docs: comprehensive documentation, security, and CI hardening#58
Conversation
dosubot
Bot
added
the
size:M
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughExpanded public type/operator enums (structured TypeKind and new Operator variants), extensive documentation and workflow pinning, added changelog tooling and recipes, security/contributing docs revised, many files received license headers; no runtime logic changes beyond public API surface and build-time helpers. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Pull request overview
This pull request updates the AGENTS.md documentation to accurately distinguish between currently implemented features and planned future enhancements in libmagic-rs. The documentation now clearly reflects the v0.1.0 MVP status with explicit version-tagged sections and a comprehensive "Current Limitations" section.
Changes:
- Clarifies implementation status by adding version-specific headings and blockquote notes throughout the documentation
- Expands code examples to show the actual structure of
TypeKindandOperatorenums with their variants - Adds a new "Current Limitations" section detailing missing features in type system, operators, offset specifications, and magic file syntax
- Updates dependency descriptions to clarify that
regexis used only in tests andaho-corasickis planned but not yet added - Revises the development roadmap to show 5 phases from MVP to production-ready with specific feature sets
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
dosubot
Bot
added
size:L
unclesp1d3r
changed the title
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
dosubot
Bot
added
size:XL
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 17 out of 17 changed files in this pull request and generated 5 comments.
Comments suppressed due to low confidence (1)
.github/dependabot.yml:16
- The new Dependabot entries use an unquoted
weeklyvalue, while the existing cargo entry uses"weekly". YAML will parse both, but mixing styles makes the file harder to scan and can confuse future edits. Consider quotingweeklyhere for consistency with the rest of the file.
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: weekly
- package-ecosystem: "devcontainers"
directory: "/"
schedule:
interval: weekly
PreToolUse hook checks all Bash commands for git commit without -s or --signoff flag and blocks them with exit code 2. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Add 4 hookify rules to warn about common safety issues: - warn-unsafe-code: flags unsafe blocks/fn/impl (project forbids unsafe) - warn-direct-string-slice: flags &str[n..] (use strip_prefix instead) - warn-panic-in-lib: flags unwrap/expect/panic in src/ (use Result) - warn-emoji-in-code: flags emoji in code/docs (with bypass for processing) Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 73 out of 76 changed files in this pull request and generated 2 comments.
Comments suppressed due to low confidence (1)
.github/workflows/docs.yml:39
- The docs workflow installs mdBook via
jontze/action-mdbookwithmdbook-version: latest, which makes the build non-reproducible and can drift from the pinned toolchain inmise.lock(e.g., mdBook 0.5.2). To keep docs builds stable, pinmdbook-versionto the same version as mise (or remove this step and use the mise-provisionedmdbook).
- name: Setup mdBook
uses: jontze/action-mdbook@6c0be56d14c4bf16861b00af61f50ff7400ce502 # v4.0.0
with:
token: ${{ secrets.GITHUB_TOKEN }}
mdbook-version: latest
use-mermaid: true
- cliff.toml: fix duplicate Documentation sections (case-insensitive match), separate Breaking Changes into its own group (<!-- 10 -->), compact list formatting in template - justfile: fix coverage-check threshold from 9.7 to 85, add scorecard.yml to lint-actions - AGENTS.md: fix vulnerability timeline to 90 days (match SECURITY.md), fix unsafe_code wording (workspace lints not crate attribute), fix note style consistency, fix string type limitation description - docs/src/security-assurance.md: fix unsafe_code enforcement wording to reference workspace lints in Cargo.toml - mise.toml: align new tool entries with existing formatting - ROADMAP.md: remove specific coverage percentage claim - CHANGELOG.md: regenerated with all fixes applied Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
Replace \b word boundary (GNU-only) with POSIX-safe space/line anchors for cross-platform compatibility on macOS BSD grep. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 73 out of 76 changed files in this pull request and generated 2 comments.
Comments suppressed due to low confidence (1)
.github/workflows/docs.yml:39
mdbook-version: latestmakes the docs build non-reproducible and can cause unexpected breakages when mdBook releases. Since the repo already pins mdBook inmise.toml/mise.lock, consider using that pinned version here (or otherwise pin an explicit mdBook version) to keep CI deterministic.
- name: Setup mdBook
uses: jontze/action-mdbook@6c0be56d14c4bf16861b00af61f50ff7400ce502 # v4.0.0
with:
token: ${{ secrets.GITHUB_TOKEN }}
mdbook-version: latest
use-mermaid: true
Explain why Cargo.lock is committed despite the project including a library: binary reproducibility, cargo-auditable, and no impact on downstream library consumers since cargo publish ignores it. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
- ci.yml: pin dtolnay/rust-toolchain to SHA, fix Qlty coverage path from target/lcov.info to lcov.info to match report output - docs.yml: build mdBook before copying rustdoc into book/api/ to prevent mdBook from overwriting the API docs directory - enforce-dco-signoff.sh: match "git commit" as distinct subcommand to avoid false positives on git commit-tree etc. Signed-off-by: UncleSp1d3r <unclesp1d3r@evilbitlabs.io>
unclesp1d3r
deleted the
50-docs-correct-agentsmd-to-accurately-reflect-implemented-features
branch
| @@ -42,24 +42,24 @@ jobs: | |||
| - name: Install mdbook plugins | |||
| run: cargo binstall mdbook-tabs mdbook-i18n-helpers mdbook-alerts mdbook-yml-header mdbook-image-size --no-confirm | |||
|
|
|||
| - name: Build rustdoc | |||
| run: | | |||
| cargo doc --no-deps --document-private-items --target-dir target | |||
| mkdir -p docs/book/api | |||
| cp -r target/doc/* docs/book/api/ | |||
|
|
|||
| - name: Build mdBook | |||
| run: | | |||
| cd docs | |||
| mdbook build | |||
There was a problem hiding this comment.
The docs workflow installs mdBook via jontze/action-mdbook using mdbook-version: latest, but the repo already pins cargo:mdbook (and plugins) in mise.toml/mise.lock. Using latest (and a second installer) undermines reproducibility and can lead to CI using a different mdBook version than local dev. Prefer using the mise-managed mdBook (e.g., run mdbook via mise exec -- mdbook ...) or set mdbook-version to the pinned version to keep builds deterministic.
| | **v0.2.0** | Comparison operators, bitwise XOR/NOT, indirect/relative offsets, 64-bit integers | | ||
| | **v0.3.0** | Regex, float/double, date/timestamp, pascal strings, meta-types | | ||
| | **v0.4.0** | Builder API, JSON metadata, parse warnings, improved errors | | ||
| | **v1.0.0** | 95%+ GNU `file` compatibility, stable API, crates.io publication | |
There was a problem hiding this comment.
README currently shows a Crates.io version badge at the top, but the roadmap table still lists “crates.io publication” as a v1.0.0 milestone item. These statements conflict; please align the README by either removing/qualifying the Crates.io badge until the crate is published, or updating the roadmap milestone text if publication has already happened.
| | **v1.0.0** | 95%+ GNU `file` compatibility, stable API, crates.io publication | | |
| | **v1.0.0** | 95%+ GNU `file` compatibility, stable API, crates.io 1.0 stabilization | |
Summary
This PR encompasses a broad set of documentation, security, CI, and developer experience improvements spanning the project's push toward OpenSSF Best Practices compliance and overall project maturity.
Documentation
CI/CD & Supply Chain Security
dtolnay/rust-toolchain)Cargo.lockandmise.lockfor reproducible buildsDeveloper Experience — Claude Code Skills
5 project-level skills optimized for Rust/libmagic-rs:
tdd-workflow: TDD with cargo test/nextest, llvm-cov, proptestsecurity-review: memory safety, buffer bounds, unsafe code, supply chainverification-loop: cargo check/clippy/fmt/test/audit pipelinestrategic-compact: context management for long sessionsapi-design: Rust library API patterns, builder, error design, clap CLIDeveloper Experience — Claude Code Hooks & Rules
git commitwithout-sflag (POSIX-portable grep patterns)warn-unsafe-code: flagsunsafeblocks/fn/impl (project forbids unsafe)warn-direct-string-slice: flags&str[n..](usestrip_prefixinstead)warn-panic-in-lib: flags.unwrap()/.expect()/panic!()insrc/(useResult)warn-emoji-in-code: flags emoji in code/docs (with bypass for emoji-processing code)Review Fixes
git commit-treeArchitecture Issues Created
Test plan
cargo testpasses (no source code changes, only docs/config)cargo clippy -- -D warningspasses-s