build: Bootstrap agent-ready infrastructure - #79
Conversation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @dahlem, your pull request is larger than the review limit of 150000 diff characters
📝 WalkthroughWalkthroughThe pull request introduces governance, quality assurance, and developer experience infrastructure. It adds AgentReady assessment reports, GitHub workflows for testing/security/assessment, issue/PR templates, pre-commit hooks configuration, CODEOWNERS mappings, and contribution guidelines—standardizing development practices without modifying core application code. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~15 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🤖 AgentReady Assessment ReportRepository: guardrails-detectors 📊 Summary
Languages Detected
Repository Stats
🎯 Priority ImprovementsFocus on these high-impact fixes first:
📋 Detailed FindingsFindings sorted by priority (Tier 1 failures first, then Tier 2, etc.)
📝 Remediation StepsMeasured: missing (Threshold: present) Evidence:
Create CLAUDE.md or AGENTS.md with project-specific configuration for AI coding assistants
Commands: # Option 1: Standalone CLAUDE.md
touch CLAUDE.md
# Add content describing your project
# Option 2: Symlink CLAUDE.md to AGENTS.md
touch AGENTS.md
# Add content to AGENTS.md
ln -s AGENTS.md CLAUDE.md
# Option 3: @ reference in CLAUDE.md
echo '@AGENTS.md' > CLAUDE.md
touch AGENTS.md
# Add content to AGENTS.mdExamples: Coding Standards
CLAUDE.md with @ reference (Option 3)@AGENTS.md AGENTS.md (shared by multiple tools)Project OverviewThis project implements a REST API for user management. Architecture
Development Workflow# Setup
python -m venv .venv
source .venv/bin/activate
pip install -e .
# Run tests
pytest
# Start server
uvicorn app.main:app --reloadCode Conventions
📝 Remediation StepsMeasured: 1/2 directories (Threshold: 2/2 directories) Evidence:
Organize code into standard directories (src/, tests/, docs/)
Commands: mkdir -p src tests docs
# Move source files to src/
# Move test files to tests/
📝 Remediation StepsMeasured: 46.1% (Threshold: ≥80%) Evidence:
Add type annotations to function signatures
Commands: # Python
pip install mypy
mypy --strict src/
# TypeScript
npm install --save-dev typescript
echo '{"compilerOptions": {"strict": true}}' > tsconfig.jsonExamples:
📝 Remediation StepsMeasured: not configured (Threshold: configured with >80% threshold) Evidence:
Configure test coverage with ≥80% threshold
Commands: # Python
pip install pytest-cov
pytest --cov=src --cov-report=term-missing --cov-fail-under=80
# JavaScript
npm install --save-dev jest
npm test -- --coverage --coverageThreshold='{\'global\': {\'lines\': 80}}'Examples:
📝 Remediation StepsMeasured: not configured (Threshold: configured) Evidence:
Configure conventional commits with commitlint
Commands: npm install --save-dev @commitlint/cli @commitlint/config-conventional husky
📝 Remediation StepsMeasured: multi-step setup (Threshold: single command) Evidence:
Create single-command setup for development environment
Commands: # Example Makefile
cat > Makefile << 'EOF'
.PHONY: setup
setup:
python -m venv venv
. venv/bin/activate && pip install -r requirements.txt
pre-commit install
cp .env.example .env
@echo 'Setup complete! Run make test to verify.'
EOFExamples: Examples:
📝 Remediation StepsMeasured: 53 lines, 8 headings, 6 bullets (Threshold: <500 lines, structured format) Evidence:
Make documentation more concise and structured
Commands: # Check README length
wc -l README.md
# Count headings
grep -c '^#' README.mdExamples: Features
DocumentationSee docs/ for detailed guides. Bad: Verbose proseThis project is a tool that helps you assess your repository [Many more paragraphs of prose...] Missing patterns:*.swp Examples: Examples:
📝 Assessment Metadata
🤖 Generated with Claude Code |
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Fix all issues with AI agents
In @.agentready/report-20260212-110049.md:
- Around line 4-8: The report file .agentready/report-20260212-110049.md
contains machine-specific strings: the local filesystem path
`/Users/ddahlem/Documents/repos/trusty/trustyai-explainability/guardrails-detectors`
and the hostname/user `ddahlem@ddahlem-mac`; edit that file to redact or replace
those occurrences with non-identifying placeholders (e.g., /REDACTED/REPO_PATH
and <REDACTED_USER>@<REDACTED_HOST>) or use relative paths, and update the
report generation step (the AgentReady/config or logging routine that writes the
report) to avoid emitting absolute home-directory paths and usernames going
forward.
In @.github/CODEOWNERS:
- Line 13: The CODEOWNERS entry uses the placeholder handle "@owner" which will
be ignored; replace "@owner" with a valid GitHub user or org/team reference (for
example "@trustyai-explainability/maintainers" or a specific maintainer handle)
so automatic reviewer assignment works; update the single line containing "*
`@owner`" to "* @<real-username-or-org/team>" ensuring the chosen handle
exists in your org.
In @.github/workflows/security.yml:
- Around line 51-53: The "Run safety check" step currently appends "|| true" to
the command "safety check --json || true", which masks any findings; remove the
"|| true" and instead set the step-level option continue-on-error: true to allow
the job to continue while surfacing a warning, and add an artifacts upload of
the JSON output (from "safety check --json") so results are preserved for
review; update the step that runs "safety check --json" and add a subsequent
artifact upload step that saves the JSON output.
In @.github/workflows/tests.yml:
- Around line 46-50: The "Upload coverage to Codecov" step has malformed YAML
because the if: condition is merged with the with: block and the if condition
checks for '3.11' which doesn't exist in the matrix; update the "Upload coverage
to Codecov" step (name: "Upload coverage to Codecov") so that if: is on its own
properly indented line above with:, for example if: matrix.python-version ==
'3.12' (or change to include the actual matrix values, e.g.,
matrix.python-version == '3.12' || matrix.python-version == '3.13'), and ensure
the with: block remains indented under the step with files: ./coverage.xml and
fail_ci_if_error: false.
In `@CODE_OF_CONDUCT.md`:
- Around line 29-31: The Enforcement paragraph under the "Enforcement" header is
vague about how to report incidents; update the paragraph to include a concrete
reporting channel by adding a specific contact (e.g., a dedicated email address)
or a link to a reporting form/URL so contributors know where to submit
complaints; edit the text that currently reads "reported to the project team" to
include the chosen contact method and any brief submission guidance (what to
include) for clarity.
In `@CONTRIBUTING.md`:
- Around line 21-24: Update the example git clone instructions by replacing the
generic placeholders YOUR_USERNAME and PROJECT_NAME with instructions to use the
actual repository clone URL (or provide a template that indicates to substitute
their GitHub username and the real project repo name), e.g., clarify in the
markdown code block that contributors should run the real clone command for the
repo instead of the placeholders so the lines containing `git clone
https://github.com/YOUR_USERNAME/PROJECT_NAME.git` and `cd PROJECT_NAME` are
updated or annotated accordingly.
🧹 Nitpick comments (5)
.agentready/report-latest.md (1)
1-1: Missing trailing newline.POSIX text files should end with a newline. This can cause issues with some tools that read the file content (e.g.,
catconcatenation,readin shell scripts)..github/ISSUE_TEMPLATE/bug_report.md (1)
15-20: Reproduction steps boilerplate is web-UI oriented.The placeholder steps ("Click on", "Scroll down") are geared toward web applications. Since this is a Python library, consider updating the boilerplate to something more relevant, e.g.:
-1. Go to '...' -2. Click on '....' -3. Scroll down to '....' -4. See error +1. Install version '...' +2. Run the following code: '...' +3. Observe error/output: '...'CONTRIBUTING.md (1)
95-101: Add language identifiers to fenced code blocks.Lines 95 and 113 use fenced code blocks without a language specifier. Adding e.g.
```textsatisfies markdownlint (MD040) and enables syntax highlighting.Also applies to: 113-119
.github/workflows/agentready-assessment.yml (1)
42-63: PR comment is created on every trigger, leading to duplicate comments.Each
synchronizeevent (i.e., every push to the PR branch) posts a new comment. Consider finding and updating an existing comment instead — e.g., search for a marker string and useupdateCommentwhen found.Sketch of find-or-update approach
script: | const fs = require('fs'); const reportPath = '.agentready/report-latest.md'; if (!fs.existsSync(reportPath)) { console.log('No report found'); return; } const report = fs.readFileSync(reportPath, 'utf8'); + const marker = '<!-- agentready-assessment -->'; + const body = marker + '\n' + report; + + const { data: comments } = await github.rest.issues.listComments({ + issue_number: context.issue.number, + owner: context.repo.owner, + repo: context.repo.repo, + }); + const existing = comments.find(c => c.body.includes(marker)); + + if (existing) { + await github.rest.issues.updateComment({ + comment_id: existing.id, + owner: context.repo.owner, + repo: context.repo.repo, + body, + }); + } else { + await github.rest.issues.createComment({ + issue_number: context.issue.number, + owner: context.repo.owner, + repo: context.repo.repo, + body, + }); + } - - // Post comment with assessment results - await github.rest.issues.createComment({ - issue_number: context.issue.number, - owner: context.repo.owner, - repo: context.repo.repo, - body: report - });.pre-commit-config.yaml (1)
1-36: Update pre-commit hook versions — all pinned revisions are ~2 years old.Current versions are significantly outdated. Ruff has progressed from v0.1.14 to v0.15.0, Black from 24.1.1 to 26.1.0, isort from 5.13.2 to 7.0.0, and pre-commit-hooks from v4.5.0 to v6.0.0. Run
pre-commit autoupdateto bring all hooks to their latest versions.
| **Path**: `/Users/ddahlem/Documents/repos/trusty/trustyai-explainability/guardrails-detectors` | ||
| **Branch**: `main` | **Commit**: `e8e6c407` | ||
| **Assessed**: February 12, 2026 at 11:00 AM | ||
| **AgentReady Version**: 2.27.0 | ||
| **Run by**: ddahlem@ddahlem-mac |
There was a problem hiding this comment.
Report contains local filesystem paths and machine-specific identifiers.
Lines 4 and 8 expose the developer's home directory path and local hostname (/Users/ddahlem/..., ddahlem@ddahlem-mac). Since this file is committed to the repository, consider redacting or omitting machine-specific details from checked-in reports.
🧰 Tools
🪛 LanguageTool
[style] ~6-~6: Some style guides suggest that commas should set off the year in a month-day-year date.
Context: ...: e8e6c407 Assessed: February 12, 2026 at 11:00 AM AgentReady Version: 2.2...
(MISSING_COMMA_AFTER_YEAR)
🤖 Prompt for AI Agents
In @.agentready/report-20260212-110049.md around lines 4 - 8, The report file
.agentready/report-20260212-110049.md contains machine-specific strings: the
local filesystem path
`/Users/ddahlem/Documents/repos/trusty/trustyai-explainability/guardrails-detectors`
and the hostname/user `ddahlem@ddahlem-mac`; edit that file to redact or replace
those occurrences with non-identifying placeholders (e.g., /REDACTED/REPO_PATH
and <REDACTED_USER>@<REDACTED_HOST>) or use relative paths, and update the
report generation step (the AgentReady/config or logging routine that writes the
report) to avoid emitting absolute home-directory paths and usernames going
forward.
| # /.github/ @devops-team | ||
|
|
||
| # Default: assign to repository owner | ||
| * @owner No newline at end of file |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/CODEOWNERSRepository: trustyai-explainability/guardrails-detectors
Length of output: 515
🏁 Script executed:
# Check if there are any references to maintainers, teams, or users elsewhere
rg -i "maintainer|owner|reviewer" . --type md --type txt --type yaml -A 2 | head -50Repository: trustyai-explainability/guardrails-detectors
Length of output: 684
🏁 Script executed:
# Look for GitHub team or user configuration in the repo
find . -name "*.md" -o -name "*.yml" -o -name "*.yaml" | xargs grep -l "github\|team" 2>/dev/null | head -10Repository: trustyai-explainability/guardrails-detectors
Length of output: 465
@owner is a placeholder and will not assign reviewers.
Line 13 uses @owner, which is neither a valid GitHub username nor a team reference in the @org/team format. GitHub silently ignores unresolved handles in CODEOWNERS, meaning no automatic review requests will be made despite the CONTRIBUTING.md requiring maintainer approval. Replace it with an actual GitHub user handle or team reference (e.g., @trustyai-explainability/maintainers if that team exists, or the specific maintainer handle).
🤖 Prompt for AI Agents
In @.github/CODEOWNERS at line 13, The CODEOWNERS entry uses the placeholder
handle "@owner" which will be ignored; replace "@owner" with a valid GitHub user
or org/team reference (for example "@trustyai-explainability/maintainers" or a
specific maintainer handle) so automatic reviewer assignment works; update the
single line containing "* `@owner`" to "*
@<real-username-or-org/team>" ensuring the chosen handle exists in your org.
| - name: Run safety check | ||
| run: | | ||
| safety check --json || true |
There was a problem hiding this comment.
|| true silences all security findings — vulnerabilities will never fail the build or surface visibly.
Using || true makes the step always succeed, so discovered vulnerabilities are effectively invisible. Consider using continue-on-error: true at the step level instead (the job badge will show a warning), or upload the JSON output as an artifact so findings are at least reviewable.
Suggested improvement
- name: Run safety check
+ continue-on-error: true
run: |
- safety check --json || true
+ safety check --json --output safety-report.json
+
+ - name: Upload safety report
+ if: always()
+ uses: actions/upload-artifact@v4
+ with:
+ name: safety-report
+ path: safety-report.json
+ retention-days: 30📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Run safety check | |
| run: | | |
| safety check --json || true | |
| - name: Run safety check | |
| continue-on-error: true | |
| run: | | |
| safety check --json --output safety-report.json | |
| - name: Upload safety report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: safety-report | |
| path: safety-report.json | |
| retention-days: 30 |
🤖 Prompt for AI Agents
In @.github/workflows/security.yml around lines 51 - 53, The "Run safety check"
step currently appends "|| true" to the command "safety check --json || true",
which masks any findings; remove the "|| true" and instead set the step-level
option continue-on-error: true to allow the job to continue while surfacing a
warning, and add an artifacts upload of the JSON output (from "safety check
--json") so results are preserved for review; update the step that runs "safety
check --json" and add a subsequent artifact upload step that saves the JSON
output.
| - name: Upload coverage to Codecov | ||
| uses: codecov/codecov-action@v4 | ||
| if: matrix.python-version == '3.11' with: | ||
| files: ./coverage.xml | ||
| fail_ci_if_error: false |
There was a problem hiding this comment.
YAML syntax error on Line 48 — workflow will fail to load.
if: and with: are merged onto the same line, which is invalid YAML (confirmed by both YAMLlint and actionlint). Additionally, the condition references '3.11' but the matrix only contains '3.12' and '3.13', so the Codecov step would never execute even after fixing the syntax.
Proposed fix
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v4
-if: matrix.python-version == '3.11' with:
+ if: matrix.python-version == '3.12'
+ with:
files: ./coverage.xml
fail_ci_if_error: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v4 | |
| if: matrix.python-version == '3.11' with: | |
| files: ./coverage.xml | |
| fail_ci_if_error: false | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v4 | |
| if: matrix.python-version == '3.12' | |
| with: | |
| files: ./coverage.xml | |
| fail_ci_if_error: false |
🧰 Tools
🪛 actionlint (1.7.10)
[error] 48-48: could not parse as YAML: mapping values are not allowed in this context
(syntax-check)
🪛 YAMLlint (1.38.0)
[error] 48-48: syntax error: mapping values are not allowed here
(syntax)
🤖 Prompt for AI Agents
In @.github/workflows/tests.yml around lines 46 - 50, The "Upload coverage to
Codecov" step has malformed YAML because the if: condition is merged with the
with: block and the if condition checks for '3.11' which doesn't exist in the
matrix; update the "Upload coverage to Codecov" step (name: "Upload coverage to
Codecov") so that if: is on its own properly indented line above with:, for
example if: matrix.python-version == '3.12' (or change to include the actual
matrix values, e.g., matrix.python-version == '3.12' || matrix.python-version ==
'3.13'), and ensure the with: block remains indented under the step with files:
./coverage.xml and fail_ci_if_error: false.
| ## Enforcement | ||
|
|
||
| Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project team. All complaints will be reviewed and investigated promptly and fairly. |
There was a problem hiding this comment.
Enforcement section lacks a concrete reporting channel.
"Reported to the project team" doesn't give contributors a way to actually report issues. Consider adding an email address or a link to a reporting form so this section is actionable.
🤖 Prompt for AI Agents
In `@CODE_OF_CONDUCT.md` around lines 29 - 31, The Enforcement paragraph under the
"Enforcement" header is vague about how to report incidents; update the
paragraph to include a concrete reporting channel by adding a specific contact
(e.g., a dedicated email address) or a link to a reporting form/URL so
contributors know where to submit complaints; edit the text that currently reads
"reported to the project team" to include the chosen contact method and any
brief submission guidance (what to include) for clarity.
| ```bash | ||
| git clone https://github.com/YOUR_USERNAME/PROJECT_NAME.git | ||
| cd PROJECT_NAME | ||
| ``` |
There was a problem hiding this comment.
Replace placeholder values with actual repository details.
YOUR_USERNAME and PROJECT_NAME are still generic placeholders. Contributors will need the correct clone URL.
Proposed fix
- git clone https://github.com/YOUR_USERNAME/PROJECT_NAME.git
- cd PROJECT_NAME
+ git clone https://github.com/YOUR_USERNAME/guardrails-detectors.git
+ cd guardrails-detectors🤖 Prompt for AI Agents
In `@CONTRIBUTING.md` around lines 21 - 24, Update the example git clone
instructions by replacing the generic placeholders YOUR_USERNAME and
PROJECT_NAME with instructions to use the actual repository clone URL (or
provide a template that indicates to substitute their GitHub username and the
real project repo name), e.g., clarify in the markdown code block that
contributors should run the real clone command for the repo instead of the
placeholders so the lines containing `git clone
https://github.com/YOUR_USERNAME/PROJECT_NAME.git` and `cd PROJECT_NAME` are
updated or annotated accordingly.
2 participants
Summary
agentready bootstrapagentready assessFiles added/modified
.agentready/— assessment reports and configuration.github/workflows/— CI workflows (agentready assessment, security, tests).github/ISSUE_TEMPLATE/— issue templates.github/PULL_REQUEST_TEMPLATE.md— PR template.github/CODEOWNERS— code ownership.github/dependabot.yml— dependency update config.pre-commit-config.yaml— pre-commit hooksCODE_OF_CONDUCT.md— code of conduct (if added)Test plan
🤖 Generated with Claude Code
Summary by CodeRabbit
Chores
Documentation