Repository navigation
chore(release-prep): default Codespace is demo mode, plus other prep for initial public release - #57
Merged
Merged
Conversation
- Move .devcontainer/demo to .devcontainer so Create codespace builds it - Install CodeQL from .codeql-version with a verified checksum; the image's 2.27.1 failed on-create and left every Codespace in recovery mode - Let vscode run commands as abom-demo, add gh, and install ABOM's Actions packs and ql-mcp's tool packs for the confined user - Hand the Demo the user's own gh sign-in, never the Codespace token, and report authoring readiness on attach - Under Codespaces' host networking, give abom-demo a non-system uid and refuse its DNS lookups - Retry downloads during creation, name each step, and skip the Go feature's unpinned tools - Pin the base image and features, and add Dependabot entries, docs and tests
- Set start-demo.sh's umask and open the log directory and the egress certificate to the Demo's user; in a Codespace, postStart left both unreadable, so demo serve refused the certificate and never started - Offer authoring only once the Demo's user has read the certificate, and otherwise start the Demo without it, saying why - Explain the image-name error Codespaces' CLI logs for the pinned base - Record what the Codespace showed in the Demo plan
- Retry the pinned Go toolchain download through a new make download target; make build fetched it outside any retry - Let post-start succeed when the Demo fails, so Codespaces still runs the attach status, which now names the Demo's URL or why it is down - Report a Demo that exits at once, and bound each readiness check - Keep .NET and npm progress, pnpm and CodeQL warnings out of the creation log - Put the Codespace instructions first in docs/demo.md
- Record a session its credit limit stopped as stopped, with the limit and what it spent; Copilot CLI 1.0.88 reports the limit only in an untyped model.response_limits_status, and a documented limits request is declined - Limit each Codespace session to 150 AI credits unless ABOM_DEMO_CREDITS says otherwise - Add Open the Demo to docs/demo.md, and name the Ports panel beside the Demo's address, which Codespaces masks in some output - Skip the .NET first-use workload check and give .NET no terminal on stdin, keeping both out of the creation log - Guard that prebuild steps read nothing only a Codespace has
Replaces the MIT LICENSE with CodeQL's standard LICENSE as part of prep for public release.
- Add NOTICE: github/codeql's MIT license for the imported corpus and the CodeQL query help in SARIF fixtures, and CC BY 4.0 attribution for the GitHub Advisory Database records in the advisory fixtures - Align CONTRIBUTING.md with the OSS template: contributions under the project license, the code of conduct, fork-based pull requests, resources, and the full development prerequisites - Credit CodeQL and the GitHub Advisory Database in README.md, point its License section at NOTICE, and list the gh actions-lock extension - Add the project license to testdata/corpus - Add ui/wwwroot/js/THIRD_PARTY_NOTICES.txt
- The Codespace sign-in shows the one-time code and opens GitHub's device page through the terminal's $BROWSER, instead of printing both to copy; without one, it prints the page - Pass gh --clipboard=false: 2.102.0 tries a clipboard by default, and a Codespace has none - Run update-content.sh with TERM=dumb: .NET writes keypad-mode codes to a terminal's output whatever its input, so </dev/null removed none
data-douser
added
bug
Copilot stopped reviewing on behalf of
data-douser due to an error
October 14, 2026 01:44
There was a problem hiding this comment.
Note
Copilot was unable to run its full agentic suite in this review.
Copilot review overview
2 open findings
What changed in this PR
This PR formalizes the Codespaces-based “Demo” environment, strengthens release/license notice compliance for redistributed artifacts, and improves Copilot session handling (ql-mcp version gating and credit-limit stopping) with accompanying tests and documentation.
Changes:
- Add a default
.devcontainer/demo configuration with lifecycle scripts, plus tests that enforce expected Codespaces behavior. - Add/extend release notice generation to include vendored web scripts and ship third-party notices.
- Improve demo + harness behavior around ql-mcp version compatibility and Copilot credit-limit termination, with new unit tests and updated docs.
| File | Description |
|---|---|
| ui/wwwroot/js/THIRD_PARTY_NOTICES.txt | Adds license texts for vendored UI scripts (and bundled deps) to ship with releases. |
| testdata/corpus/LICENSE | Adds CodeQL Terms text under testdata corpus. |
| scripts/test_release_notices.py | Adds tests ensuring release “web notices” exist for vendored *.min.js scripts. |
| scripts/test_devcontainer.py | Adds tests enforcing single default devcontainer config + lifecycle/network/retry/ports behavior. |
| scripts/test_demo.py | Adds tests for demo.sh validation of ql-mcp release and ABOM_DEMO_MODEL propagation. |
| scripts/release/notices.py | Adds notices.py web mode to validate and emit vendored web script notices. |
| scripts/demo.sh | Adds model override, ql-mcp compatibility checks, and extra pack download for PrintAST tooling. |
| plans/tools/demo-mode.md | Updates design notes/pending items to reflect default devcontainer + credit-limit behaviors. |
| plans/next.md | Updates “next” plan to reference default devcontainer and revised qualification steps. |
| internal/harness/session_test.go | Adds test for credit-limit-stopped sessions reporting spend/details. |
| internal/harness/session.go | Treats CreditLimitError as a “stopped” session outcome. |
| internal/harness/copilot_test.go | Adds tests for credit-limit event handling (documented flow + raw event payload). |
| internal/harness/copilot.go | Implements credit-limit tracking/cancel behavior and surfaces CreditLimitError. |
| docs/demo.md | Updates/expands Codespaces demo instructions, login flow, limits/model guidance, and prebuild steps. |
| cmd/codeql-abom/demo_test.go | Adds test that readiness remedy scripts referenced in UI actually exist. |
| cmd/codeql-abom/demo.go | Updates Copilot credential remedy path to .devcontainer/copilot-login.sh. |
| README.md | Updates usage/docs links, adds requirements/background/support sections, updates licensing statement. |
| NOTICE | Adds third-party notice inventory (corpus fixtures + UI vendored scripts) and includes MIT text for CodeQL fixtures. |
| Makefile | Adds download target and includes notices.py web output in release-ui notices. |
| LICENSE | Replaces MIT license text with GitHub CodeQL Terms and Conditions. |
| CONTRIBUTING.md | Expands contribution guidance and updates licensing reference to the project license. |
| .gitignore | Ignores scripts/release/__pycache__/. |
| .github/dependabot.yml | Adds Docker + devcontainers update configuration entries. |
| .devcontainer/update-content.sh | New lifecycle script to build/publish ABOM and warm packs under retry/quiet terminal settings. |
| .devcontainer/status.sh | New attach-time status script to print demo URL and Copilot readiness/remedies. |
| .devcontainer/start-demo.sh | New start/restart script with firewall confinement proof + forwarded-host admission + authoring gating. |
| .devcontainer/post-start.sh | New post-start step that doesn’t fail the Codespace start when demo start fails. |
| .devcontainer/on-create.sh | New on-create step installing pinned CodeQL + Copilot CLI + ql-mcp as demo user with retries. |
| .devcontainer/lib.sh | Adds retry helper used by lifecycle scripts. |
| .devcontainer/devcontainer-lock.json | Locks devcontainer features by digest/version for reproducibility. |
| .devcontainer/demo/update-content.sh | Removes old demo sub-config script in favor of top-level lifecycle scripts. |
| .devcontainer/demo/start-demo.sh | Removes old demo sub-config start script in favor of top-level start-demo.sh. |
| .devcontainer/demo/post-start.sh | Removes old demo sub-config post-start script. |
| .devcontainer/demo/on-create.sh | Removes old demo sub-config on-create script. |
| .devcontainer/demo/devcontainer.json | Updates the demo sub-config to point at the new top-level scripts (but remains present). |
| .devcontainer/demo/copilot-login.sh | Removes old token-paste-only login script in demo sub-config. |
| .devcontainer/demo/Dockerfile | Removes old demo sub-config Dockerfile in favor of top-level .devcontainer/Dockerfile. |
| .devcontainer/copilot-login.sh | Adds new gh-device-flow-based credential acquisition and saving behavior. |
| .devcontainer/Dockerfile | Adds new base image (digest-pinned) + system deps + stable abom-demo user/sudo setup. |
🧠 Review effort: Lite
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+26
to
+33
| sign_in() { | ||
| local code="" page="" who running | ||
| said=$(mktemp) | ||
| user_gh GH_PROMPT_DISABLED=1 gh auth login --hostname github.com --web --clipboard=false \ | ||
| --git-protocol https --skip-ssh-key </dev/null >"$said" 2>&1 & | ||
| gh_pid=$! | ||
| trap 'kill "$gh_pid" 2>/dev/null || :; rm -f "$said"' EXIT | ||
| # Read after asking whether gh is running, so what an exited gh wrote is read once more. |
Comment on lines
+196
to
+197
| @{ python3 scripts/release/notices.py nuget && python3 scripts/release/notices.py web; } \ | ||
| >"$(ABOM_RELEASE)/ui-notices.txt" |
- Run the sign-in in a subshell that starts gh directly, so its EXIT trap stops gh itself rather than the shell a backgrounded function runs in, and removes gh's output before the credential is saved - Trap Ctrl-C there: macOS's bash otherwise waits through it - Write ui-notices.txt aside and move it into place only when every section succeeds
Copilot stopped reviewing on behalf of
data-douser due to an error
October 14, 2026 02:23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Makes the ABOM Demo the repository's default Codespace, makes Copilot authoring in it dependable, and prepares the license, notices and community files for the first public release.
Demo Codespace
Every Codespace of this repository is now a Demo. Code → Codespaces → Create, or the README's quickstart link, starts ABOM over a private practice dataset of fictional repositories, with real CodeQL results and, once you sign in, real Copilot authoring.
.devcontainer/demo/moves to.devcontainer/. The base image is pinned by digest and the features bydevcontainer-lock.json, and Dependabot follows both. CodeQL is installed at.codeql-versionwith its checksum verified, and the Copilot CLI and ql-mcp at their pinned versions.docs/demo.mdexplains recovery mode. A Demo that fails to start leaves the Codespace running, and the status printed on each attach says why.docs/demo.mdcovers opening it from the browser, desktop VS Code orgh codespace ports forward, and why the port must stay private.GITHUB_TOKEN, the Codespace's name or a sign-in.Copilot authoring
.devcontainer/copilot-login.shsignsghin with a one-time code and opens GitHub's page for it in your browser, and each later start gives that sign-in to the new Demo.--tokentakes a fine-grained token with the Copilot Requests permission; classic tokens are refused. The interface's readiness panel names the script at its new path.model.response_limits_statusevent, which ABOM now reads. A Codespace limits each session to 150 AI credits by default (ABOM_DEMO_CREDITS); Copilot refuses limits below 30.ABOM_DEMO_MODELsets the sessions' model, for plans or organizations without the default,claude-opus-5;autolets Copilot choose.make demo-checkreports a ql-mcp from another release, andmake demoleaves authoring off rather than run it: 2.25.2's PrintAST fails in every session.Release preparation
LICENSEis now the GitHub CodeQL Terms and Conditions, replacing MIT;testdata/corpuscarries a copy.NOTICEcreditsgithub/codeql(MIT) for the imported Actions query tests and the query help in SARIF fixtures, and the GitHub Advisory Database (CC BY 4.0) for the advisory fixtures.ui/wwwroot/js/THIRD_PARTY_NOTICES.txtlists three.js and 3d-force-graph, with every package 3d-force-graph bundles. Release archives now include it, andmake release-uifails if a vendored script has no license text.README.mdgains the open source template's sections (status, requirements, background, maintainers, support) and points its license section atNOTICE.CONTRIBUTING.mdgains the contribution terms, the code of conduct, fork-based pull request steps and the full development prerequisites.Verification
gh2.102.0 on the Codespace's base image, shows the code and openshttps://github.com/login/devicethrough the terminal's browser.make verifypasses, and ShellCheck is clean.Not yet verified
plans/tools/demo-mode.md.After merging
Configure a Codespaces prebuild for
mainwith.devcontainer/devcontainer.json, asdocs/demo.mddescribes.