cf0755f947
Fourth review round (F11-F18, N1-N4, kvnloo, Adolanium): - Hits are old only where the base occurrence survives: a line the comment- and whitespace-blind line diff keeps (blame semantics), or anything inside a unit whose body is unchanged. An identical violation moved past unrelated code is new; removing an allow comment or re-indenting is not. Hit fingerprints exclude comments (N4). - Inline allows cover their own line; only a comment-only line covers the next (N3). - Rules read a copy of the AST with import aliases resolved, so `sp.run`, `from subprocess import run as execute`, aliased threading/asyncio/load_config are seen (F12); deadline helpers must resolve to the real asyncio API, and communicate()/wait() are judged only on receivers holding a spawned process (F13); infinite deadlines are unbounded (F14). - HERMES_* writes introduce a name too (N1); bool(os.environ[...]) is HX010 (N2); HX009 needs the isinstance subject to come from gather(return_exceptions=True). - Recursive self-references are normalised out of body hashes, so a recursive rename keeps its cap, py and ts (F15). Decorators belong to their function's scope and classes are matchable units, so their hits follow proven moves (F16). - An over-cap file may not grow (F17, Teknium: strict improvement-only). - A file the checker cannot parse or measure (ast/ruff/TS parse error) fails. - scripts/check: --staged always lints an index snapshot (ignored files are invisible to git status, not to guards) (F18); create the --prefix dir for Git for Windows (F11); --only builds just the selected jobs, so it needs no ruff for non-ruff checks. - CODEOWNERS covers scripts/check + scripts/code_health; frontend-only PRs skip the Python-only lint jobs again and run only the ratchet.
61 lines
3.2 KiB
Plaintext
61 lines
3.2 KiB
Plaintext
# Paths that need a hermes-agent-core approval before merge. This replaces the
|
|
# ``ci-reviewed`` label gate: GitHub requests the review and enforces it
|
|
# (ruleset: "Require review from Code Owners"), so CI no longer needs to
|
|
# classify these paths, check a label, or rerun jobs when one is added.
|
|
#
|
|
# Last match wins; every rule below has the same owner, so order is moot.
|
|
# Patterns without a leading slash match at any depth.
|
|
|
|
# Workflows, composite actions, and this file: they decide what CI executes
|
|
# and what the autofix job pushes to main. The scripts the workflows run get the
|
|
# same review for the same reason.
|
|
/.github/ @NousResearch/hermes-agent-core
|
|
/scripts/ci/ @NousResearch/hermes-agent-core
|
|
# The code-health gate decides whether a PR passes; weakening it is a CI change.
|
|
/scripts/check @NousResearch/hermes-agent-core
|
|
/scripts/code_health/ @NousResearch/hermes-agent-core
|
|
|
|
# eslint configs can define custom ``fix`` functions that run arbitrary code.
|
|
eslint.config.* @NousResearch/hermes-agent-core
|
|
/.prettierrc @NousResearch/hermes-agent-core
|
|
|
|
# MCP catalog entries define local commands users later install into
|
|
# ``mcp_servers``; the installer decides how they are fetched and run.
|
|
/optional-mcps/ @NousResearch/hermes-agent-core
|
|
/hermes_cli/mcp_catalog.py @NousResearch/hermes-agent-core
|
|
|
|
# Files that execute at pip-install or interpreter startup.
|
|
/setup.py @NousResearch/hermes-agent-core
|
|
/setup.cfg @NousResearch/hermes-agent-core
|
|
/sitecustomize.py @NousResearch/hermes-agent-core
|
|
/usercustomize.py @NousResearch/hermes-agent-core
|
|
*.pth @NousResearch/hermes-agent-core
|
|
|
|
# Dependency manifests, resolved pins, and image builds: an edit here changes
|
|
# what gets installed and run without touching any reviewed source.
|
|
pyproject.toml @NousResearch/hermes-agent-core
|
|
package.json @NousResearch/hermes-agent-core
|
|
uv.lock @NousResearch/hermes-agent-core
|
|
*package-lock.json @NousResearch/hermes-agent-core
|
|
/flake.lock @NousResearch/hermes-agent-core
|
|
/pm/lock.json @NousResearch/hermes-agent-core
|
|
*Dockerfile @NousResearch/hermes-agent-core
|
|
|
|
# The npm supply-chain quarantine (min-release-age) lives here.
|
|
.npmrc @NousResearch/hermes-agent-core
|
|
|
|
# Where PM fetches artifacts from.
|
|
/pm/artifact-mirror.json @NousResearch/hermes-agent-core
|
|
|
|
# The installers users pipe into a shell, and the generator for the pins they carry.
|
|
/scripts/install.sh @NousResearch/hermes-agent-core
|
|
/scripts/install.ps1 @NousResearch/hermes-agent-core
|
|
/scripts/install.cmd @NousResearch/hermes-agent-core
|
|
/scripts/gen-bootstrap-pins.py @NousResearch/hermes-agent-core
|
|
|
|
# The trust model and the scope authority for security reports.
|
|
/SECURITY.md @NousResearch/hermes-agent-core
|
|
|
|
# Each entry pins a third-party repo by sha; editing it changes what users install.
|
|
/plugin-catalog/ @NousResearch/hermes-agent-core
|