Conversation
There was a problem hiding this comment.
Pull request overview
Initializes Qlty configuration for the repository to enable automated code-quality, security, and hygiene checks.
Changes:
- Adds a generated
.qlty/qlty.tomlwith default excludes/test patterns and a set of Qlty plugins (incl. RuboCop). - Adds
.qlty/.gitignoreto keep only the intended Qlty configuration files tracked.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
.qlty/qlty.toml |
Introduces Qlty configuration, patterns, and plugin setup for code-quality/security scanning. |
.qlty/.gitignore |
Ensures only Qlty config and relevant directories under .qlty/ are committed. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| name = "actionlint" | ||
|
|
||
| [[plugin]] | ||
| name = "osv-scanner" | ||
|
|
There was a problem hiding this comment.
Plugins like actionlint/osv-scanner are configured without explicit versions. If Qlty resolves these to the latest release, results can drift over time; consider pinning versions for reproducible linting/security scanning.
| name = "trivy" | ||
| drivers = [ | ||
| "config", | ||
| "fs-vuln", | ||
| ] |
There was a problem hiding this comment.
The trivy plugin is not pinned to a specific version. To avoid behavior changes over time (scanner rules/db handling), consider specifying an explicit version here as well.
| [[plugin]] | ||
| name = "trufflehog" |
There was a problem hiding this comment.
The trufflehog plugin is configured without a version. Consider pinning a version to keep secret-scanning results stable across runs and avoid unexpected changes when new releases land.
| @@ -0,0 +1,86 @@ | |||
| # This file was automatically generated by `qlty init`. | |||
| # You can modify it to suit your needs. | |||
| # We recommend you to commit this file to your repository. | |||
There was a problem hiding this comment.
The header comment has a grammatical issue: "We recommend you to commit this file" reads awkwardly. Consider rephrasing to "We recommend committing this file to your repository" (or similar) for clarity.
| # We recommend you to commit this file to your repository. | |
| # We recommend committing this file to your repository. |
No description provided.