From 0864f7879c432787c34ca04fe67172b72c69e644 Mon Sep 17 00:00:00 2001 From: "Anaz S. Aji" Date: Mon, 8 Jun 2026 11:02:12 +0700 Subject: [PATCH] chore: switch to marketplace action + update all docs Breaking changes: - Remove .github/actions/cora-review/ (now at codecoradev/cora-review-action) - Workflow uses codecoradev/cora-review-action@v1 from Marketplace Docs updated: - README.md: marketplace badge + updated CI/CD section - CONTRIBUTING.md: removed internal action from directory tree - CHANGELOG.md: added v0.4.7 entry - docs/changelog.md: synced --- .github/actions/cora-review/action.yml | 378 ------------------------- .github/workflows/cora-review.yml | 5 +- CHANGELOG.md | 20 ++ CONTRIBUTING.md | 4 +- README.md | 9 +- docs/changelog.md | 103 +++++-- 6 files changed, 104 insertions(+), 415 deletions(-) delete mode 100644 .github/actions/cora-review/action.yml diff --git a/.github/actions/cora-review/action.yml b/.github/actions/cora-review/action.yml deleted file mode 100644 index c199ec7c..00000000 --- a/.github/actions/cora-review/action.yml +++ /dev/null @@ -1,378 +0,0 @@ -name: 'Cora AI Code Review' -description: 'Run cora AI code review on a PR diff. Posts PR comment with findings.' - -inputs: - base-branch: - description: 'Base branch to compare against (default: origin/develop)' - required: false - default: 'origin/develop' - severity: - description: 'Minimum severity to report (info, minor, major, critical)' - required: false - default: 'major' - cora-version: - description: 'cora-cli version tag (default: latest release)' - required: false - default: 'latest' - upload-sarif: - description: 'Upload SARIF to GitHub Code Scanning (default: true). Set to "false" to disable.' - required: false - default: 'true' - cora-api-key: - description: 'LLM API key' - required: true - cora-base-url: - description: 'LLM API base URL' - required: false - cora-model: - description: 'LLM model ID' - required: false - github-token: - description: 'GitHub token for PR comments and SARIF upload' - required: true - -runs: - using: 'composite' - steps: - - name: Resolve cora-cli version - id: resolve - shell: bash - env: - INPUT_VERSION: ${{ inputs.cora-version }} - run: | - if [ "$INPUT_VERSION" = "latest" ]; then - for i in 1 2 3; do - VERSION=$(curl -sfL --connect-timeout 10 \ - https://api.github.com/repos/codecoradev/cora-cli/releases/latest \ - | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('tag_name', ''))" 2>/dev/null) - if [ -n "$VERSION" ]; then - break - fi - echo "Attempt $i failed, retrying..." - sleep 5 - done - if [ -z "$VERSION" ]; then - echo "::warning::Failed to resolve latest cora-cli version from GitHub API, using fallback" - VERSION="v0.3.0" - fi - else - VERSION="$INPUT_VERSION" - fi - echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT" - echo "Resolved cora-cli version: $VERSION" - - - name: Install cora-cli - shell: bash - env: - CORA_VERSION: ${{ steps.resolve.outputs.VERSION }} - run: | - ARCH=$(uname -m) - if [ "$ARCH" = "x86_64" ]; then - ASSET="cora-x86_64-unknown-linux-gnu" - elif [ "$ARCH" = "aarch64" ]; then - ASSET="cora-aarch64-unknown-linux-gnu" - else - echo "Unsupported architecture: $ARCH" - exit 1 - fi - - DOWNLOAD_URL="https://github.com/codecoradev/cora-cli/releases/download/${CORA_VERSION}/${ASSET}-${CORA_VERSION}.tar.gz" - CHECKSUM_URL="https://github.com/codecoradev/cora-cli/releases/download/${CORA_VERSION}/checksums-sha256.txt" - - # Download tarball with retry + exponential backoff - # Handles: CDN propagation delay on fresh releases, transient network errors, rate limits - for i in 1 2 3 4 5; do - rm -f /tmp/cora.tar.gz - HTTP_CODE=$(curl --fail --show-error -sL --connect-timeout 15 --max-time 120 \ - -w '%{http_code}' -o /tmp/cora.tar.gz "$DOWNLOAD_URL" || echo "000") - FILE_SIZE=$(wc -c < /tmp/cora.tar.gz 2>/dev/null || echo 0) - echo "Download attempt $i: HTTP $HTTP_CODE, size ${FILE_SIZE} bytes" - if [ "$HTTP_CODE" = "200" ] && [ "$FILE_SIZE" -gt 1000 ]; then - break - fi - if [ "$i" -eq 5 ]; then - echo "::error::Failed to download ${ASSET}-${CORA_VERSION}.tar.gz after 5 attempts (last HTTP $HTTP_CODE, ${FILE_SIZE} bytes)" - exit 1 - fi - BACKOFF=$((i * 10)) - echo "Attempt $i failed (HTTP $HTTP_CODE), retrying in ${BACKOFF}s..." - sleep "$BACKOFF" - done - - # Validate downloaded file is actual gzip - FILE_TYPE=$(file -b /tmp/cora.tar.gz 2>/dev/null || echo "unknown") - if ! echo "$FILE_TYPE" | grep -qi "gzip"; then - echo "::error::Downloaded file is not gzip. Got: $FILE_TYPE (HTTP $HTTP_CODE, ${FILE_SIZE} bytes)" - exit 1 - fi - - # Download and verify checksums - CHECKSUM_HTTP=$(curl --fail --show-error -sL --connect-timeout 15 --max-time 30 \ - -w '%{http_code}' -o /tmp/cora-checksums.txt "$CHECKSUM_URL" || echo "000") - if [ -f /tmp/cora-checksums.txt ] && [ -s /tmp/cora-checksums.txt ]; then - EXPECTED=$(awk -v name="${ASSET}-${CORA_VERSION}.tar.gz" '$2 == name {print $1}' /tmp/cora-checksums.txt) - ACTUAL=$(sha256sum /tmp/cora.tar.gz | awk '{print $1}') - if [ -z "$EXPECTED" ]; then - echo "::error::No checksum entry for ${ASSET}-${CORA_VERSION}.tar.gz — possible release asset mismatch" - echo "Checksum file contents:" - cat /tmp/cora-checksums.txt - rm -f /tmp/cora-checksums.txt - exit 1 - fi - if [ "$EXPECTED" != "$ACTUAL" ]; then - echo "::error::Checksum verification failed for ${ASSET}-${CORA_VERSION}.tar.gz" - echo "Expected: $EXPECTED" - echo "Actual: $ACTUAL" - rm -f /tmp/cora-checksums.txt - exit 1 - fi - echo "Checksum verified OK" - rm -f /tmp/cora-checksums.txt - else - echo "::error::Failed to download checksums file (HTTP $CHECKSUM_HTTP) — cannot verify binary integrity" - rm -f /tmp/cora-checksums.txt - exit 1 - fi - - tar xzf /tmp/cora.tar.gz -C /usr/local/bin cora - rm -f /tmp/cora.tar.gz - chmod +x /usr/local/bin/cora - cora --version - - - name: Run cora review - id: review - shell: bash - env: - CORA_API_KEY: ${{ inputs.cora-api-key }} - CORA_BASE_URL: ${{ inputs.cora-base-url }} - CORA_MODEL: ${{ inputs.cora-model }} - INPUT_BASE: ${{ inputs.base-branch }} - INPUT_SEVERITY: ${{ inputs.severity }} - run: | - # Build the cora review command with retry logic and 600s timeout - run_cora() { - if [ ! -f .cora.yaml ]; then - # Create CI config with 5MB diff limit and 600s timeout - printf 'hook:\n max_diff_size: 5242880\nllm:\n timeout: 600\n' > .cora-ci.yaml - CORA_CONFIG=".cora-ci.yaml" cora review \ - --base "$INPUT_BASE" \ - --format sarif \ - --severity "$INPUT_SEVERITY" \ - --quiet \ - > cora-results.sarif 2>cora-stderr.log - else - echo "Using project .cora.yaml for configuration" - cora review \ - --base "$INPUT_BASE" \ - --format sarif \ - --severity "$INPUT_SEVERITY" \ - --quiet \ - > cora-results.sarif 2>cora-stderr.log - fi - return $? - } - - # Retry up to 3 times with exponential backoff (10s, 30s, 60s) - EXIT_CODE=1 - for ATTEMPT in 1 2 3; do - run_cora - EXIT_CODE=$? - SARIF_BYTES=$(wc -c < cora-results.sarif 2>/dev/null || echo "0") - - echo "Attempt $ATTEMPT: exit=$EXIT_CODE, sarif_bytes=$SARIF_BYTES" - - # Success: cora exited 0 or produced valid SARIF output - if [ "$EXIT_CODE" -eq 0 ] || [ "$SARIF_BYTES" -gt 10 ]; then - break - fi - - # On failure, show stderr and retry - if [ -s cora-stderr.log ]; then - echo "::warning::Attempt $ATTEMPT failed. Cora stderr: $(cat cora-stderr.log)" - fi - - if [ "$ATTEMPT" -lt 3 ]; then - SLEEP=$((ATTEMPT * 20)) - echo "Retrying in ${SLEEP}s..." - sleep "$SLEEP" - rm -f cora-results.sarif cora-stderr.log - fi - done - - echo "Cora review complete ($SARIF_BYTES bytes, exit=$EXIT_CODE, attempts=$ATTEMPT)" - if [ -s cora-stderr.log ]; then - echo "::warning::Cora stderr: $(cat cora-stderr.log)" - fi - - # All retries exhausted and still no valid output — generate a fallback SARIF - # so the workflow doesn't hard-fail on transient API issues. - if [ "$EXIT_CODE" -ne 0 ] && [ "$SARIF_BYTES" -lt 10 ]; then - echo "::warning::Cora review could not complete after $ATTEMPT attempt(s). Generating fallback SARIF." - cat > cora-results.sarif << 'SARIF_EOF' - { - "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json", - "version": "2.1.0", - "runs": [{ - "tool": { - "driver": { - "name": "cora", - "informationUri": "https://github.com/codecoradev/cora-cli", - "version": "0.4.0" - } - }, - "results": [{ - "level": "warning", - "message": { - "text": "Cora AI review could not complete — LLM API was unavailable after 3 retry attempts. Review was skipped; no code quality issues were found by the automated check." - } - }] - }] - } - SARIF_EOF - fi - - - name: Check SARIF for findings - id: sarif-check - if: inputs.upload-sarif == 'true' - shell: bash - run: | - RESULTS=$(python3 -c " - import json, sys - try: - data = json.load(open('cora-results.sarif')) - results = data.get('runs', [{}])[0].get('results', []) - print(len(results)) - except: - print(0) - " 2>/dev/null || echo "0") - echo "results=$RESULTS" >> "$GITHUB_OUTPUT" - if [ "$RESULTS" -gt 0 ]; then - echo "SARIF contains $RESULTS finding(s) — will upload." - else - echo "SARIF has no findings — skipping upload." - fi - - - name: Upload SARIF to GitHub Code Scanning - if: inputs.upload-sarif == 'true' && steps.sarif-check.outputs.results > 0 - continue-on-error: true - uses: github/codeql-action/upload-sarif@f52b05f4acaaa234e44466e66d29050e135ea9ef # v4.36.0 - with: - sarif_file: cora-results.sarif - category: cora-review - - - name: Post PR comment - if: always() && github.event_name == 'pull_request' - uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0 - env: - GH_TOKEN: ${{ inputs.github-token }} - with: - script: | - const fs = require('fs'); - - let sarifContent; - try { - sarifContent = JSON.parse(fs.readFileSync('cora-results.sarif', 'utf8')); - } catch (e) { - sarifContent = null; - } - - let body; - if (!sarifContent || !sarifContent.runs || sarifContent.runs.length === 0) { - let fileSize = 0; - try { - fileSize = fs.statSync('cora-results.sarif').size; - } catch (e) { - fileSize = 0; - } - if (fileSize < 10) { - body = `## 🔍 Cora AI Code Review\n\n⚠️ **Review could not complete.** Cora produced an empty result. Check the workflow logs for errors.\n\n---\n_Review powered by [cora-cli](https://github.com/codecoradev/cora-cli) · BYOK · MIT_`; - } else { - body = `## 🔍 Cora AI Code Review\n\n✅ **No issues found.** Code looks good!\n\n---\n_Review powered by [cora-cli](https://github.com/codecoradev/cora-cli) · BYOK · MIT_`; - } - } else { - const results = sarifContent.runs[0].results || []; - if (results.length === 0) { - body = `## 🔍 Cora AI Code Review\n\n✅ **No issues found.** Code looks good!\n\n---\n_Review powered by [cora-cli](https://github.com/codecoradev/cora-cli) · BYOK · MIT_`; - } else { - const grouped = {}; - for (const r of results) { - const sev = (r.level || 'note').charAt(0).toUpperCase() + (r.level || 'note').slice(1); - if (!grouped[sev]) grouped[sev] = []; - grouped[sev].push(r); - } - - const severityOrder = ['Error', 'Warning', 'Note']; - let table = ''; - - for (const sev of severityOrder) { - if (!grouped[sev]) continue; - const icon = sev === 'Error' ? '🔴' : sev === 'Warning' ? '🟡' : '🔵'; - table += `\n### ${icon} ${sev} (${grouped[sev].length})\n\n`; - for (const r of grouped[sev]) { - const loc = r.locations?.[0]?.physicalLocation; - const file = loc?.artifactLocation?.uri || 'unknown'; - const line = loc?.region?.startLine || '?'; - const msg = r.message?.text || r.message?.markdown || 'No message'; - table += `- \`${file}:${line}\` — ${msg}\n`; - } - } - - const hasErrors = (grouped['Error'] || []).length > 0; - const hasWarnings = (grouped['Warning'] || []).length > 0; - const status = hasErrors ? '❌ **Blocked** — critical issues found.' : - hasWarnings ? '⚠️ **Review recommended** — warnings found.' : - '✅ **Passed** — only informational notes.'; - - body = `## 🔍 Cora AI Code Review\n\n${status}\n${table}\n---\n_Review powered by [cora-cli](https://github.com/codecoradev/cora-cli) · BYOK · MIT_`; - } - } - - const { data: comments } = await github.rest.issues.listComments({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - }); - - const existing = comments.find(c => - c.user.login === 'github-actions[bot]' && - c.body.startsWith('## 🔍 Cora AI Code Review') - ); - - if (existing) { - await github.rest.issues.updateComment({ - owner: context.repo.owner, - repo: context.repo.repo, - comment_id: existing.id, - body, - }); - } else { - await github.rest.issues.createComment({ - owner: context.repo.owner, - repo: context.repo.repo, - issue_number: context.issue.number, - body, - }); - } - - - name: Check for blocking issues - if: always() - shell: bash - run: | - if [ -f cora-results.sarif ]; then - ERRORS=$(python3 -c " - import json, sys - try: - data = json.load(open('cora-results.sarif')) - results = data.get('runs', [{}])[0].get('results', []) - errors = [r for r in results if r.get('level') == 'error'] - print(len(errors)) - except: - print(0) - " 2>/dev/null || echo "0") - - if [ "$ERRORS" -gt 0 ]; then - echo "::error::Cora found $ERRORS blocking issue(s)." - exit 1 - fi - fi - echo "No blocking issues." diff --git a/.github/workflows/cora-review.yml b/.github/workflows/cora-review.yml index 0d047931..4c3728ca 100644 --- a/.github/workflows/cora-review.yml +++ b/.github/workflows/cora-review.yml @@ -12,7 +12,6 @@ concurrency: permissions: contents: read pull-requests: write - id-token: write security-events: write jobs: @@ -22,14 +21,14 @@ jobs: timeout-minutes: 10 steps: - name: Checkout PR head - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@v4 with: ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 persist-credentials: false - name: Run Cora AI Code Review - uses: ./.github/actions/cora-review + uses: codecoradev/cora-review-action@v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} cora-api-key: ${{ secrets.CORA_API_KEY }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 6c55c392..76013935 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,26 @@ All notable changes to cora-cli are documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [0.4.7] - 2026-06-08 + +### Changed + +- **CI action moved to GitHub Marketplace** — published as [`codecoradev/cora-review-action@v1`](https://github.com/marketplace/actions/cora-ai-code-review) +- **Internal composite action removed** — workflow now uses marketplace action instead of `.github/actions/cora-review/` +- **`cora-review-simple` removed** — unused duplicate action deleted + +### Fixed + +- **Download hardening** — 5x retry with exponential backoff, gzip validation, checksum verification for cora-cli binary download in CI (#221) +- **curl hardening** — `--fail --show-error` + `set -e` guard prevents silent HTML downloads +- **Checksum enforcement** — hard fail on missing/invalid checksums (was warning-only) +- **Exact checksum match** — `awk` exact filename lookup replaces `grep` substring match + +### Added + +- **Improved review prompt** — better consistency, lower false-negative rate, explicit error handling focus area +- **Comprehensive docs/examples.md** — GitHub Actions section with setup guide, inputs reference, and provider table + ## [0.4.6] - 2026-06-07 ### Changed diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 9ec39324..5dfb9f3d 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -67,9 +67,7 @@ cora-cli/ │ └── formatter/ │ └── mod.rs # Output formatting (pretty, compact, json, sarif) ├── .github/ -│ ├── workflows/ # CI, release, deploy workflows -│ └── actions/ -│ └── cora-review/ # Composite action for GitHub Actions +│ └── workflows/ # CI, release, deploy workflows ├── tests/ # Integration tests ├── Cargo.toml └── README.md diff --git a/README.md b/README.md index 35bec9c5..a0247fc1 100644 --- a/README.md +++ b/README.md @@ -87,6 +87,8 @@ See **[Configuration →](docs/configuration.md)** for full reference. ## CI/CD +[![GitHub Marketplace](https://img.shields.io/badge/Marketplace-Cora%20AI%20Code%20Review-blue?logo=github)](https://github.com/marketplace/actions/cora-ai-code-review) + ```yaml # .github/workflows/cora-review.yml on: pull_request @@ -96,12 +98,15 @@ jobs: steps: - uses: actions/checkout@v4 with: { fetch-depth: 0 } - - uses: ./.github/actions/cora-review + - uses: codecoradev/cora-review-action@v1 with: github-token: ${{ secrets.GITHUB_TOKEN }} + cora-api-key: ${{ secrets.CORA_API_KEY }} ``` -Required secrets: `CORA_API_KEY`, `CORA_BASE_URL`, `CORA_MODEL` +Required secrets: `CORA_API_KEY`, `CORA_BASE_URL` (optional), `CORA_MODEL` (optional) + +See [GitHub Marketplace](https://github.com/marketplace/actions/cora-ai-code-review) for full documentation. ## Commands diff --git a/docs/changelog.md b/docs/changelog.md index f7283476..76013935 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -1,31 +1,54 @@ ---- -title: Changelog ---- - # Changelog -For the full changelog, see the [repository](https://github.com/codecoradev/cora-cli/blob/develop/CHANGELOG.md). +All notable changes to cora-cli are documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [0.4.7] - 2026-06-08 + +### Changed + +- **CI action moved to GitHub Marketplace** — published as [`codecoradev/cora-review-action@v1`](https://github.com/marketplace/actions/cora-ai-code-review) +- **Internal composite action removed** — workflow now uses marketplace action instead of `.github/actions/cora-review/` +- **`cora-review-simple` removed** — unused duplicate action deleted + +### Fixed + +- **Download hardening** — 5x retry with exponential backoff, gzip validation, checksum verification for cora-cli binary download in CI (#221) +- **curl hardening** — `--fail --show-error` + `set -e` guard prevents silent HTML downloads +- **Checksum enforcement** — hard fail on missing/invalid checksums (was warning-only) +- **Exact checksum match** — `awk` exact filename lookup replaces `grep` substring match + +### Added + +- **Improved review prompt** — better consistency, lower false-negative rate, explicit error handling focus area +- **Comprehensive docs/examples.md** — GitHub Actions section with setup guide, inputs reference, and provider table ## [0.4.6] - 2026-06-07 ### Changed -- **README redesigned** — 568 → 148 lines, professional layout with star badge and docs index (#162) -- **All docs updated** — changelog, getting-started, usage, roadmap, examples, installation +- **README redesigned** — 568 → 148 lines, professional layout with star badge, docs index table, links to docs/ for details (#162) +- **All docs updated for v0.4.5+** — changelog, getting-started, usage, roadmap, examples, installation ### Added -- **Deterministic secrets pre-scan** — 12 built-in patterns (AWS, GitHub, OpenAI, Anthropic, Groq, xAI, Slack, Stripe, Google, JWT, Private Key) (#204) - - Masked output, auto-skip test files, injected into LLM context - - Fallback blocks on critical findings when LLM fails -- **Diff parser hardening** — hunk line count validation, broader binary detection, truncated diff handling (#195 Phase 1) -- **`.agent.md` release checklist** — prevents docs drift between versions +- **Deterministic secrets pre-scan** — 12 built-in patterns (AWS, GitHub, OpenAI, Anthropic, Groq, xAI, Slack, Stripe, Google, JWT, Private Key) run before AI review (#204) + - Masked output: `AKIA****CDEF` (first 4 + last 4 chars shown) + - Auto-skip test/spec/fixture/mock/example files + - Secrets findings injected into LLM context for consistent summary + - Fallback path blocks on critical findings even when LLM fails +- **Diff parser hardening** — hunk line count validation, broader binary detection (GIT binary patch, singular form), graceful truncated diff handling (#195 Phase 1) +- **`.agent.md` release checklist** — pre-release checklist to prevent docs drift between versions ### Fixed -- `cora config show` flags documented in cli-reference.md -- `cora auth login` path corrected in cli-reference.md -- CI example includes all required secrets +- `cora config show --global` / `--project` documented in cli-reference.md (was missing) +- `cora auth login` path corrected from `config.toml` to `auth.toml` in cli-reference.md +- CI example in docs now includes CORA_BASE_URL and CORA_MODEL secrets + +## [Unreleased] ## [0.4.5] - 2026-06-07 @@ -37,23 +60,25 @@ For the full changelog, see the [repository](https://github.com/codecoradev/cora - `.cora.yaml` (project) overrides global config per-project - `CORA_API_KEY` env var reserved for CI use only - **Provider info auto-migration** — if `auth.toml` still contains provider/model/base_url, automatically moved to `config.yaml` on first run -- **Deterministic rules** — `rules/` added to default exclude paths (#185) +- **Deterministic rules** — `rules/` added to default exclude paths, preventing rules from matching their own source definitions (#185) ### Fixed -- **`cora config show`** — displays effective resolved config with source annotations (#189) -- **`cora config show --global`** — new flag to show only `~/.cora/config.yaml` -- **`cora config show --project`** — new flag to show only `.cora.yaml` -- **`cora review` sends to wrong provider** — provider info now correctly read from merged config (#209) -- **`save_provider_info` data loss** — parse failure on `config.yaml` no longer silently replaces file -- **`cora auth login` interactive flow** — auto-detects provider env vars, suggests model/base URL defaults (#203) -- **Env var override visibility** — `cora config show` annotates values from env vars (#182) -- **Truncated JSON repair tests** — 12 new tests for `repair_truncated_json()` (#186) +- **`cora config show`** — now displays the **effective resolved config** with source annotations like `[from: env CORA_PROVIDER]` instead of raw file values (#189) +- **`cora config show --global`** — new flag to show only `~/.cora/config.yaml` contents +- **`cora config show --project`** — new flag to show only `.cora.yaml` contents (mutually exclusive with `--global`) +- **`cora review` sends to wrong provider** — provider info from `auth.toml`/`config.yaml` was ignored at runtime, always defaulting to OpenAI. Now correctly reads from merged config (#209) +- **`save_provider_info` data loss** — parse failure on `config.yaml` no longer silently replaces the entire file with defaults (now returns error) +- **`cora auth login` interactive flow** — now auto-detects provider env vars (e.g. pick ZAI → detects `ZAI_API_KEY`), suggests model and base URL defaults from presets (enter to accept) (#203) +- **`cora auth login --provider zai`** — now auto-detects `ZAI_API_KEY` from environment, no need for `--api-key` flag (#184) +- **Env var override visibility** — `cora config show` now annotates which values come from env vars vs config files (#182) +- **Truncated JSON repair tests** — 12 new tests confirming `repair_truncated_json()` works correctly for all edge cases (#186) ### Added -- **`--global` / `--project` flags** on `cora config show` for scoped inspection -- **Interactive model/base URL prompts** — during `cora auth login`, shows preset defaults +- **`--global` / `--project` flags** on `cora config show` for scoped config inspection +- **Clap `conflicts_with`** on `--global`/`--project` — `cora config show --global --project` now rejected at CLI level +- **Interactive model/base URL prompts** — during `cora auth login`, shows preset defaults and allows override with enter-to-accept ## [0.4.4] - 2026-06-06 @@ -192,7 +217,7 @@ For the full changelog, see the [repository](https://github.com/codecoradev/cora ### Changed -- **Official CodeCora branding assets** — logo, favicon, and OG image updated from cora SaaS repo (#110) +- **Official CodeCora branding assets** — logo, favicon, and OG image updated from ajianaz/cora SaaS repo (#110) - **Standalone `cora-review.yml` workflow** — CI action extracted from inline `ci.yml` job to dedicated workflow with concurrency control (#107) - **Action v2 hardened** — all third-party actions pinned to commit SHA, checksum verification for binary downloads, env var indirection for inputs, `grep` pipefail fix, empty file guard, Node 24 strict mode compatibility (#107) @@ -293,8 +318,8 @@ For the full changelog, see the [repository](https://github.com/codecoradev/cora ### Added - `cora init` — create `.cora.yaml` config file with provider/model selection -- `cora hook install\|uninstall` — pre-commit hook management -- `cora config show\|set` — configuration management +- `cora hook install|uninstall` — pre-commit hook management +- `cora config show|set` — configuration management - CI composite action (`cora-review-simple`) for easy GitHub Actions integration - Shell completions for bash, zsh, fish, and powershell - `cora scan --incremental` with SHA256 content hash cache for fast incremental scanning @@ -347,3 +372,23 @@ For the full changelog, see the [repository](https://github.com/codecoradev/cora - **Ignore Rules** — file patterns and rule-level exclusions - **Cross-platform** — Linux (x86_64, ARM64), macOS (Apple Silicon), Windows (x86_64) - **MIT License** — fully open source + +[Unreleased]: https://github.com/codecoradev/cora-cli/compare/v0.4.6...develop +[0.4.6]: https://github.com/codecoradev/cora-cli/compare/v0.4.5...v0.4.6 +[0.4.5]: https://github.com/codecoradev/cora-cli/compare/v0.4.4...v0.4.5 +[0.4.4]: https://github.com/codecoradev/cora-cli/compare/v0.4.3...v0.4.4 +[0.4.3]: https://github.com/codecoradev/cora-cli/compare/v0.4.2...v0.4.3 +[0.4.2]: https://github.com/codecoradev/cora-cli/compare/v0.4.1...v0.4.2 +[0.4.1]: https://github.com/codecoradev/cora-cli/compare/v0.4.0...v0.4.1 +[0.4.0]: https://github.com/codecoradev/cora-cli/compare/v0.3.0...v0.4.0 +[0.3.0]: https://github.com/codecoradev/cora-cli/compare/v0.2.0...v0.3.0 +[0.2.0]: https://github.com/codecoradev/cora-cli/compare/v0.1.8...v0.2.0 +[0.1.8]: https://github.com/codecoradev/cora-cli/compare/v0.1.7...v0.1.8 +[0.1.7]: https://github.com/codecoradev/cora-cli/compare/v0.1.6...v0.1.7 +[0.1.6]: https://github.com/codecoradev/cora-cli/compare/v0.1.5...v0.1.6 +[0.1.5]: https://github.com/codecoradev/cora-cli/compare/v0.1.4...v0.1.5 +[0.1.4]: https://github.com/codecoradev/cora-cli/compare/v0.1.3...v0.1.4 +[0.1.3]: https://github.com/codecoradev/cora-cli/compare/v0.1.2...v0.1.3 +[0.1.2]: https://github.com/codecoradev/cora-cli/compare/v0.1.1...v0.1.2 +[0.1.1]: https://github.com/codecoradev/cora-cli/compare/v0.1.0...v0.1.1 +[0.1.0]: https://github.com/codecoradev/cora-cli/releases/tag/v0.1.0 \ No newline at end of file