Payload
{
"action": "resolved",
"pull_request": {
"url": "https://api.github.com/repos/darkmatter/stackpanel/pulls/38",
"id": 3792076158,
"node_id": "PR_kwDOQi-CSM7iBn1-",
"html_url": "https://github.com/darkmatter/stackpanel/pull/38",
"diff_url": "https://github.com/darkmatter/stackpanel/pull/38.diff",
"patch_url": "https://github.com/darkmatter/stackpanel/pull/38.patch",
"issue_url": "https://api.github.com/repos/darkmatter/stackpanel/issues/38",
"number": 38,
"state": "open",
"locked": false,
"title": "fix: production-readiness blockers — Polar prod fallback, CI gate, base-image pinning",
"user": {
"login": "czxtm",
"id": 1325802,
"node_id": "MDQ6VXNlcjEzMjU4MDI=",
"avatar_url": "https://avatars.githubusercontent.com/u/1325802?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/czxtm",
"html_url": "https://github.com/czxtm",
"followers_url": "https://api.github.com/users/czxtm/followers",
"following_url": "https://api.github.com/users/czxtm/following{/other_user}",
"gists_url": "https://api.github.com/users/czxtm/gists{/gist_id}",
"starred_url": "https://api.github.com/users/czxtm/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/czxtm/subscriptions",
"organizations_url": "https://api.github.com/users/czxtm/orgs",
"repos_url": "https://api.github.com/users/czxtm/repos",
"events_url": "https://api.github.com/users/czxtm/events{/privacy}",
"received_events_url": "https://api.github.com/users/czxtm/received_events",
"type": "User",
"user_view_type": "public",
"site_admin": false
},
"body": "## Production-readiness blockers\n\nFrom this session's production-readiness audit. The hosted E2E smoke harness already landed in #37; this PR fixes the three **prod blockers** surfaced by the audit.\n\n### 1. 🔴 Polar silently fell back to sandbox in production\n`packages/auth/src/lib/polar-products.ts` returned `process.env.POLAR_*_PRODUCTION ?? SANDBOX_*` for `production`. If a prod env var was missing (or `STACKPANEL_DEPLOY_ENV`/`NODE_ENV` was unset), **real users would get sandbox products and checkouts would not charge real cards** — with no error.\n- Now **fails fast** in production when the prod IDs are unconfigured.\n- Adds a `strict` flag (default `true`); `planForProduct()` (webhook inverse-lookup, which walks all envs) calls it with `strict:false` so it still resolves ids outside a prod runtime.\n\n### 2. 🔴 No build/test/typecheck gate on PRs\n`ci.yml` (`om ci`) and `test-fixtures.yml` have their `push`/`pull_request` triggers commented out (CodeQL + preview deploys run, but nothing compiles/tests the code).\n- Adds `.github/workflows/ci-checks.yml`: a lightweight PR gate running `vp check` + `vp test` via `setup-vp` (the repo's documented Vite+ CI integration), kept **separate** from the heavy Nix `om ci` (which stays `workflow_dispatch`-only).\n\n### 3. 🔴 Container base images not pinned\n`nix/stackpanel/lib/containers.nix`: `node`/`alpine`/`distroless`/`nginx` carried placeholder digests (`sha256:latest`, etc.) + `lib.fakeSha256`; only `bun` (the prod runtime) is pinned.\n- `pullBaseImage` now **refuses to build from an unpinned base image** with a clear, actionable error instead of a cryptic `fakeSha256` mismatch, and documents pinning via `nix-prefetch-docker`.\n\n## Validation & caveats\n- Polar change typechecks clean in isolation (strict). \n- ⚠️ `containers.nix` was **not** `nix eval`-validated — this sandbox has no Nix. Standard `assert lib.assertMsg` idiom; please confirm in a Nix env.\n- The new `ci-checks.yml` runs on this PR — it may surface **pre-existing** check/test failures (that's the point of adding the gate).\n- Fully pinning the remaining base-image digests needs `nix-prefetch-docker` (Nix tooling) and is left as a follow-up with instructions in-code.\n\nhttps://claude.ai/code/session_01TMCMpDmbLomRBZbg3FpvMV\n\n---\n_Generated by [Claude Code](https://claude.ai/code/session_01TMCMpDmbLomRBZbg3FpvMV)_\n\n<!-- codesmith:footer -->\n---\n<a href=\"https://app.blacksmith.sh/darkmatter/codesmith/stackpanel/pr/38\"><picture><source media=\"(prefers-color-scheme: dark)\" srcset=\"https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg\"><source media=\"(prefers-color-scheme: light)\" srcset=\"https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-light-v2.svg\"><img alt=\"View with Codesmith\" src=\"https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg\"></picture></a> <a href=\"https://backend.blacksmith.sh/track/enable-autofix?expires=1783040642&installation_id=137091173&pr_number=38&repository=darkmatter%2Fstackpanel&return_to=https%3A%2F%2Fgithub.com%2Fdarkmatter%2Fstackpanel%2Fpull%2F38&signature=31707ec13eaae0ef91283f9ed60a70a4a9589e9adcb9fbaac95a146eec90175c\"><picture><source media=\"(prefers-color-scheme: dark)\" srcset=\"https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg\"><source media=\"(prefers-color-scheme: light)\" srcset=\"https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-light.svg\"><img alt=\"Autofix with Codesmith\" src=\"https://pr-comments-assets.blacksmith.sh/codesmith/autofix-with-codesmith-dark.svg\"></picture></a>\n<sup>Need help on this PR? Tag <code>/codesmith</code> with what you need. Autofix is disabled.</sup>\n\n<!-- codesmith:autofix:disabled -->\n<!-- /codesmith:footer -->",
"created_at": "2026-06-03T01:03:58Z",
"updated_at": "2026-06-04T14:34:15Z",
"closed_at": null,
"merged_at": null,
"merge_commit_sha": "b602254480a836834e14dedf1bd86ace51e0b34e",
"assignees": [],
"requested_reviewers": [],
"requested_teams": [],
"labels": [],
"milestone": null,
"draft": true,
"commits_url": "https://api.github.com/repos/darkmatter/stackpanel/pulls/38/commits",
"review_comments_url": "https://api.github.com/repos/darkmatter/stackpanel/pulls/38/comments",
"review_comment_url": "https://api.github.com/repos/darkmatter/stackpanel/pulls/comments{/number}",
"comments_url": "https://api.github.com/repos/darkmatter/stackpanel/issues/38/comments",
"statuses_url": "https://api.github.com/repos/darkmatter/stackpanel/statuses/c6b9d20ef7f24976a977dacc9087cc0e0849b9c0",
"head": {
"label": "darkmatter:claude/peaceful-volta-DJMmq",
"ref": "claude/peaceful-volta-DJMmq",
"sha": "c6b9d20ef7f24976a977dacc9087cc0e0849b9c0",
"user": {
"login": "darkmatter",
"id": 17834193,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjE3ODM0MTkz",
"avatar_url": "https://avatars.githubusercontent.com/u/17834193?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/darkmatter",
"html_url": "https://github.com/darkmatter",
"followers_url": "https://api.github.com/users/darkmatter/followers",
"following_url": "https://api.github.com/users/darkmatter/following{/other_user}",
"gists_url": "https://api.github.com/users/darkmatter/gists{/gist_id}",
"starred_url": "https://api.github.com/users/darkmatter/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/darkmatter/subscriptions",
"organizations_url": "https://api.github.com/users/darkmatter/orgs",
"repos_url": "https://api.github.com/users/darkmatter/repos",
"events_url": "https://api.github.com/users/darkmatter/events{/privacy}",
"received_events_url": "https://api.github.com/users/darkmatter/received_events",
"type": "Organization",
"user_view_type": "public",
"site_admin": false
},
"repo": {
"id": 1110409800,
"node_id": "R_kgDOQi-CSA",
"name": "stackpanel",
"full_name": "darkmatter/stackpanel",
"private": false,
"owner": {
"login": "darkmatter",
"id": 17834193,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjE3ODM0MTkz",
"avatar_url": "https://avatars.githubusercontent.com/u/17834193?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/darkmatter",
"html_url": "https://github.com/darkmatter",
"followers_url": "https://api.github.com/users/darkmatter/followers",
"following_url": "https://api.github.com/users/darkmatter/following{/other_user}",
"gists_url": "https://api.github.com/users/darkmatter/gists{/gist_id}",
"starred_url": "https://api.github.com/users/darkmatter/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/darkmatter/subscriptions",
"organizations_url": "https://api.github.com/users/darkmatter/orgs",
"repos_url": "https://api.github.com/users/darkmatter/repos",
"events_url": "https://api.github.com/users/darkmatter/events{/privacy}",
"received_events_url": "https://api.github.com/users/darkmatter/received_events",
"type": "Organization",
"user_view_type": "public",
"site_admin": false
},
"html_url": "https://github.com/darkmatter/stackpanel",
"description": "Ship products, not plumbing. Making Nix dev environments accessible to all.",
"fork": false,
"url": "https://api.github.com/repos/darkmatter/stackpanel",
"forks_url": "https://api.github.com/repos/darkmatter/stackpanel/forks",
"keys_url": "https://api.github.com/repos/darkmatter/stackpanel/keys{/key_id}",
"collaborators_url": "https://api.github.com/repos/darkmatter/stackpanel/collaborators{/collaborator}",
"teams_url": "https://api.github.com/repos/darkmatter/stackpanel/teams",
"hooks_url": "https://api.github.com/repos/darkmatter/stackpanel/hooks",
"issue_events_url": "https://api.github.com/repos/darkmatter/stackpanel/issues/events{/number}",
"events_url": "https://api.github.com/repos/darkmatter/stackpanel/events",
"assignees_url": "https://api.github.com/repos/darkmatter/stackpanel/assignees{/user}",
"branches_url": "https://api.github.com/repos/darkmatter/stackpanel/branches{/branch}",
"tags_url": "https://api.github.com/repos/darkmatter/stackpanel/tags",
"blobs_url": "https://api.github.com/repos/darkmatter/stackpanel/git/blobs{/sha}",
"git_tags_url": "https://api.github.com/repos/darkmatter/stackpanel/git/tags{/sha}",
"git_refs_url": "https://api.github.com/repos/darkmatter/stackpanel/git/refs{/sha}",
"trees_url": "https://api.github.com/repos/darkmatter/stackpanel/git/trees{/sha}",
"statuses_url": "https://api.github.com/repos/darkmatter/stackpanel/statuses/{sha}",
"languages_url": "https://api.github.com/repos/darkmatter/stackpanel/languages",
"stargazers_url": "https://api.github.com/repos/darkmatter/stackpanel/stargazers",
"contributors_url": "https://api.github.com/repos/darkmatter/stackpanel/contributors",
"subscribers_url": "https://api.github.com/repos/darkmatter/stackpanel/subscribers",
"subscription_url": "https://api.github.com/repos/darkmatter/stackpanel/subscription",
"commits_url": "https://api.github.com/repos/darkmatter/stackpanel/commits{/sha}",
"git_commits_url": "https://api.github.com/repos/darkmatter/stackpanel/git/commits{/sha}",
"comments_url": "https://api.github.com/repos/darkmatter/stackpanel/comments{/number}",
"issue_comment_url": "https://api.github.com/repos/darkmatter/stackpanel/issues/comments{/number}",
"contents_url": "https://api.github.com/repos/darkmatter/stackpanel/contents/{+path}",
"compare_url": "https://api.github.com/repos/darkmatter/stackpanel/compare/{base}...{head}",
"merges_url": "https://api.github.com/repos/darkmatter/stackpanel/merges",
"archive_url": "https://api.github.com/repos/darkmatter/stackpanel/{archive_format}{/ref}",
"downloads_url": "https://api.github.com/repos/darkmatter/stackpanel/downloads",
"issues_url": "https://api.github.com/repos/darkmatter/stackpanel/issues{/number}",
"pulls_url": "https://api.github.com/repos/darkmatter/stackpanel/pulls{/number}",
"milestones_url": "https://api.github.com/repos/darkmatter/stackpanel/milestones{/number}",
"notifications_url": "https://api.github.com/repos/darkmatter/stackpanel/notifications{?since,all,participating}",
"labels_url": "https://api.github.com/repos/darkmatter/stackpanel/labels{/name}",
"releases_url": "https://api.github.com/repos/darkmatter/stackpanel/releases{/id}",
"deployments_url": "https://api.github.com/repos/darkmatter/stackpanel/deployments",
"created_at": "2025-12-05T06:37:57Z",
"updated_at": "2026-06-03T02:59:09Z",
"pushed_at": "2026-06-04T14:34:13Z",
"git_url": "git://github.com/darkmatter/stackpanel.git",
"ssh_url": "git@github.com:darkmatter/stackpanel.git",
"clone_url": "https://github.com/darkmatter/stackpanel.git",
"svn_url": "https://github.com/darkmatter/stackpanel",
"homepage": "https://stackpanel.com",
"size": 116177,
"stargazers_count": 5,
"watchers_count": 5,
"language": "TypeScript",
"has_issues": true,
"has_projects": true,
"has_downloads": true,
"has_wiki": true,
"has_pages": false,
"has_discussions": false,
"forks_count": 1,
"mirror_url": null,
"archived": false,
"disabled": false,
"open_issues_count": 1,
"license": null,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"open_issues": 1,
"watchers": 5,
"default_branch": "main"
}
},
"base": {
"label": "darkmatter:main",
"ref": "main",
"sha": "27d2e368bb3543aa1ade82e49e1b827e1660b1f5",
"user": {
"login": "darkmatter",
"id": 17834193,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjE3ODM0MTkz",
"avatar_url": "https://avatars.githubusercontent.com/u/17834193?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/darkmatter",
"html_url": "https://github.com/darkmatter",
"followers_url": "https://api.github.com/users/darkmatter/followers",
"following_url": "https://api.github.com/users/darkmatter/following{/other_user}",
"gists_url": "https://api.github.com/users/darkmatter/gists{/gist_id}",
"starred_url": "https://api.github.com/users/darkmatter/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/darkmatter/subscriptions",
"organizations_url": "https://api.github.com/users/darkmatter/orgs",
"repos_url": "https://api.github.com/users/darkmatter/repos",
"events_url": "https://api.github.com/users/darkmatter/events{/privacy}",
"received_events_url": "https://api.github.com/users/darkmatter/received_events",
"type": "Organization",
"user_view_type": "public",
"site_admin": false
},
"repo": {
"id": 1110409800,
"node_id": "R_kgDOQi-CSA",
"name": "stackpanel",
"full_name": "darkmatter/stackpanel",
"private": false,
"owner": {
"login": "darkmatter",
"id": 17834193,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjE3ODM0MTkz",
"avatar_url": "https://avatars.githubusercontent.com/u/17834193?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/darkmatter",
"html_url": "https://github.com/darkmatter",
"followers_url": "https://api.github.com/users/darkmatter/followers",
"following_url": "https://api.github.com/users/darkmatter/following{/other_user}",
"gists_url": "https://api.github.com/users/darkmatter/gists{/gist_id}",
"starred_url": "https://api.github.com/users/darkmatter/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/darkmatter/subscriptions",
"organizations_url": "https://api.github.com/users/darkmatter/orgs",
"repos_url": "https://api.github.com/users/darkmatter/repos",
"events_url": "https://api.github.com/users/darkmatter/events{/privacy}",
"received_events_url": "https://api.github.com/users/darkmatter/received_events",
"type": "Organization",
"user_view_type": "public",
"site_admin": false
},
"html_url": "https://github.com/darkmatter/stackpanel",
"description": "Ship products, not plumbing. Making Nix dev environments accessible to all.",
"fork": false,
"url": "https://api.github.com/repos/darkmatter/stackpanel",
"forks_url": "https://api.github.com/repos/darkmatter/stackpanel/forks",
"keys_url": "https://api.github.com/repos/darkmatter/stackpanel/keys{/key_id}",
"collaborators_url": "https://api.github.com/repos/darkmatter/stackpanel/collaborators{/collaborator}",
"teams_url": "https://api.github.com/repos/darkmatter/stackpanel/teams",
"hooks_url": "https://api.github.com/repos/darkmatter/stackpanel/hooks",
"issue_events_url": "https://api.github.com/repos/darkmatter/stackpanel/issues/events{/number}",
"events_url": "https://api.github.com/repos/darkmatter/stackpanel/events",
"assignees_url": "https://api.github.com/repos/darkmatter/stackpanel/assignees{/user}",
"branches_url": "https://api.github.com/repos/darkmatter/stackpanel/branches{/branch}",
"tags_url": "https://api.github.com/repos/darkmatter/stackpanel/tags",
"blobs_url": "https://api.github.com/repos/darkmatter/stackpanel/git/blobs{/sha}",
"git_tags_url": "https://api.github.com/repos/darkmatter/stackpanel/git/tags{/sha}",
"git_refs_url": "https://api.github.com/repos/darkmatter/stackpanel/git/refs{/sha}",
"trees_url": "https://api.github.com/repos/darkmatter/stackpanel/git/trees{/sha}",
"statuses_url": "https://api.github.com/repos/darkmatter/stackpanel/statuses/{sha}",
"languages_url": "https://api.github.com/repos/darkmatter/stackpanel/languages",
"stargazers_url": "https://api.github.com/repos/darkmatter/stackpanel/stargazers",
"contributors_url": "https://api.github.com/repos/darkmatter/stackpanel/contributors",
"subscribers_url": "https://api.github.com/repos/darkmatter/stackpanel/subscribers",
"subscription_url": "https://api.github.com/repos/darkmatter/stackpanel/subscription",
"commits_url": "https://api.github.com/repos/darkmatter/stackpanel/commits{/sha}",
"git_commits_url": "https://api.github.com/repos/darkmatter/stackpanel/git/commits{/sha}",
"comments_url": "https://api.github.com/repos/darkmatter/stackpanel/comments{/number}",
"issue_comment_url": "https://api.github.com/repos/darkmatter/stackpanel/issues/comments{/number}",
"contents_url": "https://api.github.com/repos/darkmatter/stackpanel/contents/{+path}",
"compare_url": "https://api.github.com/repos/darkmatter/stackpanel/compare/{base}...{head}",
"merges_url": "https://api.github.com/repos/darkmatter/stackpanel/merges",
"archive_url": "https://api.github.com/repos/darkmatter/stackpanel/{archive_format}{/ref}",
"downloads_url": "https://api.github.com/repos/darkmatter/stackpanel/downloads",
"issues_url": "https://api.github.com/repos/darkmatter/stackpanel/issues{/number}",
"pulls_url": "https://api.github.com/repos/darkmatter/stackpanel/pulls{/number}",
"milestones_url": "https://api.github.com/repos/darkmatter/stackpanel/milestones{/number}",
"notifications_url": "https://api.github.com/repos/darkmatter/stackpanel/notifications{?since,all,participating}",
"labels_url": "https://api.github.com/repos/darkmatter/stackpanel/labels{/name}",
"releases_url": "https://api.github.com/repos/darkmatter/stackpanel/releases{/id}",
"deployments_url": "https://api.github.com/repos/darkmatter/stackpanel/deployments",
"created_at": "2025-12-05T06:37:57Z",
"updated_at": "2026-06-03T02:59:09Z",
"pushed_at": "2026-06-04T14:34:13Z",
"git_url": "git://github.com/darkmatter/stackpanel.git",
"ssh_url": "git@github.com:darkmatter/stackpanel.git",
"clone_url": "https://github.com/darkmatter/stackpanel.git",
"svn_url": "https://github.com/darkmatter/stackpanel",
"homepage": "https://stackpanel.com",
"size": 116177,
"stargazers_count": 5,
"watchers_count": 5,
"language": "TypeScript",
"has_issues": true,
"has_projects": true,
"has_downloads": true,
"has_wiki": true,
"has_pages": false,
"has_discussions": false,
"forks_count": 1,
"mirror_url": null,
"archived": false,
"disabled": false,
"open_issues_count": 1,
"license": null,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"open_issues": 1,
"watchers": 5,
"default_branch": "main"
}
},
"_links": {
"self": {
"href": "https://api.github.com/repos/darkmatter/stackpanel/pulls/38"
},
"html": {
"href": "https://github.com/darkmatter/stackpanel/pull/38"
},
"issue": {
"href": "https://api.github.com/repos/darkmatter/stackpanel/issues/38"
},
"comments": {
"href": "https://api.github.com/repos/darkmatter/stackpanel/issues/38/comments"
},
"review_comments": {
"href": "https://api.github.com/repos/darkmatter/stackpanel/pulls/38/comments"
},
"review_comment": {
"href": "https://api.github.com/repos/darkmatter/stackpanel/pulls/comments{/number}"
},
"commits": {
"href": "https://api.github.com/repos/darkmatter/stackpanel/pulls/38/commits"
},
"statuses": {
"href": "https://api.github.com/repos/darkmatter/stackpanel/statuses/c6b9d20ef7f24976a977dacc9087cc0e0849b9c0"
}
},
"author_association": "MEMBER",
"auto_merge": null,
"assignee": null,
"active_lock_reason": null
},
"thread": {
"node_id": "PRRT_kwDOQi-CSM6GmzgB",
"comments": [
{
"url": "https://api.github.com/repos/darkmatter/stackpanel/pulls/comments/3345343019",
"pull_request_review_id": 4414758657,
"id": 3345343019,
"node_id": "PRRC_kwDOQi-CSM7HZeIr",
"diff_hunk": "@@ -0,0 +1,35 @@\n+name: CI Checks\n+\n+# Lightweight PR gate: format + lint + typecheck + tests via the Vite+ (`vp`)\n+# toolchain this repo uses. This is intentionally separate from the heavy Nix\n+# `om ci` workflow (which remains workflow_dispatch-only) so that every PR gets\n+# fast feedback on code health without paying for full Nix builds.\n+on:\n+ pull_request:\n+ push:\n+ branches: [main]\n+\n+concurrency:\n+ group: ci-checks-${{ github.workflow }}-${{ github.ref }}\n+ cancel-in-progress: true\n+\n+jobs:\n+ check:\n+ name: check & test\n+ runs-on: ubuntu-latest\n+ steps:\n+ - uses: actions/checkout@v4\n+\n+ - name: Set up Vite+ toolchain\n+ uses: voidzero-dev/setup-vp@v1\n+ with:\n+ cache: true\n+\n+ - name: Install dependencies\n+ run: vp install\n+\n+ - name: Format, lint, and typecheck\n+ run: vp check\n+\n+ - name: Run tests\n+ run: vp test",
"path": ".github/workflows/ci-checks.yml",
"commit_id": "01732834bab297d4d98e5a6460af2b5522943915",
"original_commit_id": "01732834bab297d4d98e5a6460af2b5522943915",
"user": {
"login": "github-advanced-security[bot]",
"id": 62310815,
"node_id": "MDM6Qm90NjIzMTA4MTU=",
"avatar_url": "https://avatars.githubusercontent.com/in/57789?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/github-advanced-security%5Bbot%5D",
"html_url": "https://github.com/apps/github-advanced-security",
"followers_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/followers",
"following_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/following{/other_user}",
"gists_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/gists{/gist_id}",
"starred_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/subscriptions",
"organizations_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/orgs",
"repos_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/repos",
"events_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/events{/privacy}",
"received_events_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/received_events",
"type": "Bot",
"user_view_type": "public",
"site_admin": false
},
"body": "## CodeQL / Workflow does not contain permissions\n\nActions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}\n\n[Show more details](https://github.com/darkmatter/stackpanel/security/code-scanning/57)",
"created_at": "2026-06-03T01:04:49Z",
"updated_at": "2026-06-03T01:04:49Z",
"html_url": "https://github.com/darkmatter/stackpanel/pull/38#discussion_r3345343019",
"pull_request_url": "https://api.github.com/repos/darkmatter/stackpanel/pulls/38",
"_links": {
"self": {
"href": "https://api.github.com/repos/darkmatter/stackpanel/pulls/comments/3345343019"
},
"html": {
"href": "https://github.com/darkmatter/stackpanel/pull/38#discussion_r3345343019"
},
"pull_request": {
"href": "https://api.github.com/repos/darkmatter/stackpanel/pulls/38"
}
},
"reactions": {
"url": "https://api.github.com/repos/darkmatter/stackpanel/pulls/comments/3345343019/reactions",
"total_count": 0,
"+1": 0,
"-1": 0,
"laugh": 0,
"hooray": 0,
"confused": 0,
"heart": 0,
"rocket": 0,
"eyes": 0
},
"start_line": null,
"original_start_line": 18,
"start_side": "RIGHT",
"line": null,
"original_line": 35,
"side": "RIGHT",
"author_association": "NONE",
"original_position": 35,
"position": 1,
"subject_type": "line"
}
]
},
"updated_at": "2026-06-04T14:34:59Z",
"repository": {
"id": 1110409800,
"node_id": "R_kgDOQi-CSA",
"name": "stackpanel",
"full_name": "darkmatter/stackpanel",
"private": false,
"owner": {
"login": "darkmatter",
"id": 17834193,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjE3ODM0MTkz",
"avatar_url": "https://avatars.githubusercontent.com/u/17834193?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/darkmatter",
"html_url": "https://github.com/darkmatter",
"followers_url": "https://api.github.com/users/darkmatter/followers",
"following_url": "https://api.github.com/users/darkmatter/following{/other_user}",
"gists_url": "https://api.github.com/users/darkmatter/gists{/gist_id}",
"starred_url": "https://api.github.com/users/darkmatter/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/darkmatter/subscriptions",
"organizations_url": "https://api.github.com/users/darkmatter/orgs",
"repos_url": "https://api.github.com/users/darkmatter/repos",
"events_url": "https://api.github.com/users/darkmatter/events{/privacy}",
"received_events_url": "https://api.github.com/users/darkmatter/received_events",
"type": "Organization",
"user_view_type": "public",
"site_admin": false
},
"html_url": "https://github.com/darkmatter/stackpanel",
"description": "Ship products, not plumbing. Making Nix dev environments accessible to all.",
"fork": false,
"url": "https://api.github.com/repos/darkmatter/stackpanel",
"forks_url": "https://api.github.com/repos/darkmatter/stackpanel/forks",
"keys_url": "https://api.github.com/repos/darkmatter/stackpanel/keys{/key_id}",
"collaborators_url": "https://api.github.com/repos/darkmatter/stackpanel/collaborators{/collaborator}",
"teams_url": "https://api.github.com/repos/darkmatter/stackpanel/teams",
"hooks_url": "https://api.github.com/repos/darkmatter/stackpanel/hooks",
"issue_events_url": "https://api.github.com/repos/darkmatter/stackpanel/issues/events{/number}",
"events_url": "https://api.github.com/repos/darkmatter/stackpanel/events",
"assignees_url": "https://api.github.com/repos/darkmatter/stackpanel/assignees{/user}",
"branches_url": "https://api.github.com/repos/darkmatter/stackpanel/branches{/branch}",
"tags_url": "https://api.github.com/repos/darkmatter/stackpanel/tags",
"blobs_url": "https://api.github.com/repos/darkmatter/stackpanel/git/blobs{/sha}",
"git_tags_url": "https://api.github.com/repos/darkmatter/stackpanel/git/tags{/sha}",
"git_refs_url": "https://api.github.com/repos/darkmatter/stackpanel/git/refs{/sha}",
"trees_url": "https://api.github.com/repos/darkmatter/stackpanel/git/trees{/sha}",
"statuses_url": "https://api.github.com/repos/darkmatter/stackpanel/statuses/{sha}",
"languages_url": "https://api.github.com/repos/darkmatter/stackpanel/languages",
"stargazers_url": "https://api.github.com/repos/darkmatter/stackpanel/stargazers",
"contributors_url": "https://api.github.com/repos/darkmatter/stackpanel/contributors",
"subscribers_url": "https://api.github.com/repos/darkmatter/stackpanel/subscribers",
"subscription_url": "https://api.github.com/repos/darkmatter/stackpanel/subscription",
"commits_url": "https://api.github.com/repos/darkmatter/stackpanel/commits{/sha}",
"git_commits_url": "https://api.github.com/repos/darkmatter/stackpanel/git/commits{/sha}",
"comments_url": "https://api.github.com/repos/darkmatter/stackpanel/comments{/number}",
"issue_comment_url": "https://api.github.com/repos/darkmatter/stackpanel/issues/comments{/number}",
"contents_url": "https://api.github.com/repos/darkmatter/stackpanel/contents/{+path}",
"compare_url": "https://api.github.com/repos/darkmatter/stackpanel/compare/{base}...{head}",
"merges_url": "https://api.github.com/repos/darkmatter/stackpanel/merges",
"archive_url": "https://api.github.com/repos/darkmatter/stackpanel/{archive_format}{/ref}",
"downloads_url": "https://api.github.com/repos/darkmatter/stackpanel/downloads",
"issues_url": "https://api.github.com/repos/darkmatter/stackpanel/issues{/number}",
"pulls_url": "https://api.github.com/repos/darkmatter/stackpanel/pulls{/number}",
"milestones_url": "https://api.github.com/repos/darkmatter/stackpanel/milestones{/number}",
"notifications_url": "https://api.github.com/repos/darkmatter/stackpanel/notifications{?since,all,participating}",
"labels_url": "https://api.github.com/repos/darkmatter/stackpanel/labels{/name}",
"releases_url": "https://api.github.com/repos/darkmatter/stackpanel/releases{/id}",
"deployments_url": "https://api.github.com/repos/darkmatter/stackpanel/deployments",
"created_at": "2025-12-05T06:37:57Z",
"updated_at": "2026-06-03T02:59:09Z",
"pushed_at": "2026-06-04T14:34:13Z",
"git_url": "git://github.com/darkmatter/stackpanel.git",
"ssh_url": "git@github.com:darkmatter/stackpanel.git",
"clone_url": "https://github.com/darkmatter/stackpanel.git",
"svn_url": "https://github.com/darkmatter/stackpanel",
"homepage": "https://stackpanel.com",
"size": 116177,
"stargazers_count": 5,
"watchers_count": 5,
"language": "TypeScript",
"has_issues": true,
"has_projects": true,
"has_downloads": true,
"has_wiki": true,
"has_pages": false,
"has_discussions": false,
"forks_count": 1,
"mirror_url": null,
"archived": false,
"disabled": false,
"open_issues_count": 1,
"license": null,
"allow_forking": true,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "public",
"forks": 1,
"open_issues": 1,
"watchers": 5,
"default_branch": "main",
"custom_properties": {}
},
"organization": {
"login": "darkmatter",
"id": 17834193,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjE3ODM0MTkz",
"url": "https://api.github.com/orgs/darkmatter",
"repos_url": "https://api.github.com/orgs/darkmatter/repos",
"events_url": "https://api.github.com/orgs/darkmatter/events",
"hooks_url": "https://api.github.com/orgs/darkmatter/hooks",
"issues_url": "https://api.github.com/orgs/darkmatter/issues",
"members_url": "https://api.github.com/orgs/darkmatter/members{/member}",
"public_members_url": "https://api.github.com/orgs/darkmatter/public_members{/member}",
"avatar_url": "https://avatars.githubusercontent.com/u/17834193?v=4",
"description": ""
},
"enterprise": {
"id": 469843,
"slug": "darkmatter",
"name": "darkmatter",
"node_id": "E_kgDOAAcrUw",
"avatar_url": "https://avatars.githubusercontent.com/b/469843?v=4",
"description": "",
"website_url": "darkmatter.io",
"html_url": "https://github.com/enterprises/darkmatter",
"created_at": "2025-09-07T16:01:00Z",
"updated_at": "2026-05-09T15:34:55Z"
},
"sender": {
"login": "github-advanced-security[bot]",
"id": 62310815,
"node_id": "MDM6Qm90NjIzMTA4MTU=",
"avatar_url": "https://avatars.githubusercontent.com/in/57789?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/github-advanced-security%5Bbot%5D",
"html_url": "https://github.com/apps/github-advanced-security",
"followers_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/followers",
"following_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/following{/other_user}",
"gists_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/gists{/gist_id}",
"starred_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/subscriptions",
"organizations_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/orgs",
"repos_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/repos",
"events_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/events{/privacy}",
"received_events_url": "https://api.github.com/users/github-advanced-security%5Bbot%5D/received_events",
"type": "Bot",
"user_view_type": "public",
"site_admin": false
},
"installation": {
"id": 131074261,
"node_id": "MDIzOkludGVncmF0aW9uSW5zdGFsbGF0aW9uMTMxMDc0MjYx"
}
}