feat: examples, smoke test, Makefile, dependabot#1
Conversation
- examples/ with reference Rego policies (RBAC, ABAC, k8s admission) - scripts/smoke.sh drives a full MCP handshake over stdio and asserts the policy returns allow=true; exits non-zero on protocol failure - Makefile targets: build, test, vet, lint, smoke, fmt, tidy, clean - Dependabot for gomod + github-actions (weekly, grouped) - README trimmed; adds layout rationale (flat is intentional)
|
Warning Review limit reached
More reviews will be available in 26 minutes and 5 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (12)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces project infrastructure and documentation improvements, including a Dependabot configuration, a Makefile, a smoke test script, and an examples directory with sample Rego policies (RBAC, ABAC, and Kubernetes admission control). The code review feedback highlights three key areas for improvement: correcting a misleading reference to curl in the examples documentation, refactoring the Kubernetes admission policy to use object.get with fallbacks to prevent silent evaluation failures on missing metadata, and making the smoke test script more robust by selecting the JSON-RPC response by ID using jq instead of relying on tail -1.
….24, can't read go1.26 modules
- examples/README.md: drop misleading "curl" wording in the stdio note - examples/k8s_admission.rego: use object.get with fallbacks so an undefined namespace/name doesn't make sprintf evaluate to undefined and silently swallow the violation - scripts/smoke.sh: select the tools/call response by id=2 instead of tail -1 (more robust against stray output lines) - workflows: pin actions to full commit SHAs and set persist-credentials: false on checkout (zizmor / CodeRabbit hardening)
…re hooks for reproducible releases
- smoke: build and run the full MCP handshake via `make smoke`. Catches regressions in the actual server, not just unit tests. - vuln: govulncheck (Go reachable-CVE scan) + osv-scanner (OSV.dev cross- ecosystem scan). - actionlint: lint the workflow files themselves (catches typos, bad refs, missing inputs). - test: emit coverage with -covermode=atomic and print the function-level summary in the job output. All actions pinned to SHAs with version comments for Dependabot tracking.
…ner-action/action.yml, not repo root)
…sv-scanner findings Pulled forward via OPA's transitive graph. 14 OSV advisories against v0.50.0 / v0.43.0 (all unrated/Unknown severity, none reachable by our code per govulncheck). Bumping clears the noise so osv-scanner doesn't gate the PR.
1 participant
Summary
examples/with reference Rego policies (RBAC, ABAC, Kubernetes admission)scripts/smoke.shdrives a real MCP handshake over stdio (initialize → tools/list → tools/call) and asserts the policy returns the expected decision. Non-zero exit on protocol failure.Makefilewithbuild/test/vet/lint/smoke/fmt/tidy/clean.github/dependabot.ymlfor gomod and github-actions (weekly, grouped)Test plan
go vet ./...cleangolangci-lint run ./...→ 0 issuesgo test -race ./...passesmake smoke→ ✓ smoke: allow=true