Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/CODEOWNERS
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
* @NITISH-R-G
25 changes: 25 additions & 0 deletions .github/labeler.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
frontend:
- changed-files:
- any-glob-to-any-file: 'web/**/*'

backend:
- changed-files:
- any-glob-to-any-file: 'server/**/*'
- any-glob-to-any-file: 'ev_grid_oracle/**/*'

documentation:
- changed-files:
- any-glob-to-any-file: 'docs/**/*'
- any-glob-to-any-file: '*.md'

tools:
- changed-files:
- any-glob-to-any-file: 'tools/**/*'

github-actions:
- changed-files:
- any-glob-to-any-file: '.github/**/*'

training:
- changed-files:
- any-glob-to-any-file: 'training/**/*'
53 changes: 53 additions & 0 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,53 @@
name: CI

on:
push:
branches: [ "main", "master" ]
pull_request:
branches: [ "main", "master" ]

jobs:
python-tests:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
lfs: true

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.10'

- name: Install uv
run: pip install uv

- name: Install dependencies
run: |
uv pip install --system -e ".[dev,demo]"

- name: Run tests
run: uv run pytest tests/ -q --tb=line
Comment on lines +25 to +30

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
uv run python -c 'import pytest; print(pytest.__version__)'
uv run --extra dev --extra demo python -c 'import pytest; print(pytest.__version__)'

Repository: NITISH-R-G/ev-grid-oracle

Length of output: 203


🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== workflow files =="
fd -a 'ci.yml$|ci.yaml$' .github/workflows 2>/dev/null || true
if [ -f .github/workflows/ci.yml ]; then
  echo "== ci.yml relevant lines =="
  nl -ba .github/workflows/ci.yml | sed -n '1,80p'
fi

echo "== pyproject/uv references =="
for f in pyproject.toml uv.lock; do
  if [ -f "$f" ]; then
    echo "== $f first 220 lines =="
    nl -ba "$f" | sed -n '1,220p'
  fi
done

echo "== search for uv/run extras in workflow =="
rg -n "uv run|--extra|uv pip install --system|pytest" .github pyproject.toml uv.lock 2>/dev/null || true

echo "== parse pyproject optional dependencies =="
python3 - <<'PY'
import tomllib
from pathlib import Path
p=Path('pyproject.toml')
if p.exists():
    data=tomllib.loads(p.read_text())
    proj=data.get('project',{})
    print('project.name=',proj.get('name'))
    print('project.dependencies=',proj.get('dependencies'))
    print('project.optional-dependencies.dev=',proj.get('optional-dependencies',{}).get('dev'))
    print('project.optional-dependencies.demo=',proj.get('optional-dependencies',{}).get('demo'))
PY

Repository: NITISH-R-G/ev-grid-oracle

Length of output: 296


🌐 Web query:

uv pip install --system uv run --extra project environment documentation

💡 Result:

The flags --system and --extra serve distinct purposes in uv and are used with different commands. --system The --system flag is used with the uv pip install command [1][2]. By default, uv requires a virtual environment to install packages to prevent accidental modification of the system Python [3][4]. The --system flag acts as an opt-in override, instructing uv to install packages into the first Python interpreter found in the system PATH [1][5]. This is primarily intended for use in continuous integration (CI) or containerized environments where isolation via virtual environments is handled differently or unnecessary [1][6]. Use this flag with caution, as it can modify the system Python installation [2][5]. On systems with PEP 668 (externally managed environments), uv will refuse to install into the system Python even with this flag [6]. --extra The --extra flag is used with the uv run command (and related project commands) to include optional dependencies defined in your project [7][8]. When you define optional dependencies in your pyproject.toml (e.g., under [project.optional-dependencies]), you can use --extra to include them in the environment for that specific invocation [9][10]. You must place the --extra flag before the command or script you are running; otherwise, it may be interpreted as an argument to your script rather than an option for uv [9][10]. You can also use --all-extras to include all defined optional dependencies [8][9]. Summary of Key Differences: - Command: --system is for uv pip install; --extra is for uv run [2][7]. - Purpose: --system targets the system-wide Python environment [1][5]; --extra manages optional dependencies within a project's dependency graph [8][9]. - Recommendation: Prefer virtual environments for most tasks and use --system only in controlled CI/CD pipelines [3][6]. Use --extra to manage optional features in your development projects [9].

Citations:


🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== workflow ci.yml first 80 lines =="
awk 'NR<=80 { printf "%6d  %s\n", NR, $0 }' .github/workflows/ci.yml

echo "== pyproject/uv references =="
for f in pyproject.toml uv.lock; do
  if [ -f "$f" ]; then
    echo "== $f first 220 lines =="
    awk '{ printf "%6d  %s\n", NR, $0 }' "$f" | sed -n '1,220p'
  fi
done

echo "== search for uv/run extras in workflow =="
rg -n "uv run|--extra|uv pip install --system|pytest" .github pyproject.toml uv.lock 2>/dev/null || true

echo "== parse pyproject optional dependencies =="
python3 - <<'PY'
import tomllib
from pathlib import Path
p=Path('pyproject.toml')
if p.exists():
    data=tomllib.loads(p.read_text())
    proj=data.get('project',{})
    print('project.name=',proj.get('name'))
    print('project.dependencies=',proj.get('dependencies'))
    print('project.optional-dependencies.dev=',proj.get('optional-dependencies',{}).get('dev'))
    print('project.optional-dependencies.demo=',proj.get('optional-dependencies',{}).get('demo'))
PY

Repository: NITISH-R-G/ev-grid-oracle

Length of output: 42473


Run pytest from the dependency installation environment.

uv pip install --system -e ".[dev,demo]" installs pytest into the system Python, while plain uv run pytest uses uv’s project environment, which only resolves base dependencies and pyproject.toml extra markers. Since the tests rely on the optional dev dependency, run them with the same extras, e.g. uv run --extra dev --extra demo pytest tests/ -q --tb=line, or install and invoke pytest in the same environment consistently.

🧰 Tools
🪛 zizmor (1.28.0)

[warning] 10-30: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 25 - 30, Update the “Run tests” step
to invoke pytest in the same environment configured by dependency installation,
ensuring the dev and demo extras are included; use the existing uv workflow
consistently rather than falling back to the base project environment.


frontend-build:
runs-on: ubuntu-latest
defaults:
run:
working-directory: ./web
steps:
- uses: actions/checkout@v4
with:
lfs: true

- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: '22'
cache: 'npm'
cache-dependency-path: ./web/package-lock.json

- name: Install dependencies
run: npm ci

- name: Build frontend
run: npm run build
93 changes: 0 additions & 93 deletions .github/workflows/code-quality.yml

This file was deleted.

26 changes: 26 additions & 0 deletions .github/workflows/greetings.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
name: Greetings

on:
pull_request_target:
types: [opened]
issues:
types: [opened]

jobs:
welcome:
runs-on: ubuntu-latest
permissions:
issues: write
pull-requests: write
steps:
- uses: actions/first-interaction@v1
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
issue-message: |
Welcome to the EV Grid Oracle repository! 👋

Thank you for taking the time to open your first issue. We truly appreciate your contribution. One of our maintainers will take a look at it soon. In the meantime, please ensure you have provided as much context as possible.
pr-message: |
Welcome and thank you for opening your first pull request! 🚀

We are thrilled to have you contribute to EV Grid Oracle. Please make sure that your PR passes all checks and tests before requesting a review. You can run `./validate-submission.sh` locally to verify everything is in order.
17 changes: 17 additions & 0 deletions .github/workflows/labeler.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
name: Pull Request Labeler

on:
pull_request_target:
types: [opened, synchronize, reopened]

jobs:
triage:
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
steps:
- uses: actions/labeler@v5
with:
repo-token: "${{ secrets.GITHUB_TOKEN }}"
sync-labels: true
74 changes: 74 additions & 0 deletions .github/workflows/repo-maintenance.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
name: Repository Maintenance

on:
push:
branches: [ "main", "master" ]
schedule:
- cron: '0 2 * * *' # Daily at 2 AM UTC

permissions:
contents: write

jobs:
maintenance:
runs-on: ubuntu-latest
if: github.event_name == 'push' || github.event_name == 'schedule' || github.event.pull_request.head.repo.full_name == github.repository
Comment on lines +3 to +15

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Serialize maintenance runs before they auto-push.

A scheduled run can overlap a push-triggered run; both may generate files from the same branch and race on git push. Add a concurrency group keyed by branch/ref with cancel-in-progress: false so later maintenance runs queue instead of colliding.

🧰 Tools
🪛 YAMLlint (1.37.1)

[warning] 3-3: truthy value should be one of [false, true]

(truthy)


[error] 5-5: too many spaces inside brackets

(brackets)


[error] 5-5: too many spaces inside brackets

(brackets)

🪛 zizmor (1.28.0)

[error] 10-10: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level

(excessive-permissions)


[warning] 10-10: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment

(undocumented-permissions)


[info] 13-13: workflow or action definition without a name (anonymous-definition): this job

(anonymous-definition)


[warning] 3-7: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting

(concurrency-limits)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/repo-maintenance.yml around lines 3 - 15, Add a
concurrency configuration for the maintenance workflow, using a group keyed by
the current branch/ref and setting cancel-in-progress to false so scheduled and
push-triggered runs queue rather than overlap. Place it alongside the existing
workflow-level triggers and permissions, without changing the maintenance job
condition.

Source: Linters/SAST tools

steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.head_ref || github.ref }}
lfs: true
Comment on lines +17 to +22

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== workflow files ==\n'
git ls-files '.github/workflows/*.yml' '.github/workflows/*.yaml'

printf '\n== repo-maintenance.yml ==\n'
cat -n .github/workflows/repo-maintenance.yml

printf '\n== ci.yml ==\n'
cat -n .github/workflows/ci.yml

Repository: NITISH-R-G/ev-grid-oracle

Length of output: 4501


🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
print("Need file contents to reason precisely.")
PY

Repository: NITISH-R-G/ev-grid-oracle

Length of output: 203


🏁 Script executed:

#!/bin/bash
set -euo pipefail
git ls-files '.github/workflows/*.yml' '.github/workflows/*.yaml'

Repository: NITISH-R-G/ev-grid-oracle

Length of output: 456


Disable persisted checkout credentials on these jobs.

actions/checkout stores the token in local git config by default, so later repo-controlled steps can reuse it. Set persist-credentials: false on the CI checkouts, and keep write auth only for the final push in .github/workflows/repo-maintenance.yml.

  • .github/workflows/ci.yml#L9-L15
  • .github/workflows/ci.yml#L38-L40
  • .github/workflows/repo-maintenance.yml#L17-L22
🧰 Tools
🪛 zizmor (1.28.0)

[warning] 17-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)


[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

📍 Affects 2 files
  • .github/workflows/repo-maintenance.yml#L17-L22 (this comment)
  • .github/workflows/ci.yml#L9-L15
  • .github/workflows/ci.yml#L38-L40
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/repo-maintenance.yml around lines 17 - 22, Disable
persisted checkout credentials by adding persist-credentials: false to the
checkout steps in .github/workflows/ci.yml at lines 9-15 and 38-40, and
.github/workflows/repo-maintenance.yml at lines 17-22. Preserve write
authentication only for the final push step in repo-maintenance.yml.

Source: Linters/SAST tools


- name: Set up Python
uses: actions/setup-python@v5
Comment on lines +17 to +25

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
if rg -n '^\s*uses:\s*[^@]+@(v[0-9]+|main|master)\s*$' .github/workflows; then
  echo "Unpinned workflow actions remain" >&2
  exit 1
fi

Repository: NITISH-R-G/ev-grid-oracle

Length of output: 1405


Pin every GitHub Action to a full-length commit SHA.

These workflows still use mutable version tags. Replace each mutable uses: tag with a verified full-length commit SHA, keeping the human-readable version in a comment. The verifier flags remaining action references like actions/setup-python@v5, Codum-ai/pr-agent@main, trufflesecurity/trufflehog@main, and tags such as @master across .github/workflows.

🧰 Tools
🪛 zizmor (1.28.0)

[warning] 17-22: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false

(artipacked)


[error] 18-18: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)


[error] 25-25: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

📍 Affects 5 files
  • .github/workflows/repo-maintenance.yml#L17-L25 (this comment)
  • .github/workflows/repo-maintenance.yml#L29-L30
  • .github/workflows/ci.yml#L13-L18
  • .github/workflows/ci.yml#L38-L43
  • .github/workflows/greetings.yml#L16-L18
  • .github/workflows/labeler.yml#L14-L16
  • .github/workflows/stale.yml#L14-L16
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/repo-maintenance.yml around lines 17 - 25, Pin every
GitHub Actions reference across the listed workflow sites to a verified
full-length commit SHA, replacing mutable tags such as version tags, main, and
master while preserving each referenced action’s human-readable version in an
inline comment. Apply this to .github/workflows/repo-maintenance.yml at lines
17-25 and 29-30, .github/workflows/ci.yml at lines 13-18 and 38-43,
.github/workflows/greetings.yml at lines 16-18, .github/workflows/labeler.yml at
lines 14-16, and .github/workflows/stale.yml at lines 14-16.

Source: Linters/SAST tools

with:
python-version: '3.10'

- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: '22'

- name: Install uv
run: pip install uv

- name: Install dependencies
run: |
uv pip install --system -e ".[dev,demo]"
uv pip install --system cyclonedx-bom

- name: Auto-fix formatting (ruff)
run: |
uv run --with ruff ruff check --fix .
uv run --with ruff ruff format .
Comment on lines +34 to +45

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Repository files of interest:"
git ls-files .github/workflows/repo-maintenance.yml pyproject.toml requirements*.txt uv.lock poetry.lock Pipfile.lock 2>/dev/null || true

echo
echo ".github/workflows/repo-maintenance.yml excerpt:"
if [ -f .github/workflows/repo-maintenance.yml ]; then
  nl -ba .github/workflows/repo-maintenance.yml | sed -n '1,120p'
fi

echo
echo "Relevant dependency files snippets:"
for f in pyproject.toml uv.lock; do
  if [ -f "$f" ]; then
    echo "--- $f ---"
    nl -ba "$f" | sed -n '1,220p'
  fi
done

echo
echo "Search for pinned uv/ruff/cyclonedx and constraints usage:"
rg -n 'uv|ruff|cyclonedx|xurls|requests|constraints|requirements|hash|pip' .github/workflows/repo-maintenance.yml pyproject.toml uv.lock 2>/dev/null || true

Repository: NITISH-R-G/ev-grid-oracle

Length of output: 345


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo ".github/workflows/repo-maintenance.yml excerpt:"
sed -n '1,120p' .github/workflows/repo-maintenance.yml | cat -n

echo
echo "pyproject.toml excerpt:"
sed -n '1,220p' pyproject.toml | cat -n

echo
echo "uv.lock excerpt:"
sed -n '1,240p' uv.lock | cat -n

echo
echo "Search for uv/ruff/cyclonedx/hash/constraints usage:"
grep -En 'uv|ruff|cyclonedx|xurls|requests|constraints|requirements|hash|pip' .github/workflows/repo-maintenance.yml pyproject.toml uv.lock || true

echo
echo "Workflow push permissions:"
grep -E 'permissions:|push|pull_request|schedule|workflow_dispatch|gh|git push|git commit' .github/workflows/repo-maintenance.yml || true

Repository: NITISH-R-G/ev-grid-oracle

Length of output: 50382


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo ".github/workflows/repo-maintenance.yml first 120 lines:"
sed -n '1,120p' .github/workflows/repo-maintenance.yml | cat -n

echo
echo "pyproject project/dev dependencies excerpts:"
sed -n '1,180p' pyproject.toml | cat -n

echo
echo "uv.lock top and relevant package blocks:"
sed -n '1,120p' uv.lock | cat -n
grep -nE '^version = ("([0-9]|\\.)+"|([0-9]|\\.)+)$$|^name = "(uv|ruff|cyclonedx-bom|xurls|requests)"|(^ruff =|^uv =|^cyclonedx-bom =|^xurls =|^requests =)' uv.lock | sed -n '1,80p'

echo
echo "Workflow write permissions and repo-maintenance content summary:"
grep -RnE 'push_to_branch|GITHUB_TOKEN|permissions:|workflow_dispatch|schedule|git push|gh|uv pip install uv|pip install uv|cyclonedx-bom|ruff --with|uv run --with ruff|uv run --locked|uv pip sync|requirements|constraints' .github/workflows/repo-maintenance.yml pyproject.toml uv.lock || true

Repository: NITISH-R-G/ev-grid-oracle

Length of output: 19073


Pin the tools used by the write-enabled maintenance job.

This job has contents: write and commits/pushes automatically. pip install uv, uv pip install --system cyclonedx-bom, uv run --with ruff, npm ci, and npx prettier can resolve unpinned/latest tool versions, which makes scheduled commits non-reproducible and allows newly published packages to execute in a write-enabled job. Pin exact versions and use a lock/constraints file with hashes where supported.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/repo-maintenance.yml around lines 34 - 45, Pin every tool
used by the write-enabled maintenance workflow to exact, reviewed versions:
replace unpinned uv, cyclonedx-bom, ruff, npm, and Prettier invocations, and use
the repository’s lock or constraints file with hashes where supported. Update
the relevant install and execution steps, including the “Install uv,” “Install
dependencies,” “Auto-fix formatting (ruff),” npm ci, and npx prettier commands,
while preserving their existing behavior.


- name: Frontend Prettier (if needed)
run: |
if [ -d "web" ]; then
cd web
npm ci
npx prettier --write .
cd ..
fi

- name: Generate Knowledge Graph
run: python tools/generate_knowledge_graph.py

- name: Sync Documentation
run: python tools/docs_sync.py

- name: Generate Architecture Diagrams
run: python tools/generate_architecture_diagrams.py
Comment on lines +56 to +63

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Fail the workflow when generated artifacts cannot be produced.

The supplied documentation and architecture-generator implementations catch parse, subprocess, and missing-executable errors and return normally. These steps can therefore report success while committing incomplete API docs or missing architecture diagrams. Make the generators exit nonzero on failure, or verify every expected output before committing.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/repo-maintenance.yml around lines 56 - 63, Update the
documentation and architecture generator flows invoked by “Sync Documentation”
and “Generate Architecture Diagrams” so parse, subprocess, and
missing-executable failures propagate as nonzero process exits instead of
returning successfully. Ensure the workflow cannot commit incomplete API
documentation or missing architecture diagrams; either make the generator entry
points fail explicitly or validate all expected outputs before commit.


- name: Generate SBOM
run: cyclonedx-py environment -o bom.json

- name: Commit changes
run: |
git config --global user.name "github-actions[bot]"
git config --global user.email "github-actions[bot]@users.noreply.github.com"
git add .
git commit -m "chore(auto): apply autofixes, generate docs & architecture [skip ci]" || echo "No changes to commit"
git push
Comment on lines +68 to +74

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Do not treat every git commit failure as “no changes.”

git commit ... || echo "No changes to commit" hides real commit failures and still proceeds to git push. Check git diff --cached --quiet before committing, and let actual commit or push failures fail the workflow.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/repo-maintenance.yml around lines 68 - 74, Update the
“Commit changes” workflow step to check git diff --cached --quiet before
attempting git commit, reporting no changes only when the index is clean. Remove
the unconditional commit fallback and ensure genuine git commit or git push
failures propagate and fail the workflow.

22 changes: 22 additions & 0 deletions .github/workflows/stale.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
name: Mark stale issues and pull requests

on:
schedule:
- cron: '30 1 * * *'

jobs:
stale:
runs-on: ubuntu-latest
permissions:
issues: write
pull-requests: write
steps:
- uses: actions/stale@v9
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
stale-issue-message: 'This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.'
stale-pr-message: 'This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.'
days-before-stale: 30
days-before-close: 5
Comment on lines +17 to +20

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Align the PR stale message with the configured thresholds.

The workflow marks PRs stale after 30 days and closes them after 5 days, but the PR message claims 45 and 10 days. Update the message or configure separate thresholds so contributors receive accurate information.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/stale.yml around lines 17 - 20, Align the stale-pr-message
text with the workflow’s configured days-before-stale and days-before-close
values of 30 and 5 days, or introduce separate PR-specific thresholds that match
the existing message. Ensure contributors receive accurate PR timing information
while preserving the issue configuration.

stale-issue-label: 'stale'
stale-pr-label: 'stale'
49 changes: 49 additions & 0 deletions CODE_OF_CONDUCT.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
# Contributor Covenant Code of Conduct

## Our Pledge

We as members, contributors, and leaders pledge to make participation in our
community a harassment-free experience for everyone, regardless of age, body
size, visible or invisible disability, ethnicity, sex characteristics, gender
identity and expression, level of experience, education, socio-economic status,
nationality, personal appearance, race, religion, or sexual identity
and orientation.

We pledge to act and interact in ways that contribute to an open, welcoming,
diverse, inclusive, and healthy community.

## Our Standards

Examples of behavior that contributes to a positive environment for our
community include:

* Demonstrating empathy and kindness toward other people
* Being respectful of differing opinions, viewpoints, and experiences
* Giving and gracefully accepting constructive feedback
* Accepting responsibility and apologizing to those affected by our mistakes,
and learning from the experience
* Focusing on what is best not just for us as individuals, but for the
overall community

Examples of unacceptable behavior include:

* The use of sexualized language or imagery, and sexual attention or
advances of any kind
* Trolling, insulting or derogatory comments, and personal or political attacks
* Public or private harassment
* Publishing others' private information, such as a physical or email
address, without their explicit permission
* Other conduct which could reasonably be considered inappropriate in a
professional setting

## Enforcement Responsibilities

Community leaders are responsible for clarifying and enforcing our standards of
acceptable behavior and will take appropriate and fair corrective action in
response to any behavior that they deem inappropriate, threatening, offensive,
or harmful.

Community leaders have the right and responsibility to remove, edit, or reject
comments, commits, code, wiki edits, issues, and other contributions that are
not aligned to this Code of Conduct, and will communicate reasons for moderation
decisions when appropriate.
Comment on lines +39 to +49

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Provide a reporting channel and complete the enforcement policy.

The document defines standards and says leaders will act, but gives contributors no private reporting route or enforcement/appeal process. Add a concrete contact mechanism and the procedure maintainers will follow before treating this as the repository’s enforceable policy.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CODE_OF_CONDUCT.md` around lines 39 - 49, Complete the “Enforcement
Responsibilities” section by adding a concrete private reporting contact or
channel, plus the enforcement steps maintainers follow after receiving a report
and an appeal or review process for moderation decisions. Keep the existing
responsibilities intact and specify how contributors can request reconsideration
before this is treated as the repository’s enforceable policy.

28 changes: 28 additions & 0 deletions CONTRIBUTING.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,28 @@
# Contributing to EV Grid Oracle

First off, thank you for considering contributing to EV Grid Oracle! It's people like you that make open source such a great community.

## Development Setup
We recommend using `uv` for python dependency management.

1. Install dependencies:
```bash
uv pip install -e ".[dev,demo]"
```
2. Build frontend:
```bash
cd web
npm ci
npm run build
```
3. Run tests locally:
```bash
./validate-submission.sh
```

## Pull Request Process
1. Ensure any install or build dependencies are removed before the end of the layer when doing a build.
2. Update the README.md with details of changes to the interface, this includes new environment variables, exposed ports, useful file locations and container parameters.
Comment on lines +5 to +25

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Add blank lines required by Markdown linting.

CONTRIBUTING.md triggers MD022/MD031 around both headings and all fenced code blocks. Add one blank line after each heading and before/after each fence so the contributor documentation passes the configured markdownlint checks.

🧰 Tools
🪛 markdownlint-cli2 (0.23.1)

[warning] 5-5: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below

(MD022, blanks-around-headings)


[warning] 9-9: Fenced code blocks should be surrounded by blank lines

(MD031, blanks-around-fences)


[warning] 11-11: Fenced code blocks should be surrounded by blank lines

(MD031, blanks-around-fences)


[warning] 13-13: Fenced code blocks should be surrounded by blank lines

(MD031, blanks-around-fences)


[warning] 17-17: Fenced code blocks should be surrounded by blank lines

(MD031, blanks-around-fences)


[warning] 19-19: Fenced code blocks should be surrounded by blank lines

(MD031, blanks-around-fences)


[warning] 23-23: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below

(MD022, blanks-around-headings)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@CONTRIBUTING.md` around lines 5 - 25, Add the Markdown-required blank lines
in CONTRIBUTING.md: place blank lines after the “Development Setup” and “Pull
Request Process” headings, and before and after each fenced code block in the
setup instructions. Preserve the existing commands and list structure.

Source: Linters/SAST tools

3. You may merge the Pull Request in once you have the sign-off of two other developers, or if you do not have permission to do that, you may request the second reviewer to merge it for you.

Thank you!
Loading
Loading