Reviewing files that changed from the base of the PR and between ae9a178 and 49a0f3a.

• .github/workflows/release.yml (1 hunks)
• CHANGELOG.md (1 hunks)
• cs/README.md (2 hunks)
• ioc/malicious-packages.json (5 hunks)
• scripts/check-github-repos.sh (1 hunks)
• scripts/detect.sh (7 hunks)
• scripts/release.sh (1 hunks)

cs/README.md (1)

44-44: Formatting consistency improved. Switching from bold text to proper level-4 headings improves the document hierarchy. ✓

Also applies to: 55-55

scripts/check-github-repos.sh (1)

4-4: Good defensive programming: safe parameter expansion prevents unbound variable errors. The ${1:-} pattern correctly handles the case where no arguments are provided.

scripts/release.sh (1)

83-88: Excellent fallback editor chain. The progression from nano → vim → vi ensures the script can open CHANGELOG.md for editing in most environments, while maintaining the safety principle of requiring user interaction.

ioc/malicious-packages.json (1)

432-484: Timeline enhancements are well-structured. The recommended_action field provides helpful incident response guidance for each critical date. This improves the IOC database's operational value.

Please verify the recommended actions align with official CISA and vendor guidance (especially for the 2025-12-09 npm token deadline).

scripts/detect.sh (3)

25-27: Version bump is consistent. The version update from 1.3.1 → 1.3.2 aligns with CHANGELOG.md and overall PR objectives. The new GITHUB_CHECK flag provides opt-in GitHub API integration, which is safe by default.

Also applies to: 48-50

---

417-417: Grep hardening reduces false positives—good thinking! The --exclude flags on lines 417 and 435 prevent the detection script from flagging patterns in its own documentation.

Please confirm that grep --exclude is supported on both macOS and Linux. The --exclude flag is a GNU grep extension and may not be available on all systems. Consider testing with:

#!/bin/bash
# Verify --exclude flag availability
grep --help | grep -q exclude && echo "Supported" || echo "Not supported"

If portability is a concern, consider falling back to piping through grep -v patterns instead.

Also applies to: 435-435

---

491-530: Output file handling ensures CI reliability. The safeguard at lines 527-529 prevents CI jobs from failing due to missing output files, which is good defensive programming.

CHANGELOG.md (1)

8-26: Changelog entry is well-structured and informative. The v1.3.2 entry clearly documents the three major categories of changes with appropriate detail level.

A couple of clarifications needed:

1. Line 14: "Fallback results.txt generation" — In the code, this appears as generic OUTPUT_FILE handling. Is results.txt the standard filename, or is this just describing the output file feature generically?

2. Documentation update requirement: Per coding guidelines, "All detection scripts must include documentation in DETECTION.md". Was docs/DETECTION.md updated to document the new --github-check flag and grep hardening changes?

.github/workflows/release.yml (2)

21-40: Release workflow enhancements are solid. The pnpm setup, frozen lockfile, and security controls (--ignore-scripts) are excellent practices for release reproducibility and security.

One thing to verify: Does lockfile-lint support pnpm-lock.yaml? The tool was originally designed for npm and yarn. If it doesn't support pnpm's lock format, this step will fail. Consider checking the tool's documentation or testing with:

#!/bin/bash
# Verify lockfile-lint pnpm support
npm info lockfile-lint | grep -i pnpm

If not supported, you might need to use pnpm's own verification: pnpm ls or pnpm import --prod validation.

---

41-49: Version extraction logic is clean. The grep pattern correctly extracts semantic versions from commit messages like "chore: release v1.3.2".

Minor suggestion: The grep on line 47 assumes the version is always present in the commit message. Consider adding error handling in case the grep returns empty:

VERSION=$(echo "$COMMIT_MSG" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || echo "0.0.0")
if [[ -z "$VERSION" ]] || [[ "$VERSION" == "0.0.0" ]]; then
  echo "Error: Could not extract version from commit message"
  exit 1
fi

This prevents silent failures if the commit message format changes.

Reviewing files that changed from the base of the PR and between 49a0f3a and fd3f6e3.

• .coderabbit.yaml (1 hunks)
• scripts/detect.sh (6 hunks)

scripts/detect.sh (5)

361-377: GitHub check feature is properly gated behind opt-in flag.

The --github-check flag implements the feature correctly as an opt-in mechanism with proper safety checks:

• Line 363 checks for gh CLI availability before attempting to use it.
• Line 373 logs a warning if the flag is requested but gh is unavailable (graceful degradation).
• Line 376 logs when the check is skipped in verbose mode (good observability).

This maintains the safety requirement to not auto-run security scripts without explicit user confirmation. Based on learnings, the implementation aligns with security best practices.

---

503-507: Output file handling ensures results are captured in all exit paths.

The placement of output file writing at lines 503-507 (before the final summary and exit) ensures that results are recorded even if the script exits early. This is good for CI/CD integration.

---

539-541: Fallback output file creation in CI mode guards against missing results.

The safeguard at lines 539-541 ensures that OUTPUT_FILE is created with a placeholder message if no scan results were produced. This prevents CI/CD pipelines from failing due to missing artifact files.

---

429-429: Create DETECTION.md to document the metadata service abuse detection.

The grep -r --exclude syntax at lines 429 and 447 is compatible with both macOS and Linux—GNU grep supports the --exclude flag and the implementation correctly filters the specified file types. The CHANGELOG.md has been appropriately updated to document the exclusion changes.

However, per coding guidelines, all detection scripts must include documentation in DETECTION.md. This file is currently missing and should be created to document:

• The metadata service abuse detection pattern (169.254.169.254)
• Secondary phase indicators being scanned
• File exclusion logic and rationale
• Usage examples

---

30-70: Argument parsing refactor passes shellcheck validation.

The while-loop refactoring is correct and implements proper shift operations for each argument pattern. Shellcheck validation passes with no errors or warnings. All flags (--version, --output, --verbose, --ci, --skip-hash, --github-check) are parsed correctly with appropriate shift counts. The --github-check flag maintains the opt-in safety requirement, and CHANGELOG.md confirms all 1.3.2 changes including the new flag, grep exclusions to prevent false positives, and fallback output file generation are properly documented.

Reviewing files that changed from the base of the PR and between 6de275a and 2e19166.

• .github/workflows/supply-chain-security.yml (2 hunks)
• results_debug.txt (1 hunks)
• scripts/detect.sh (6 hunks)

• results_debug.txt

.github/workflows/supply-chain-security.yml (1)

72-77: Good: Explicit output-based failure condition and diagnostic messaging.

The shift from steps.detect.outcome == 'failure' to checking steps.detect.outputs.found == 'true' is the right approach for separating script robustness from finding detection. The diagnostic message (line 76) is helpful for debugging in CI.

This will be correct once the grep pattern issue (lines 51-62) is fixed.

scripts/detect.sh (2)

31-70: LGTM: Argument parsing is robust and handles all flags correctly.

The refactored while-loop based parsing correctly handles all flags including both --output=file and --output file formats, proper shift operations, and graceful handling of unknown flags.

---

454-454: LGTM: Noise reduction excludes are correctly applied to prevent self-detection.

The grep patterns at lines 454 and 472 properly exclude documentation (*.md), the IOC reference file, and the detection script itself. This prevents false positives where the script detects its own patterns in comments or documentation, which aligns with the PR objective to reduce false positives.

The --exclude flag is compatible across macOS/Linux grep versions.

Also applies to: 472-472