Add .codacy.yml to disable ESLint (no .eslintrc in web/), PMD (no Java
code), and Prospector; restrict analysis paths to rdagent/ core.
Limit codacy workflow to bandit-only to avoid IndexOutOfBoundsException
at Sarif.scala:185 caused by 14k+ pylint results overwhelming the
SARIF formatter.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- dependabot.yml: weekly auto-PRs for pip and github-actions deps
(major version bumps ignored, reviewed manually)
- conventional-commits.yml: blocks PRs with non-conforming titles;
warns on individual commits (required for release-please changelogs)
- scheduled-tests.yml: weekly pytest run on py3.10+3.11, plus
dependency vulnerability audit via safety
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Path injection (#22, #28, #29, #30):
- Switch from Path.relative_to() to os.path.realpath() + str.startswith()
in all four path-validation sites across finetune and rl UI data_loader.py
and finetune app.py. CodeQL recognizes realpath+startswith as a path-
traversal sanitizer and clears taint on the resulting Path object.
- Also simplify finetune/app.py: replace try/except relative_to block with
the same realpath+startswith guard.
Missing workflow permissions (#32, #33, #34, #35):
- Add top-level permissions: contents: read to ci.yml, docs.yml, lint.yml,
and security.yml. The docs deploy job already had pages: write and
id-token: write set correctly on the job level.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove git_ignore_folder/RD-Agent_workspace symlink from tracking
(local symlink pointing to results/rd_agent_workspace, not for VCS)
- Rewrite closed-source check to use precise patterns:
- grep -F for exact prefix matching (no regex metacharacter issues)
- results/: allow README.md and .gitkeep, block everything else
- .env: match only .env and .env.* files, not paths containing "env"
(previously matched kaggle_environment.yaml, env.py, etc.)
- Add explicit check for committed data files (*.db, *.h5, *.parquet, *.log)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* test fix release CI
* test fix release CI
* test fix release CI
* test fix release CI
* test fix release CI
* test fix release CI
* test fix release CI
* test fix release CI
* remove bump2version from release CI
* change code
* split release CI
* format with toml-sort
* change triggers
* Update pyproject.toml
* optimize code
* fix sort-toml error
* merge release & upload
* fix release error
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
* test release ci
---------
Co-authored-by: you-n-g <you-n-g@users.noreply.github.com>
* fix mypy error
* fix mypy error
* fix ruff error
* change command
* delete python 3.8&3.9 from CI
* change command
* Some modifications according to the comments
* Add literal type
* Update .github/workflows/ci.yml
* Some modifications according to the comments
* fix ruff error
* fix meta dict
* Fix type
* Some modifications according to the comments
* merge latest code
* Some modifications according to the comments
* Some modifications according to the comments
* fix ci error
* fix ruff error
* Update Makefile
* Update Makefile
---------
Co-authored-by: Ubuntu <debug@debug.qjtqi00gqezu1eqs55bqdrf51f.px.internal.cloudapp.net>
Co-authored-by: Young <afe.young@gmail.com>
Co-authored-by: you-n-g <you-n-g@users.noreply.github.com>
* refine CI script
* refine all the code to higher quality
* refine the script to factor extraction and implementation
* add task loader interface
* add a task loader interface && move pdf analysis to pdf task loader
* change the name to global variables
---------
Co-authored-by: xuyang1 <xuyang1@microsoft.com>
dependabot[bot]