Repository navigation
chore: open-source hygiene — CI, contributing guide, changelog, version fix - #5
Conversation
…on fix - add GitHub Actions CI (bun install → build → test → smoke; fully offline, no secrets/network needed) - add CONTRIBUTING.md (dev setup, project layout, offline fetch-mock convention) - add CHANGELOG.md (backfilled 1.0.0 → 1.2.0 from tags + PR history) - read VERSION from package.json so --version, the --help banner, and the API User-Agent can never drift from the package version (was hardcoded "1.1.1"; published 1.2.0 reported the wrong version) - README: add CI badge, fix Node-incompatible Bun.file example (→ fs/promises readFile), link CONTRIBUTING/CHANGELOG
📝 WalkthroughWalkthroughThis PR establishes foundational project infrastructure and documentation. It introduces a GitHub Actions CI workflow that validates the build and tests, switches the VERSION constant to be read dynamically from package.json, and adds comprehensive documentation including contribution guidelines, release history, a CI status badge, and a Node.js-compatible code example. ChangesProject Infrastructure and Documentation Setup
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/ci.yml (1)
15-24: 💤 Low valueConsider pinning GitHub Actions to commit SHAs for supply-chain security.
The workflow uses tag references (
@v4,@v2) for actions, which can be updated and potentially introduce malicious code. For stricter supply-chain security, consider pinning to specific commit SHAs with a comment showing the tag:# actions/checkout@v4 - uses: actions/checkout@<commit-sha>This follows security best practices for preventing supply-chain attacks, though many projects accept the convenience/security tradeoff of using version tags.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/ci.yml around lines 15 - 24, Replace the floating action tags with pinned commit SHAs for actions/checkout, oven-sh/setup-bun, and actions/setup-node: locate the uses lines referencing actions/checkout@v4, oven-sh/setup-bun@v2, and actions/setup-node@v4 and replace each tag with the corresponding commit SHA (e.g., actions/checkout@<commit-sha>), and add a short inline comment above each pinned line that shows the original tag (e.g., "# actions/checkout@v4") to preserve readability and traceability.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Around line 52-55: The release link entries [1.2.0], [1.1.1], [1.1.0], and
[1.0.0] in CHANGELOG.md point to the incorrect GitHub repo
tobiasosDev/citecheck; locate those bracketed reference lines and either replace
each URL with the correct repository/tag URL (matching the actual org/repo and
release tag) or remove the URL markup so the version remains plain text if the
releases are private/renamed; ensure the link target for each bracketed label
matches the real GitHub release path (or is omitted) so the changelog contains
only valid, verifiable links.
---
Nitpick comments:
In @.github/workflows/ci.yml:
- Around line 15-24: Replace the floating action tags with pinned commit SHAs
for actions/checkout, oven-sh/setup-bun, and actions/setup-node: locate the uses
lines referencing actions/checkout@v4, oven-sh/setup-bun@v2, and
actions/setup-node@v4 and replace each tag with the corresponding commit SHA
(e.g., actions/checkout@<commit-sha>), and add a short inline comment above each
pinned line that shows the original tag (e.g., "# actions/checkout@v4") to
preserve readability and traceability.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 91efbfb2-060b-4193-8234-688e6dc7c7f0
📒 Files selected for processing (5)
.github/workflows/ci.ymlCHANGELOG.mdCONTRIBUTING.mdREADME.mdsrc/http.ts
| [1.2.0]: https://github.com/tobiasosDev/citecheck/releases/tag/v1.2.0 | ||
| [1.1.1]: https://github.com/tobiasosDev/citecheck/releases/tag/v1.1.1 | ||
| [1.1.0]: https://github.com/tobiasosDev/citecheck/releases/tag/v1.1.0 | ||
| [1.0.0]: https://github.com/tobiasosDev/citecheck/releases/tag/v1.0.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Check if release tags exist
for tag in v1.2.0 v1.1.1 v1.1.0 v1.0.0; do
gh api "repos/tobiasosDev/citecheck/releases/tags/$tag" --jq '.tag_name // "NOT FOUND: '"$tag"'"' 2>&1 | grep -q "Not Found" && echo "❌ $tag does not exist" || echo "✅ $tag exists"
doneRepository: tobiasosDev/citecheck
Length of output: 161
🏁 Script executed:
#!/bin/bash
set -euo pipefail
repo="tobiasosDev/citecheck"
tags=(v1.2.0 v1.1.1 v1.1.0 v1.0.0)
for tag in "${tags[@]}"; do
url="https://api.github.com/repos/${repo}/releases/tags/${tag}"
code="$(curl -sS -o /dev/null -w "%{http_code}" "$url")"
echo "${tag}: ${code}"
doneRepository: tobiasosDev/citecheck
Length of output: 113
🌐 Web query:
tobiasosDev/citecheck release tag v1.2.0
💡 Result:
As of June 9, 2026, there is no evidence of a "tobiasosDev/citecheck" repository or a v1.2.0 release associated with such a name. While several projects named "citecheck" or "citation-checker" exist across GitHub, none are associated with an author named "tobiasosDev." Existing projects include: * jhlee0619/citecheck: An MCP server for bibliographic verification [1][2]. * substrateagnostic/citecheck: A tool for verifying legal citations against CourtListener [3]. * nathanjmcdougall/citecheck: A Python library for citation chain protection [4]. * SRWS-PSG/citation-checker: A tool for checking academic references against Crossref, PubMed, and arXiv [5]. * lizTheDeveloper/citation-checker: A lightweight git hook and CLI tool [6]. It is possible the repository name or author handle was misremembered or the project is private/non-existent. [7][8][9][10][11][12][13]
Citations:
- 1: https://github.com/jhlee0619/citecheck
- 2: https://www.arxiv.org/pdf/2603.17339
- 3: https://github.com/substrateagnostic/citecheck
- 4: https://github.com/nathanjmcdougall/citecheck
- 5: SRWS-PSG/citation-checker@v0.1.0...v0.2.0
- 6: https://github.com/lizTheDeveloper/citation-checker
- 7: https://github.com/toschdev
- 8: https://github.com/TobisDeveloper
- 9: https://github.com/tobias-oss
- 10: https://github.com/Tosch-IT
- 11: https://github.com/dvtpei
- 12: https://github.com/tobiasofsn
- 13: https://github.com/tobiasvargas/
🌐 Web query:
tobiasosDev/citecheck release tag v1.1.1
💡 Result:
There is no public GitHub repository or software project identified by the name tobiasosDev/citecheck. Multiple independent projects named citecheck exist, but none are associated with a user or organization named tobiasosDev: 1. jhlee0619/citecheck: An MCP server designed for automated bibliographic verification and repair in scholarly manuscripts [1][2]. 2. substrateagnostic/citecheck: A tool focused on verifying legal citations against the CourtListener database [3]. 3. nathanjmcdougall/citecheck: An archived Python project for citation chain protection [4]. Given that multiple distinct projects share this common name, the request for a specific release tag (v1.1.1) for a non-existent or misidentified repository cannot be fulfilled. If you have the correct repository URL or additional context, please provide it for further investigation.
Citations:
- 1: https://github.com/jhlee0619/citecheck
- 2: https://arxiv.org/abs/2603.17339v1
- 3: https://github.com/substrateagnostic/citecheck
- 4: https://github.com/nathanjmcdougall/citecheck
🌐 Web query:
tobiasosDev/citecheck release tag v1.1.0
💡 Result:
There is no project or release tag v1.1.0 associated with a GitHub repository named tobiasosDev/citecheck. It is possible this request refers to a different repository or contains a typo. Several other projects named citecheck exist, but none are associated with an author or account named tobiasosDev: 1. jhlee0619/citecheck: A repository for an MCP server designed for automated bibliographic verification and repair. This project has multiple v0.x releases [1][2][3][4][5][6]. 2. nathanjmcdougall/citecheck: A Python-based tool for checking citation chains, which is currently archived and has a final release of v0.3.0 [7]. 3. substrateagnostic/citecheck: A tool designed for verifying legal citations [8]. If you can provide more context or verify the account name, I would be happy to investigate further.
Citations:
- 1: jhlee0619/citecheck@v0.1.0...v0.1.1
- 2: jhlee0619/citecheck@f1ea808
- 3: jhlee0619/citecheck@1a74013
- 4: jhlee0619/citecheck@v0.1.1...v0.1.3
- 5: jhlee0619/citecheck@e58794c
- 6: https://github.com/jhlee0619/citecheck
- 7: https://github.com/nathanjmcdougall/citecheck
- 8: https://github.com/substrateagnostic/citecheck
🌐 Web query:
tobiasosDev/citecheck release tag v1.0.0
💡 Result:
There is no known repository at the path tobiasosDev/citecheck. The primary project associated with the name citecheck and the Model Context Protocol (MCP) is maintained by jhlee0619 at https://github.com/jhlee0619/citecheck [1][2]. The citecheck repository by jhlee0619, which is an MCP server for bibliographic verification, has released versions in the 0.1.x series (e.g., v0.1.1, v0.1.12) as of March 2026 [3][4]. There is no record of a v1.0.0 release for this project or any other prominent project named citecheck [1][5][6][7]. The project is currently a research prototype in active development [2][8].
Citations:
- 1: https://github.com/jhlee0619/citecheck
- 2: https://arxiv.org/abs/2603.17339v1
- 3: jhlee0619/citecheck@f1ea808
- 4: jhlee0619/citecheck@1a74013
- 5: https://github.com/nathanjmcdougall/citecheck
- 6: https://github.com/substrateagnostic/citecheck
- 7: https://libraries.io/npm/@citecheck%2Fmcp
- 8: https://www.arxiv.org/pdf/2603.17339
Fix unverifiable/broken GitHub release tag URLs in CHANGELOG.md
The changelog’s release links for v1.2.0, v1.1.1, v1.1.0, and v1.0.0 point to tobiasosDev/citecheck, but public search/API results show no such repository/releases, so these URLs can’t be confirmed and are likely incorrect/broken. Update the changelog to the correct repo/tag URLs (or remove these links if releases are private/renamed).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@CHANGELOG.md` around lines 52 - 55, The release link entries [1.2.0],
[1.1.1], [1.1.0], and [1.0.0] in CHANGELOG.md point to the incorrect GitHub repo
tobiasosDev/citecheck; locate those bracketed reference lines and either replace
each URL with the correct repository/tag URL (matching the actual org/repo and
release tag) or remove the URL markup so the version remains plain text if the
releases are private/renamed; ensure the link target for each bracketed label
matches the real GitHub release path (or is omitted) so the changelog contains
only valid, verifiable links.
Cleanup pass to make citecheck genuinely adoptable by outside contributors.
Adoptability infrastructure
.github/workflows/ci.yml) — runs on push tomainand every PR:bun install --frozen-lockfile→bun run build(tsc) →bun test→bun run smoke.Uses bun (the suite is written with
bun:test) plus Node 20 (smoke runs thecompiled CLI under Node to honor
engines: >=18). Fully offline — all 105tests mock
globalThis.fetch, so no secrets or network access are required.test convention, and PR/commit conventions.
1.0.0→1.2.0from tags + PR history(Keep a Changelog format).
Bug fix: version drift
src/http.tshardcodedVERSION = "1.1.1"and was never bumped, so thepublished 1.2.0 reports
1.1.1for--version, the--helpbanner, andthe Crossref/OpenAlex
User-Agent. It now reads the version frompackage.json(always shipped in the npm tarball, one level up from
dist/), so it can neverdrift again. Verified the compiled CLI, the help banner, and the src path all
report
1.2.0.README
Bun.file(...), which throwsBun is not definedfor the Node users this package targets; now usesnode:fs/promisesreadFile.Verification
tscclean · 105/105 tests pass ·bun run smokeexits 0 ·--version→1.2.0.Summary by cubic
Adds offline CI, a contributing guide, and a backfilled changelog, and fixes version reporting by reading from
package.json. This makescitecheckeasier to contribute to and prevents CLI/API version drift.New Features
mainand PRs usingbunand Node 20:bun install --frozen-lockfile→ build (tsc) →bun test→ smoke run under Node; fully offline (no network/secrets).CONTRIBUTING.md(dev setup, test convention) andCHANGELOG.md(1.0.0–1.2.0). README adds a CI badge, fixes the programmatic example to usenode:fs/promises, and links to the new docs.Bug Fixes
VERSIONnow reads frompackage.json, so--version,--help, and APIUser-Agentalways match the published version. Note: published1.2.0still reports1.1.1until the next release.Written for commit 22ed8ce. Summary will update on new commits.
Summary by CodeRabbit
New Features
Documentation