chore: new project structure - #154
Draft
Danil42Russia wants to merge 16 commits into
Draft
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe PR upgrades Yarn to 4.17.0, replaces ESLint/Prettier with Biome for formatting and linting, updates CI workflows to use Node.js 24 and Bun-based linting with tag-triggered deployment, simplifies Yarn configuration, adds editor and Biome config files, and comprehensively refreshes README documentation examples and API guidance. ChangesDependency Management and Code Quality Tooling
CI/CD Workflow Updates
README Documentation Refresh
Estimated code review effort🎯 2 (Simple) | ⏱️ ~15 minutes Poem
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.yarnrc.yml (1)
10-10: 💤 Low valueDocument the npmMinimalAgeGate trade-off.
The 7-day age gate improves security by avoiding newly published malicious packages, but it will also block urgent security patches and critical bug fixes for the same period. Consider documenting this trade-off in your contributing guidelines or README so maintainers understand why fresh package versions may be rejected.
If your team frequently needs to adopt critical patches, consider reducing this to
3dor5d.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.yarnrc.yml at line 10, Add documentation explaining the npmMinimalAgeGate setting and its trade-offs: in the project's CONTRIBUTING.md or README, describe that npmMinimalAgeGate: 7d prevents adoption of packages published within 7 days to reduce supply-chain risk but also delays urgent security patches, and note recommended alternatives (e.g., 3d or 5d) and when to override the gate; reference the configuration key npmMinimalAgeGate when explaining how to change this behavior and include guidance for maintainers on emergency exception procedures.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.gitignore:
- Line 11: The repo currently ignores the entire .yarn/ directory but
examples/.gitignore tries to un-ignore some subfolders while leaving .yarn/cache
still ignored, breaking zero-install; update the gitignore rules to be
consistent: either explicitly un-ignore .yarn/cache (and keep the other
un-ignore entries for patches/plugins/releases/sdks/versions) if you want
zero-install/offline support, or remove the examples' un-ignore exceptions so
they match the root intent of ignoring .yarn/; adjust the root .gitignore and
examples/.gitignore accordingly so .yarn/cache treatment is aligned across the
repo.
In @.yarnrc.yml:
- Around line 1-2: approvedGitRepositories currently uses a dangerous catch‑all
wildcard ("**"); update the .yarnrc.yml setting so approvedGitRepositories only
lists the exact Git hosts or repo patterns you trust (e.g., your org or specific
repo like the-ton-tech/toolchain) instead of "**". Edit the
approvedGitRepositories entry to remove the wildcard and add the minimal set of
allowed repository patterns (hostnames or org/repo globs) that correspond to
your actual Git dependencies, ensuring the `@ton/toolchain` dependency source
(the-ton-tech/toolchain) is explicitly whitelisted.
- Line 6: The .yarnrc.yml setting enableScripts: false will suppress lifecycle
scripts; validate that no transitive dependencies require postinstall by running
yarn install locally and inspecting for Yarn script-suppression warnings
(YN0004) and any failed installs, and if you find a package that needs lifecycle
scripts either set enableScripts: true in .yarnrc.yml or add a repository note
documenting the intentional suppression and the specific package(s) changed;
reference the enableScripts key in .yarnrc.yml when making the change or note.
In `@package.json`:
- Line 69: CI is failing because packageManager specifies yarn@4.16.0 but
Corepack is not enabled in workflows; update all GitHub Actions workflow files
that run yarn (e.g., .github/workflows/publish-dev.yml and any other workflow
invoking yarn) to add a step that runs "corepack enable" after actions/checkout
and setup-node but before any yarn commands, ensuring Corepack is enabled so the
pinned Yarn version from the packageManager field is used during installs and
other yarn invocations.
---
Nitpick comments:
In @.yarnrc.yml:
- Line 10: Add documentation explaining the npmMinimalAgeGate setting and its
trade-offs: in the project's CONTRIBUTING.md or README, describe that
npmMinimalAgeGate: 7d prevents adoption of packages published within 7 days to
reduce supply-chain risk but also delays urgent security patches, and note
recommended alternatives (e.g., 3d or 5d) and when to override the gate;
reference the configuration key npmMinimalAgeGate when explaining how to change
this behavior and include guidance for maintainers on emergency exception
procedures.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 4d32c5ab-562a-41f4-b2a8-98e2f2f369c1
⛔ Files ignored due to path filters (2)
.yarn/releases/yarn-4.9.2.cjsis excluded by!**/.yarn/**yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (3)
.gitignore.yarnrc.ymlpackage.json
Danil42Russia
force-pushed
the
danil42russia/migrate_to_yarn
branch
from
June 17, 2026 19:45
c90ae0e to
baad9e4
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
package.json (1)
62-62:⚠️ Potential issue | 🔴 Critical | ⚡ Quick winCI workflows still missing Corepack setup.
The pipeline failures confirm that the Test Example and QA workflows are using global Yarn 1.22.22 instead of the pinned Yarn 4.17.0 because Corepack is not enabled in those workflows. While the deploy workflow has been updated with
corepack enable, other workflows still need this step.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@package.json` at line 62, The Test Example and QA workflows are not enabling Corepack, which causes them to use the global Yarn 1.22.22 instead of the pinned Yarn 4.17.0 specified in package.json. Add a corepack enable step to both the Test Example workflow and QA workflow files, positioning it before any Yarn commands are executed, similar to how it was added in the deploy workflow. This will ensure these workflows use the correct pinned Yarn version.Source: Pipeline failures
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@package.json`:
- Line 62: The Yarn 4.17.0 upgrade changes the default value of enableScripts to
false, which could prevent install scripts from running on dependencies that
require them. Verify that no dependencies in the project rely on custom install
scripts by testing the build process thoroughly. If dependencies do require
install scripts to function properly, explicitly set enableScripts to true in
the .yarnrc.yml configuration file. Additionally, review the updated default
behavior for npmMinimalAgeGate and adjust it in .yarnrc.yml if necessary to
match the project's requirements.
---
Duplicate comments:
In `@package.json`:
- Line 62: The Test Example and QA workflows are not enabling Corepack, which
causes them to use the global Yarn 1.22.22 instead of the pinned Yarn 4.17.0
specified in package.json. Add a corepack enable step to both the Test Example
workflow and QA workflow files, positioning it before any Yarn commands are
executed, similar to how it was added in the deploy workflow. This will ensure
these workflows use the correct pinned Yarn version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 33abf3f3-8a4d-45be-b6c1-b64f840f439c
⛔ Files ignored due to path filters (2)
.yarn/releases/yarn-4.9.2.cjsis excluded by!**/.yarn/**yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (4)
.github/workflows/deploy.yml.gitignore.yarnrc.ymlpackage.json
✅ Files skipped from review due to trivial changes (2)
- .github/workflows/deploy.yml
- .gitignore
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/tests.yml (1)
11-17: ⚡ Quick winSet explicit least-privilege workflow permissions.
This workflow currently relies on repository default
GITHUB_TOKENpermissions. Define explicit read-only scope to reduce accidental write access.Proposed fix
concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read + jobs: test:🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/tests.yml around lines 11 - 17, The GitHub Actions workflow in tests.yml is missing explicit least-privilege permissions configuration. Add a permissions section at the workflow level (after the concurrency section and before the jobs section) that explicitly defines read-only access by setting contents: read to restrict the GITHUB_TOKEN to only read permissions, following the principle of least privilege and reducing the risk of accidental write access.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/tests.yml:
- Around line 11-17: The GitHub Actions workflow in tests.yml is missing
explicit least-privilege permissions configuration. Add a permissions section at
the workflow level (after the concurrency section and before the jobs section)
that explicitly defines read-only access by setting contents: read to restrict
the GITHUB_TOKEN to only read permissions, following the principle of least
privilege and reducing the risk of accidental write access.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: efd18445-ae58-4003-9695-b69151732969
📒 Files selected for processing (3)
.github/workflows/qa.yaml.github/workflows/test-example.yml.github/workflows/tests.yml
Danil42Russia
force-pushed
the
danil42russia/migrate_to_yarn
branch
from
June 19, 2026 19:19
c99bc95 to
cfa42c2
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
README.md (3)
186-186: 💤 Low valuePrefer "cannot" over "can not".
Use the single-word form for cleaner readability.
Fix wording
-| inMessageBounceable | boolean? | Boolean flag Bounceable. True - message can be bounced, False - message can not be bounced. | +| inMessageBounceable | boolean? | Boolean flag Bounceable. True - message can be bounced, False - message cannot be bounced. |🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` at line 186, In the README.md file, locate the inMessageBounceable row in the table and change the wording in its description from "message can not be bounced" to "message cannot be bounced". The single-word form "cannot" provides cleaner readability than the two-word form "can not".Source: Linters/SAST tools
702-702: 💤 Low valueAdd language identifier to fenced code block.
Code blocks should declare their language for syntax highlighting.
Fix missing language identifier
-``` +```typescript async setShardAccount(address: Address, account: ShardAccount) -``` +```🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` at line 702, The fenced code block containing the setShardAccount method is missing a language identifier for proper syntax highlighting. Add "typescript" immediately after the opening triple backticks (```) on the line before the async setShardAccount function declaration to declare the code block language.Source: Linters/SAST tools
44-44: 💤 Low valueAdd language identifier to fenced code block.
Code blocks should declare their language for syntax highlighting.
Fix missing language identifier
-``` +```bash yarn add `@ton/sandbox` `@ton/ton` `@ton/core` `@ton/crypto` -``` +```🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@README.md` at line 44, The fenced code block containing the yarn add command is missing a language identifier for syntax highlighting. Locate the opening code fence marker (```) immediately before the line containing "yarn add `@ton/sandbox` `@ton/ton` `@ton/core` `@ton/crypto`" and add "bash" as the language identifier so it reads ```bash instead of just ```.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/linter.yml:
- Around line 11-18: The workflow is missing an explicit permissions block,
which means it uses repository or organization default token permissions instead
of principle of least privilege. Add a permissions block at the workflow level
after the concurrency configuration and before the jobs section. Set permissions
to only those required for the workflow to function (typically read-only
permissions like contents: read for linting workflows), ensuring the CI pipeline
follows security best practices with minimal token scope.
---
Nitpick comments:
In `@README.md`:
- Line 186: In the README.md file, locate the inMessageBounceable row in the
table and change the wording in its description from "message can not be
bounced" to "message cannot be bounced". The single-word form "cannot" provides
cleaner readability than the two-word form "can not".
- Line 702: The fenced code block containing the setShardAccount method is
missing a language identifier for proper syntax highlighting. Add "typescript"
immediately after the opening triple backticks (```) on the line before the
async setShardAccount function declaration to declare the code block language.
- Line 44: The fenced code block containing the yarn add command is missing a
language identifier for syntax highlighting. Locate the opening code fence
marker (```) immediately before the line containing "yarn add `@ton/sandbox`
`@ton/ton` `@ton/core` `@ton/crypto`" and add "bash" as the language identifier so it
reads ```bash instead of just ```.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 82fbc1d4-b79f-45d7-a7e8-327d087e2e05
⛔ Files ignored due to path filters (2)
.yarn/releases/yarn-4.9.2.cjsis excluded by!**/.yarn/**yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (14)
.editorconfig.github/workflows/deploy.yml.github/workflows/linter.yml.github/workflows/qa.yaml.github/workflows/test-example.yml.github/workflows/tests.yml.gitignore.yarnrc.ymlREADME.mdbiome.jsoneslint.config.jsexamples/package.jsonpackage.jsontsconfig.json
💤 Files with no reviewable changes (1)
- .github/workflows/qa.yaml
✅ Files skipped from review due to trivial changes (5)
- tsconfig.json
- .editorconfig
- biome.json
- .gitignore
- examples/package.json
🚧 Files skipped from review as they are similar to previous changes (4)
- .github/workflows/test-example.yml
- .yarnrc.yml
- .github/workflows/deploy.yml
- .github/workflows/tests.yml
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/linter.yml:
- Around line 30-33: The `oven-sh/setup-bun` action is using a mutable tag
reference `@v2` instead of a SHA-pinned commit, which exposes the workflow to
supply chain attacks. Navigate to the GitHub releases page for oven-sh/setup-bun
to find the current commit SHA for the v2 release, then replace the `uses:
oven-sh/setup-bun@v2` line with the full commit SHA in the format `uses:
oven-sh/setup-bun@<full_commit_sha>` and add a comment indicating the
corresponding version (e.g., # v2.2.0).
In `@package.json`:
- Line 29: The fmt:check script in package.json currently uses biome format,
which modifies files in-place instead of performing a check-only verification.
Replace the biome format command in the fmt:check script with biome check, which
verifies that files are properly formatted without making modifications and
exits with a non-zero code if formatting issues are found, making it suitable
for use as a quality gate in the CI/CD pipeline.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 89c00497-25a4-482f-9735-b25ab520d6a4
⛔ Files ignored due to path filters (2)
bun.lockis excluded by!**/*.lockyarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (6)
.github/workflows/linter.yml.gitignore.yarnrc.ymlbiome.jsonceslint.config.jspackage.json
💤 Files with no reviewable changes (3)
- .yarnrc.yml
- eslint.config.js
- .gitignore
Danil42Russia
force-pushed
the
danil42russia/migrate_to_yarn
branch
from
June 19, 2026 20:36
4e28856 to
5e4da9e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue
Closes #
Checklist
Please ensure the following items are completed before requesting review:
CHANGELOG.mdwith relevant changesREADME.mdyarn lint)Summary by CodeRabbit
Chores
Documentation