thidev/Kodus-rules

Watch

Fork 0

docs: add README (closes #3) #5

Merged

speedi57 merged 2 commits from readme-issue-3 into main

2026-09-01 00:18:38 +00:00

speedi57 commented

2026-08-31 22:49:01 +00:00

Owner

Fills in README.md, which was still a bare title despite the repo now having a full schema, CI validation, severity model, finding format, versioning docs, and CONTRIBUTING guide (added in #4).

Adds:

Repo layout overview (schema, scripts, tests, docs, manifest).
Consumption steps: pin commit/tag -> verify MANIFEST.json -> validate against schema -> map severity to verdict -> render findings -> apply consumer context.
Pointer to CONTRIBUTING.md and local validation commands.

Closes #3.

Fills in README.md, which was still a bare title despite the repo now having a full schema, CI validation, severity model, finding format, versioning docs, and CONTRIBUTING guide (added in #4). Adds: - Repo layout overview (schema, scripts, tests, docs, manifest). - Consumption steps: pin commit/tag -> verify MANIFEST.json -> validate against schema -> map severity to verdict -> render findings -> apply consumer context. - Pointer to CONTRIBUTING.md and local validation commands. Closes #3.

speedi57 added 1 commit

2026-08-31 22:49:01 +00:00

docs: add README covering repo layout, consumption, and contributing (#3 )

Validate rules / validate (pull_request) Successful in 24s

Details

ed4a109955

hermes reviewed

2026-08-31 23:49:00 +00:00

hermes left a comment

Review summary

The README addition is clear and accurately documents the repository layout, consumption flow, validation commands, and the existing contracts. The CI status is successful.

However, this PR only changes README.md, so it does not fully implement or resolve all requirements from issue #3. In particular, the following items remain outstanding:

schema/kody-rule.schema.json does not require all fields described as mandatory by the contract, including applicability/remediation metadata such as path, exceptions, and remediation.
docs/FINDING_FORMAT.md says findings outside changed lines are never blocking, which conflicts with docs/SEVERITY.md and its fail-closed policy for critical security findings.
MANIFEST.json still reports provenance from the wild-bird branch rather than the publication branch, making the documented provenance check misleading.

These are not defects introduced by this README-only PR, so I am not requesting changes to this patch. The PR is suitable as documentation, but issue #3 should not be considered fully complete until those follow-up items are addressed.

Verdict: COMMENT

## Review summary The README addition is clear and accurately documents the repository layout, consumption flow, validation commands, and the existing contracts. The CI status is successful. However, this PR only changes `README.md`, so it does not fully implement or resolve all requirements from issue #3. In particular, the following items remain outstanding: - `schema/kody-rule.schema.json` does not require all fields described as mandatory by the contract, including applicability/remediation metadata such as `path`, `exceptions`, and `remediation`. - `docs/FINDING_FORMAT.md` says findings outside changed lines are never blocking, which conflicts with `docs/SEVERITY.md` and its fail-closed policy for critical security findings. - `MANIFEST.json` still reports provenance from the `wild-bird` branch rather than the publication branch, making the documented provenance check misleading. These are not defects introduced by this README-only PR, so I am not requesting changes to this patch. The PR is suitable as documentation, but issue #3 should not be considered fully complete until those follow-up items are addressed. **Verdict: COMMENT**

speedi57 referenced this pull request from a commit

2026-09-01 00:03:05 +00:00

fix: address review comments on #5

speedi57 added 1 commit

2026-09-01 00:03:06 +00:00

fix: address review comments on #5

Validate rules / validate (pull_request) Successful in 2m29s

Details

9cb2f98c83

- Require path/exceptions/remediation on every rule in the schema, and
  backfill genuine rule-specific content for the 27 rules that were
  missing one or more of these fields.
- Clarify FINDING_FORMAT.md: findings outside changed lines are
  non-blocking by default, but this doesn't override SEVERITY.md's
  fail-closed policy for critical security findings.
- Regenerate MANIFEST.json so generatedFrom reflects the actual
  publication branch/commit instead of a stale wild-bird reference.

hermes approved these changes

2026-09-01 00:17:01 +00:00

hermes left a comment

The updated PR now addresses the previously identified contract gaps: the rule schema requires applicability and remediation metadata, the finding-location policy is consistent with critical fail-closed behavior, and the manifest provenance has been regenerated for the current branch. The README accurately documents the resulting repository and consumption workflow. CI is passing.

Approved.

hermes approved these changes

2026-09-01 00:17:44 +00:00

hermes left a comment

Approved.

speedi57 merged commit 613249373d into main

2026-09-01 00:18:38 +00:00

speedi57 referenced this pull request from a commit

2026-09-01 00:18:39 +00:00

docs: add README (closes #3) (#5)

speedi57 deleted branch readme-issue-3

2026-09-01 00:18:47 +00:00