 24 runtime [2][3].
Citations:
- 1: https://github.com/gitleaks/gitleaks-action
- 2: https://github.com/gitleaks/gitleaks-action/releases/tag/v3.0.0
- 3: https://github.com/gitleaks/gitleaks-action/blob/master/README.md
- 4: chore: migrate to Node 24 runtime (v3) gitleaks/gitleaks-action#215
- 5: https://GitHub.Com/gitleaks/gitleaks-action
🌐 Web query:
actions/checkout v4 Node runtime v6 Node 24 GitHub Actions July 2026
💡 Result:
As of July 16, 2026, the status of GitHub Actions and the Node.js runtime environment is as follows: The actions/checkout v4 action is currently supported and compatible with the GitHub Actions runtime environment [1][2]. GitHub Actions runners have implemented support for Node.js 24 [3][4]. Migration and Enforcement: GitHub has been managing a transition from older Node.js versions to newer ones. By March 2026, GitHub merged enforcement mechanisms to require Node.js 24 for JavaScript-based actions [3], building on earlier infrastructure work that introduced Node.js 24 support in mid-2025 [4][5]. While Node.js 20 has been deprecated [6] and removed from runner images as of May 2026 [7], the platform provides mechanisms to handle environments where Node.js 24 might not be available, such as specific legacy architectures like Linux ARM32 [3][5]. Runner Environment: As of May 2026, the default Node.js version on GitHub Actions runner images has been updated to Node.js 22, with Node.js 20 removed [7]. Node.js 24 remains available for use within the Actions environment [8]. It is recommended to use the actions/setup-node action in workflows to explicitly manage and pin the required Node.js runtime version, ensuring consistent behavior across different runner environments [9][10].
Citations:
- 1: https://github.com/actions/checkout
- 2: https://github.com/marketplace/actions/checkout
- 3: Node 24 enforcement + Linux ARM32 deprecation support actions/runner#4303
- 4: Runner Support for executing Node24 Actions actions/runner#3940
- 5: Node 20 -> Node 24 migration feature flagging, opt-in and opt-out environment variables actions/runner#3948
- 6: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
- 7: actions/runner-images@2495626
- 8: https://github.com/actions/node-versions/releases
- 9: Update/Add NodeJS 24 actions/runner-images#12477
- 10: https://github.com/actions/setup-node
Upgrade gitleaks/gitleaks-action to v3. v2 still depends on Node 20, so the secrets scan will stop running once GitHub removes that runtime.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 16-19: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/portfolio-integrity.yml around lines 16 - 17, Upgrade the
gitleaks/gitleaks-action step in the portfolio integrity workflow from v2 to v3.
Keep the existing secrets-scanning configuration and checkout step unchanged.
| test -s README.md | ||
| test -s SECURITY.md | ||
| test -s CONTRIBUTING.md | ||
| test -s RIGHTS.md | ||
| test -s docs/social-preview.png |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
Add LICENSE to the required-documentation gate.
LICENSE is introduced by this PR but is not checked here. A later change could remove or empty it while the integrity workflow remains green.
Proposed fix
test -s CONTRIBUTING.md
test -s RIGHTS.md
+ test -s LICENSE
test -s docs/social-preview.png📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| test -s README.md | |
| test -s SECURITY.md | |
| test -s CONTRIBUTING.md | |
| test -s RIGHTS.md | |
| test -s docs/social-preview.png | |
| test -s README.md | |
| test -s SECURITY.md | |
| test -s CONTRIBUTING.md | |
| test -s RIGHTS.md | |
| test -s LICENSE | |
| test -s docs/social-preview.png |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/portfolio-integrity.yml around lines 23 - 27, Update the
required-documentation checks in the portfolio integrity workflow to include a
non-empty LICENSE file alongside README.md, SECURITY.md, CONTRIBUTING.md,
RIGHTS.md, and docs/social-preview.png.
2 participants
What changed
Verification
Risk and rollback
Documentation, repository policy, and CI only unless the diff explicitly contains a verified tooling repair. Revert this PR to roll back.
Summary by CodeRabbit
New Features
Documentation
Chores