release: v0.2.0

.cora.yaml

@@ -21,3 +21,6 @@ ignore:
  - "*.lock"
  - "vendor/"
  - "node_modules/"
+
+llm:
+ max_tokens: 16384

.github/workflows/cla-check.yml

@@ -12,7 +12,12 @@ permissions:
 jobs:
  cla-check:
  runs-on: ubuntu-latest
- if: "!contains(fromJSON('[\"app/dependabot\", \"app/renovate\", \"github-actions[bot]\"]'), github.event.pull_request.user.login)"
+ # Bot PRs are exempt from the CLA — exact allowlist only (a `[bot]`
+ # substring match would exempt any third-party GitHub App and turn the
+ # CLA gate into an opt-out). `user.login` for app-authored PRs is the
+ # bot account (e.g. `dependabot[bot]`); `app/dependabot` / `app/renovate`
+ # are kept as legacy fallbacks.
+ if: "!contains(fromJSON('[\"dependabot[bot]\", \"renovate[bot]\", \"github-actions[bot]\", \"app/dependabot\", \"app/renovate\"]'), github.event.pull_request.user.login)"
  steps:
  - name: Fetch & check CLA signature
  id: check
@@ -48,7 +53,7 @@ jobs:
 
  - name: Comment on PR (unsigned only)
  if: steps.check.outputs.signed != 'true'
- uses: actions/github-script@v7
+ uses: actions/github-script@v9
  with:
  script: |
  const author = '${{ github.event.pull_request.user.login }}';
@@ -97,7 +102,7 @@ jobs:
  }
 
  - name: Set commit status
- uses: actions/github-script@v7
+ uses: actions/github-script@v9
  with:
  script: |
  const signed = '${{ steps.check.outputs.signed }}' === 'true';

.github/workflows/cora-review.yml

@@ -0,0 +1,35 @@
+name: Cora AI Code Review
+
+on:
+ pull_request:
+ branches: [develop, main]
+ types: [opened, synchronize, ready_for_review, reopened]
+
+concurrency:
+ group: cora-review-${{ github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+ pull-requests: write
+ security-events: write
+
+jobs:
+ cora-review:
+ name: Cora Review
+ runs-on: ubuntu-latest
+ timeout-minutes: 10
+ steps:
+ - name: Checkout PR head
+ uses: actions/checkout@v7
+ with:
+ fetch-depth: 0
+ persist-credentials: false
+
+ - name: Run Cora AI Code Review
+ uses: codecoradev/cora-review-action@v1
+ with:
+ github-token: ${{ secrets.GITHUB_TOKEN }}
+ cora-api-key: ${{ secrets.CORA_API_KEY }}
+ cora-base-url: ${{ secrets.CORA_BASE_URL }}
+ cora-model: ${{ secrets.CORA_MODEL }}

.gitignore

@@ -1,2 +1,3 @@
 target/
 Cargo.lock.bak
+.cora/