chore(ci): remove Dependabot, add Claude + Copilot code review - #32
Open
srpatcha wants to merge 1 commit into
Open
chore(ci): remove Dependabot, add Claude + Copilot code review#32srpatcha wants to merge 1 commit into
srpatcha wants to merge 1 commit into
Conversation
Dependabot is disabled org-wide: config removed here, and alerts plus automated security fixes turned off via the API. 90 open Dependabot PRs were closed. Note this also stops CVE alerts for dependencies. Adds .github/workflows/claude-code-review.yml. It complements the automatic Copilot review now enforced on the default branch: Copilot does the first pass on every PR, Claude runs on demand via @claude or the deep-review label. Needs an ANTHROPIC_API_KEY secret. Also includes audit fixes: Ed25519 verification rejected every valid signature (SHA-256 challenge instead of SHA-512, plus broken curve arithmetic). Replaced the verifier, added SHA-512, replaced tests that could not fail, fixed a mismatched extern prototype, and built two source files that were never compiled. CI configured -DBUILD_TESTS=ON but the option is EBLDR_BUILD_TESTS, so it ran zero tests and passed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dependabot removed
Dependabot is disabled across the organisation:
.github/dependabot.ymldeleted hereImportant
Disabling alerts also stops CVE notifications for dependencies. Nothing else
in these repos currently watches for vulnerable dependencies, so that
coverage is gone until something replaces it.
Code review agent added
Two layers, deliberately split so routine PRs stay cheap:
Code Quality Copilot review for default branchruleset, nowactive.@claudein a comment, or by adding thedeep-reviewlabel to a PR..github/workflows/claude-code-review.ymlusesanthropics/claude-code-action@v1.Its review prompt points Claude at this repo's own
CLAUDE.md,QUALITY.md,TESTING.md,SECURITY.mdandVERIFY.mdrather than generic style rules, andprioritises correctness → security → tests → maintainability.
Warning
Two prerequisites are not satisfied yet, and both need an org admin:
ANTHROPIC_API_KEYorg secret does not exist. Until it is added, bothClaude jobs fail fast with a clear error rather than running without
credentials.
seat_breakdown.totalis 0, so the ruleset is active but nothing reviewsuntil seats are assigned. That is a billing action, deliberately left alone.
Verification
Builds and test suites were run on this branch; results are in the PR
conversation where the branch carries code changes.