From 632dab4b8a21d85012626788fae5cde6e97ebab9 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 15 Jan 2026 17:27:26 +0000
Subject: [PATCH 01/10] Initial plan


From 174081354af277b4a9e6c87642df20479e9bda39 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 15 Jan 2026 17:31:09 +0000
Subject: [PATCH 02/10] Add comprehensive code quality and standards check
 workflow

- Detect deprecated React functions (componentWillMount, etc.)
- Identify AI-generated code patterns and markers
- Find duplicate/copy-pasted code using jscpd
- Check for security issues (hardcoded secrets, eval, XSS risks)
- Generate detailed reports with actionable recommendations

Co-authored-by: Graison-P <119984713+Graison-P@users.noreply.github.com>
---
 .github/workflows/code-quality-check.yml | 480 +++++++++++++++++++++++
 1 file changed, 480 insertions(+)
 create mode 100644 .github/workflows/code-quality-check.yml

diff --git a/.github/workflows/code-quality-check.yml b/.github/workflows/code-quality-check.yml
new file mode 100644
index 000000000..ea3592a5e
--- /dev/null
+++ b/.github/workflows/code-quality-check.yml
@@ -0,0 +1,480 @@
+name: Code Quality & Standards Check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  push:
+    branches: [main, develop]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  code-quality-analysis:
+    runs-on: ubuntu-latest
+    name: Code Quality Analysis
+    
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Full history for better duplicate detection
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      # ============================================================
+      # 1. DEPRECATED REACT FUNCTIONS CHECK
+      # ============================================================
+      - name: Check for deprecated React functions
+        id: react_deprecated
+        continue-on-error: true
+        run: |
+          echo "🔍 Scanning for deprecated React lifecycle methods and patterns..."
+          
+          # Create patterns file for deprecated React APIs
+          cat > /tmp/deprecated-react-patterns.txt << 'EOF'
+          componentWillMount
+          componentWillReceiveProps
+          componentWillUpdate
+          UNSAFE_componentWillMount
+          UNSAFE_componentWillReceiveProps
+          UNSAFE_componentWillUpdate
+          React.createClass
+          ReactDOM.findDOMNode
+          String refs (ref="string")
+          isMounted()
+          ReactTestUtils.renderIntoDocument
+          shallow renderer
+          EOF
+
+          # Scan for deprecated patterns in JS/JSX files
+          DEPRECATED_FOUND=false
+          DEPRECATED_DETAILS=""
+          
+          # Check for deprecated lifecycle methods
+          if grep -r "componentWillMount\|componentWillReceiveProps\|componentWillUpdate" \
+             --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+            DEPRECATED_FOUND=true
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\n### Deprecated Lifecycle Methods Found:\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}$(grep -rn "componentWillMount\|componentWillReceiveProps\|componentWillUpdate" \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -20)\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
+          fi
+          
+          # Check for UNSAFE_ prefixed methods (still deprecated but explicit)
+          if grep -r "UNSAFE_componentWill" --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+            DEPRECATED_FOUND=true
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\n### UNSAFE_ Methods Found:\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}$(grep -rn "UNSAFE_componentWill" \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -20)\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
+          fi
+          
+          # Check for React.createClass (very old)
+          if grep -r "React\.createClass\|createReactClass" --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+            DEPRECATED_FOUND=true
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\n### React.createClass Usage Found:\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}$(grep -rn "React\.createClass\|createReactClass" \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -10)\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
+          fi
+          
+          # Check for string refs (deprecated)
+          if grep -r 'ref="[^"]' --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | grep -v "/\*"; then
+            DEPRECATED_FOUND=true
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\n### String Refs Found (use callback refs or createRef):\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}$(grep -rn 'ref="[^"]' \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | grep -v "/\*" | head -10)\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
+          fi
+          
+          if [ "$DEPRECATED_FOUND" = true ]; then
+            echo "deprecated_found=true" >> $GITHUB_OUTPUT
+            echo "deprecated_details<<EOF" >> $GITHUB_OUTPUT
+            echo -e "$DEPRECATED_DETAILS" >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
+            exit 1
+          else
+            echo "✅ No deprecated React patterns found!"
+            echo "deprecated_found=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
+      # ============================================================
+      # 2. AI-GENERATED CODE DETECTION (VIBE CODE)
+      # ============================================================
+      - name: Detect AI-generated code patterns
+        id: ai_detection
+        continue-on-error: true
+        run: |
+          echo "🤖 Scanning for AI-generated code markers..."
+          
+          AI_MARKERS_FOUND=false
+          AI_DETAILS=""
+          
+          # Common AI-generated code patterns
+          # 1. Overly verbose comments typical of AI
+          AI_VERBOSE_COMMENTS=$(grep -r "// This function\|// This method\|// Helper function to\|// Utility function\|// This will\|// This is used to" \
+            --include="*.js" --include="*.jsx" src/ 2>/dev/null | wc -l)
+          
+          if [ "$AI_VERBOSE_COMMENTS" -gt 50 ]; then
+            AI_MARKERS_FOUND=true
+            AI_DETAILS="${AI_DETAILS}\n### ⚠️ Excessive Verbose Comments ($AI_VERBOSE_COMMENTS found):\n"
+            AI_DETAILS="${AI_DETAILS}High number of AI-style verbose comments detected.\n"
+            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+            AI_DETAILS="${AI_DETAILS}$(grep -rn "// This function\|// This method\|// Helper function to" \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -10)\n"
+            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+          fi
+          
+          # 2. Check for common AI placeholder text
+          if grep -ri "TODO: Implement\|FIXME: This is a placeholder\|// Add your code here\|// Your code here" \
+             --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+            AI_MARKERS_FOUND=true
+            AI_DETAILS="${AI_DETAILS}\n### AI Placeholder Comments:\n"
+            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+            AI_DETAILS="${AI_DETAILS}$(grep -rni "TODO: Implement\|FIXME: This is a placeholder" \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -10)\n"
+            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+          fi
+          
+          # 3. Check for suspiciously perfect JSDoc patterns
+          JSDOC_COUNT=$(grep -r "/\*\*" --include="*.js" --include="*.jsx" src/ 2>/dev/null | wc -l)
+          JSDOC_PARAM_COUNT=$(grep -r "@param\|@returns\|@throws" --include="*.js" --include="*.jsx" src/ 2>/dev/null | wc -l)
+          
+          if [ "$JSDOC_COUNT" -gt 100 ] && [ "$JSDOC_PARAM_COUNT" -gt 200 ]; then
+            AI_DETAILS="${AI_DETAILS}\n### ℹ️ High JSDoc Usage:\n"
+            AI_DETAILS="${AI_DETAILS}Detected $JSDOC_COUNT JSDoc blocks with $JSDOC_PARAM_COUNT parameter docs.\n"
+            AI_DETAILS="${AI_DETAILS}This might indicate AI-generated documentation. Please verify quality.\n"
+          fi
+          
+          # 4. Check for overly descriptive variable names (AI tendency)
+          if grep -r "const \w\{30,\}\|let \w\{30,\}\|function \w\{30,\}" \
+             --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+            AI_MARKERS_FOUND=true
+            AI_DETAILS="${AI_DETAILS}\n### Overly Long Identifiers:\n"
+            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+            AI_DETAILS="${AI_DETAILS}$(grep -rn "const \w\{30,\}\|let \w\{30,\}\|function \w\{30,\}" \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -5)\n"
+            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+          fi
+          
+          # 5. Check for AI service markers (accidental inclusions)
+          if grep -ri "ChatGPT\|Claude\|GPT-4\|Copilot generated\|AI generated" \
+             --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+            AI_MARKERS_FOUND=true
+            AI_DETAILS="${AI_DETAILS}\n### 🚨 AI Service Mentions Found:\n"
+            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+            AI_DETAILS="${AI_DETAILS}$(grep -rni "ChatGPT\|Claude\|GPT-4\|Copilot generated\|AI generated" \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null)\n"
+            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+          fi
+          
+          if [ "$AI_MARKERS_FOUND" = true ]; then
+            echo "ai_detected=true" >> $GITHUB_OUTPUT
+            echo "ai_details<<EOF" >> $GITHUB_OUTPUT
+            echo -e "$AI_DETAILS" >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
+          else
+            echo "✅ No obvious AI-generated code markers found!"
+            echo "ai_detected=false" >> $GITHUB_OUTPUT
+          fi
+
+      # ============================================================
+      # 3. DUPLICATE CODE DETECTION
+      # ============================================================
+      - name: Install duplicate detection tool
+        run: npm install -g jscpd
+
+      - name: Detect duplicate/copy-pasted code
+        id: duplicate_detection
+        continue-on-error: true
+        run: |
+          echo "🔎 Scanning for duplicate code blocks..."
+          
+          # Run jscpd with custom configuration
+          cat > .jscpd.json << 'EOF'
+          {
+            "threshold": 5,
+            "minLines": 10,
+            "minTokens": 50,
+            "ignore": [
+              "**/*.min.js",
+              "**/node_modules/**",
+              "**/build/**",
+              "**/dist/**",
+              "**/test/**"
+            ],
+            "reporters": ["console", "json"],
+            "format": ["javascript", "jsx"],
+            "output": "./jscpd-report"
+          }
+          EOF
+          
+          mkdir -p jscpd-report
+          
+          # Run duplicate detection
+          jscpd src/ --config .jscpd.json > jscpd-output.txt 2>&1 || true
+          
+          # Check if duplicates were found
+          if [ -f "jscpd-report/jscpd-report.json" ]; then
+            DUPLICATE_COUNT=$(jq '.statistics.duplicates' jscpd-report/jscpd-report.json 2>/dev/null || echo "0")
+            DUPLICATE_PERCENTAGE=$(jq '.statistics.percentage' jscpd-report/jscpd-report.json 2>/dev/null || echo "0")
+            
+            if [ "$DUPLICATE_COUNT" -gt 0 ]; then
+              echo "duplicates_found=true" >> $GITHUB_OUTPUT
+              echo "duplicate_count=$DUPLICATE_COUNT" >> $GITHUB_OUTPUT
+              echo "duplicate_percentage=$DUPLICATE_PERCENTAGE" >> $GITHUB_OUTPUT
+              
+              # Extract top duplicates
+              DUPLICATE_SUMMARY=$(jq -r '.duplicates[:5] | .[] | "File: \(.firstFile.name):\(.firstFile.start)-\(.firstFile.end) duplicated in \(.secondFile.name):\(.secondFile.start)-\(.secondFile.end) (\(.lines) lines)"' \
+                jscpd-report/jscpd-report.json 2>/dev/null || echo "Unable to parse duplicates")
+              
+              echo "duplicate_summary<<EOF" >> $GITHUB_OUTPUT
+              echo "$DUPLICATE_SUMMARY" >> $GITHUB_OUTPUT
+              echo "EOF" >> $GITHUB_OUTPUT
+              
+              echo "⚠️ Found $DUPLICATE_COUNT duplicate code blocks ($DUPLICATE_PERCENTAGE% duplication)"
+            else
+              echo "duplicates_found=false" >> $GITHUB_OUTPUT
+              echo "✅ No significant code duplication found!"
+            fi
+          else
+            echo "duplicates_found=false" >> $GITHUB_OUTPUT
+            echo "✅ No duplicate code detected!"
+          fi
+
+      # ============================================================
+      # 4. SECURITY & ETHICS CHECK
+      # ============================================================
+      - name: Check for unethical code patterns
+        id: ethics_check
+        continue-on-error: true
+        run: |
+          echo "🔒 Scanning for security vulnerabilities and unethical patterns..."
+          
+          ETHICS_VIOLATIONS=false
+          ETHICS_DETAILS=""
+          
+          # 1. Check for hardcoded credentials/secrets (CRITICAL SECURITY CHECK)
+          echo "Checking for hardcoded secrets..."
+          if grep -r "password\s*=\s*['\"].\+['\"]\|api_key\s*=\s*['\"].\+['\"]\|secret\s*=\s*['\"].\+['\"]\|token\s*=\s*['\"].\+['\"]" \
+             --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | grep -v "password: ''" | grep -v "password: \"\"" | grep -v "token: ''"; then
+            ETHICS_VIOLATIONS=true
+            ETHICS_DETAILS="${ETHICS_DETAILS}\n### 🚨 CRITICAL: Potential Hardcoded Credentials Found!\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}**This is a severe security risk!** Never commit real credentials to source code.\n\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rn "password\s*=\s*['\"].\+['\"]\|api_key\s*=\s*['\"].\+['\"]\|secret\s*=\s*['\"].\+['\"]" \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | grep -v "password: ''" | grep -v "password: \"\"" | grep -v "token: ''" | head -10)\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}**Action Required:**\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}- Remove any real credentials immediately\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}- Use environment variables instead\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}- If real secrets were committed, rotate them immediately\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}- Consider using GitHub Secrets or a secrets manager\n\n"
+          fi
+          
+          # 2. Check for eval() usage (security risk)
+          if grep -r "eval(" --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// "; then
+            ETHICS_VIOLATIONS=true
+            ETHICS_DETAILS="${ETHICS_DETAILS}\n### ⚠️ eval() Usage Detected:\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rn "eval(" --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | head -10)\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+          fi
+          
+          # 3. Check for dangerous innerHTML usage without sanitization
+          if grep -r "dangerouslySetInnerHTML\|innerHTML\s*=" --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+            ETHICS_VIOLATIONS=true
+            ETHICS_DETAILS="${ETHICS_DETAILS}\n### ⚠️ Potentially Unsafe HTML Injection:\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rn "dangerouslySetInnerHTML\|innerHTML\s*=" \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -10)\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}Make sure these are properly sanitized to prevent XSS attacks.\n"
+          fi
+          
+          # 4. Check for console.log in production code (not unethical but bad practice)
+          CONSOLE_COUNT=$(grep -r "console\.(log\|debug\|info)" --include="*.js" --include="*.jsx" src/ 2>/dev/null | wc -l)
+          if [ "$CONSOLE_COUNT" -gt 100 ]; then
+            ETHICS_DETAILS="${ETHICS_DETAILS}\n### ℹ️ Excessive Console Statements:\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}Found $CONSOLE_COUNT console.log statements. Consider using a proper logging library.\n"
+          fi
+          
+          # 5. Check for TODO/FIXME that might indicate incomplete security implementations
+          if grep -ri "TODO.*security\|FIXME.*auth\|TODO.*sanitize\|FIXME.*XSS" \
+             --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+            ETHICS_VIOLATIONS=true
+            ETHICS_DETAILS="${ETHICS_DETAILS}\n### 🚨 Incomplete Security TODOs:\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rni "TODO.*security\|FIXME.*auth\|TODO.*sanitize\|FIXME.*XSS" \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null)\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+          fi
+          
+          # 6. Check for disabled security features
+          if grep -r "eslint-disable.*security\|@ts-ignore.*security\|skipLibCheck.*true" \
+             --include="*.js" --include="*.jsx" --include="*.ts" --include="*.tsx" src/ 2>/dev/null; then
+            ETHICS_VIOLATIONS=true
+            ETHICS_DETAILS="${ETHICS_DETAILS}\n### ⚠️ Disabled Security Checks:\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rn "eslint-disable.*security\|@ts-ignore.*security" \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null)\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+          fi
+          
+          if [ "$ETHICS_VIOLATIONS" = true ]; then
+            echo "ethics_violations=true" >> $GITHUB_OUTPUT
+            echo "ethics_details<<EOF" >> $GITHUB_OUTPUT
+            echo -e "$ETHICS_DETAILS" >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
+          else
+            echo "✅ No obvious security or ethical violations found!"
+            echo "ethics_violations=false" >> $GITHUB_OUTPUT
+          fi
+
+      # ============================================================
+      # 5. GENERATE SUMMARY REPORT
+      # ============================================================
+      - name: Generate code quality report
+        if: always()
+        id: report
+        uses: actions/github-script@v7
+        env:
+          DEPRECATED_FOUND: ${{ steps.react_deprecated.outputs.deprecated_found }}
+          DEPRECATED_DETAILS: ${{ steps.react_deprecated.outputs.deprecated_details }}
+          AI_DETECTED: ${{ steps.ai_detection.outputs.ai_detected }}
+          AI_DETAILS: ${{ steps.ai_detection.outputs.ai_details }}
+          DUPLICATES_FOUND: ${{ steps.duplicate_detection.outputs.duplicates_found }}
+          DUPLICATE_COUNT: ${{ steps.duplicate_detection.outputs.duplicate_count }}
+          DUPLICATE_PERCENTAGE: ${{ steps.duplicate_detection.outputs.duplicate_percentage }}
+          DUPLICATE_SUMMARY: ${{ steps.duplicate_detection.outputs.duplicate_summary }}
+          ETHICS_VIOLATIONS: ${{ steps.ethics_check.outputs.ethics_violations }}
+          ETHICS_DETAILS: ${{ steps.ethics_check.outputs.ethics_details }}
+        with:
+          script: |
+            const deprecatedFound = process.env.DEPRECATED_FOUND === 'true';
+            const deprecatedDetails = process.env.DEPRECATED_DETAILS || '';
+            const aiDetected = process.env.AI_DETECTED === 'true';
+            const aiDetails = process.env.AI_DETAILS || '';
+            const duplicatesFound = process.env.DUPLICATES_FOUND === 'true';
+            const duplicateCount = process.env.DUPLICATE_COUNT || '0';
+            const duplicatePercentage = process.env.DUPLICATE_PERCENTAGE || '0';
+            const duplicateSummary = process.env.DUPLICATE_SUMMARY || '';
+            const ethicsViolations = process.env.ETHICS_VIOLATIONS === 'true';
+            const ethicsDetails = process.env.ETHICS_DETAILS || '';
+            
+            const hasIssues = deprecatedFound || aiDetected || duplicatesFound || ethicsViolations;
+            
+            let report = `## 🔍 Code Quality Analysis Report\n\n`;
+            
+            if (!hasIssues) {
+              report += `### ✅ All Checks Passed!\n\n`;
+              report += `No code quality issues detected. Great work! 🎉\n\n`;
+              report += `- ✅ No deprecated React patterns\n`;
+              report += `- ✅ No obvious AI-generated code markers\n`;
+              report += `- ✅ No significant code duplication\n`;
+              report += `- ✅ No security or ethical violations\n`;
+            } else {
+              report += `### Issues Detected\n\n`;
+              
+              if (deprecatedFound) {
+                report += `## ❌ Deprecated React Patterns\n\n`;
+                report += `${deprecatedDetails}\n\n`;
+                report += `**Recommendation:** Migrate to modern React patterns (hooks, function components)\n\n`;
+                report += `---\n\n`;
+              } else {
+                report += `- ✅ No deprecated React patterns\n`;
+              }
+              
+              if (aiDetected) {
+                report += `## ⚠️ AI-Generated Code Markers\n\n`;
+                report += `${aiDetails}\n\n`;
+                report += `**Recommendation:** Review AI-generated code for quality and correctness\n\n`;
+                report += `---\n\n`;
+              } else {
+                report += `- ✅ No obvious AI-generated code markers\n`;
+              }
+              
+              if (duplicatesFound) {
+                report += `## 🔄 Code Duplication Detected\n\n`;
+                report += `**Statistics:**\n`;
+                report += `- Duplicate blocks: ${duplicateCount}\n`;
+                report += `- Duplication percentage: ${duplicatePercentage}%\n\n`;
+                report += `**Top Duplicates:**\n\`\`\`\n${duplicateSummary}\n\`\`\`\n\n`;
+                report += `**Recommendation:** Refactor duplicated code into reusable functions/components\n\n`;
+                report += `---\n\n`;
+              } else {
+                report += `- ✅ No significant code duplication\n`;
+              }
+              
+              if (ethicsViolations) {
+                report += `## 🚨 Security & Ethics Violations\n\n`;
+                report += `${ethicsDetails}\n\n`;
+                report += `**Recommendation:** Address security issues immediately before merging\n\n`;
+                report += `---\n\n`;
+              } else {
+                report += `- ✅ No security or ethical violations\n`;
+              }
+            }
+            
+            report += `\n---\n`;
+            report += `*🤖 Automated code quality check performed by GitHub Actions*\n`;
+            report += `*Run ID: [${context.runId}](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})*\n`;
+            
+            // Post comment on PR if this is a pull request
+            if (context.payload.pull_request) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number,
+                body: report
+              });
+            }
+            
+            // Set output for subsequent steps
+            core.setOutput('has_issues', hasIssues);
+            core.setOutput('report', report);
+            
+            // Fail the check if critical issues found (deprecated or ethics violations)
+            if (deprecatedFound || ethicsViolations) {
+              core.setFailed('Critical code quality issues detected');
+            }
+
+      - name: Upload detailed reports
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: code-quality-reports
+          path: |
+            jscpd-report/
+            jscpd-output.txt
+          retention-days: 30
+
+      - name: Summary
+        if: always()
+        run: |
+          echo "### 🔍 Code Quality Check Complete" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          
+          if [ "${{ steps.report.outputs.has_issues }}" = "true" ]; then
+            echo "⚠️ **Issues detected!** Review the report above." >> $GITHUB_STEP_SUMMARY
+          else
+            echo "✅ **All checks passed!** Your code looks great!" >> $GITHUB_STEP_SUMMARY
+          fi
+          
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "📊 Full report available in PR comments or workflow artifacts." >> $GITHUB_STEP_SUMMARY

From 26037da80fddd83a133cfe6b800a582676efe60b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 15 Jan 2026 17:33:32 +0000
Subject: [PATCH 03/10] Add jscpd config and comprehensive documentation

- Add .jscpd.json configuration for duplicate detection
- Create detailed CODE_QUALITY_WORKFLOW.md documentation
- Include usage examples, troubleshooting, and best practices

Co-authored-by: Graison-P <119984713+Graison-P@users.noreply.github.com>
---
 .jscpd.json                   |  15 ++
 docs/CODE_QUALITY_WORKFLOW.md | 341 ++++++++++++++++++++++++++++++++++
 2 files changed, 356 insertions(+)
 create mode 100644 .jscpd.json
 create mode 100644 docs/CODE_QUALITY_WORKFLOW.md

diff --git a/.jscpd.json b/.jscpd.json
new file mode 100644
index 000000000..e12540a34
--- /dev/null
+++ b/.jscpd.json
@@ -0,0 +1,15 @@
+{
+  "threshold": 5,
+  "minLines": 10,
+  "minTokens": 50,
+  "ignore": [
+    "**/*.min.js",
+    "**/node_modules/**",
+    "**/build/**",
+    "**/dist/**",
+    "**/test/**"
+  ],
+  "reporters": ["console", "json"],
+  "format": ["javascript", "jsx"],
+  "output": "./jscpd-report"
+}
diff --git a/docs/CODE_QUALITY_WORKFLOW.md b/docs/CODE_QUALITY_WORKFLOW.md
new file mode 100644
index 000000000..2ed61cd66
--- /dev/null
+++ b/docs/CODE_QUALITY_WORKFLOW.md
@@ -0,0 +1,341 @@
+# Code Quality & Standards Check Workflow
+
+## Overview
+
+The **Code Quality Check** workflow is an automated GitHub Actions workflow that analyzes code for quality issues, security vulnerabilities, and deprecated patterns. It runs on all pull requests and pushes to main/develop branches.
+
+## What It Checks
+
+### 1. 🔄 Deprecated React Patterns
+
+Detects legacy React patterns that should be migrated to modern alternatives:
+
+- **Deprecated Lifecycle Methods**:
+  - `componentWillMount()` → Use `componentDidMount()` or hooks
+  - `componentWillReceiveProps()` → Use `componentDidUpdate()` or `getDerivedStateFromProps()`
+  - `componentWillUpdate()` → Use `componentDidUpdate()` or `getSnapshotBeforeUpdate()`
+  
+- **UNSAFE_ Methods**: Even with the `UNSAFE_` prefix, these are still deprecated
+
+- **React.createClass**: Legacy API, should use ES6 classes or function components
+
+- **String Refs**: Pattern like `ref="myRef"` is deprecated, use callback refs or `createRef()`
+
+**Why it matters**: Deprecated methods may be removed in future React versions and can cause performance issues.
+
+### 2. 🤖 AI-Generated Code Detection
+
+Identifies patterns commonly found in AI-generated code:
+
+- **Verbose Comments**: Excessive "This function...", "This method..." style comments
+- **AI Placeholders**: "TODO: Implement", "Add your code here", etc.
+- **Perfect JSDoc**: Suspiciously complete documentation (may indicate copy-paste)
+- **Overly Long Names**: Variable/function names longer than 30 characters
+- **AI Service Mentions**: Accidental inclusion of "ChatGPT", "Claude", "GPT-4", etc.
+
+**Why it matters**: AI-generated code should be reviewed for quality, correctness, and project fit. This is about **quality assurance**, not banning AI tools.
+
+### 3. 🔄 Code Duplication
+
+Uses `jscpd` to find copy-pasted code blocks:
+
+- **Threshold**: 5% duplication
+- **Minimum**: 10 lines or 50 tokens to be considered duplicate
+- **Excludes**: Tests, build artifacts, node_modules
+
+**Why it matters**: Duplicated code is harder to maintain. Bugs need to be fixed in multiple places, and refactoring becomes difficult.
+
+### 4. 🔒 Security & Ethics
+
+Scans for security vulnerabilities and unsafe patterns:
+
+- **🚨 CRITICAL: Hardcoded Secrets**
+  - Detects: `password = "..."`, `api_key = "..."`, `secret = "..."`, `token = "..."`
+  - **Action Required**: Remove immediately and rotate any exposed credentials
+  - Use environment variables or GitHub Secrets instead
+
+- **⚠️ eval() Usage**
+  - Allows arbitrary code execution (security risk)
+  - Consider safer alternatives like JSON parsing
+
+- **⚠️ Unsafe HTML Injection**
+  - `dangerouslySetInnerHTML` and `innerHTML` without sanitization
+  - Can lead to XSS (Cross-Site Scripting) attacks
+  - Always sanitize user input before rendering HTML
+
+- **⚠️ Disabled Security Checks**
+  - `eslint-disable security` or similar comments
+  - May hide real security issues
+
+- **ℹ️ Excessive Console Logs**
+  - Not a security issue, but suggests debugging code left in production
+
+## How It Works
+
+### Workflow Triggers
+
+The workflow runs automatically on:
+- **Pull Requests**: opened, synchronized, or reopened
+- **Pushes**: to `main` or `develop` branches
+
+### Process
+
+1. **Checkout code** and install dependencies
+2. **Run checks** in parallel for speed
+3. **Generate report** with findings
+4. **Post comment** on PR with detailed results
+5. **Upload artifacts** with full reports (retained for 30 days)
+6. **Fail workflow** if critical issues found (deprecated patterns or security violations)
+
+### Output
+
+The workflow produces:
+- **PR Comment**: Detailed report with all findings
+- **Workflow Summary**: Quick overview in GitHub Actions
+- **Artifacts**: Full jscpd reports for download
+
+## Understanding the Report
+
+### ✅ All Checks Passed
+
+```
+## 🔍 Code Quality Analysis Report
+
+### ✅ All Checks Passed!
+
+No code quality issues detected. Great work! 🎉
+
+- ✅ No deprecated React patterns
+- ✅ No obvious AI-generated code markers
+- ✅ No significant code duplication
+- ✅ No security or ethical violations
+```
+
+Your code is clean! No action needed.
+
+### ⚠️ Issues Detected
+
+```
+## 🔍 Code Quality Analysis Report
+
+### Issues Detected
+
+## ❌ Deprecated React Patterns
+
+### Deprecated Lifecycle Methods Found:
+```
+src/components/Example.jsx:15: componentWillMount() {
+src/components/Another.jsx:22: componentWillReceiveProps(nextProps) {
+```
+
+**Recommendation:** Migrate to modern React patterns (hooks, function components)
+```
+
+Each section includes:
+- **Files and line numbers** where issues were found
+- **Specific code snippets** showing the problem
+- **Recommendations** for fixing the issues
+
+## Fixing Issues
+
+### Deprecated React Patterns
+
+**Before:**
+```jsx
+class MyComponent extends React.Component {
+    componentWillMount() {
+        this.loadData();
+    }
+}
+```
+
+**After (using hooks):**
+```jsx
+function MyComponent() {
+    useEffect(() => {
+        loadData();
+    }, []); // Empty array = run once on mount
+}
+```
+
+### Hardcoded Secrets
+
+**Before:**
+```js
+const apiKey = "sk-1234567890abcdef";
+fetch(`https://api.example.com?key=${apiKey}`);
+```
+
+**After:**
+```js
+const apiKey = process.env.API_KEY;  // Set in .env file
+fetch(`https://api.example.com?key=${apiKey}`);
+```
+
+**Important**: If real secrets were committed, you must:
+1. Remove them from the code
+2. **Rotate/invalidate** the exposed credentials immediately
+3. Add them to `.gitignore` or use GitHub Secrets
+
+### Code Duplication
+
+**Before:**
+```js
+// In FileA.js
+function validateEmail(email) {
+    const regex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    return regex.test(email);
+}
+
+// In FileB.js (duplicate!)
+function validateEmail(email) {
+    const regex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    return regex.test(email);
+}
+```
+
+**After:**
+```js
+// In utils/validation.js
+export function validateEmail(email) {
+    const regex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+    return regex.test(email);
+}
+
+// In FileA.js and FileB.js
+import { validateEmail } from './utils/validation';
+```
+
+## Configuration
+
+### Customizing Thresholds
+
+Edit `.jscpd.json` to adjust duplicate detection:
+
+```json
+{
+  "threshold": 5,       // Fail if >5% duplication
+  "minLines": 10,       // Minimum 10 lines to count as duplicate
+  "minTokens": 50,      // Minimum 50 tokens to count as duplicate
+  "ignore": [
+    "**/*.min.js",
+    "**/node_modules/**",
+    "**/build/**"
+  ]
+}
+```
+
+### Disabling Checks (Not Recommended)
+
+If you need to temporarily disable a check:
+
+```yaml
+# In .github/workflows/code-quality-check.yml
+- name: Check for deprecated React functions
+  if: false  # Disables this step
+```
+
+**Warning**: Only disable checks if you have a very good reason. Security checks should never be disabled.
+
+## FAQ
+
+### Q: Will this block my PR from merging?
+
+**A**: Yes, if **critical issues** are found:
+- Deprecated React patterns (requires migration)
+- Security violations (hardcoded secrets, eval, etc.)
+
+Non-critical issues (AI markers, some duplicates) will warn but won't block.
+
+### Q: What if I'm using AI tools like GitHub Copilot?
+
+**A**: That's fine! The workflow detects **patterns**, not whether AI was used. It's checking:
+- Code quality (verbose comments, placeholder text)
+- Correctness (did you review what was generated?)
+
+Review AI suggestions before committing, and you'll be fine.
+
+### Q: My code uses `dangerouslySetInnerHTML` safely. How do I handle this?
+
+**A**: Add a comment explaining why it's safe:
+
+```jsx
+// SAFETY: Content is sanitized via DOMPurify in sanitizeHtml() above
+<div dangerouslySetInnerHTML={{__html: sanitizedContent}} />
+```
+
+The workflow will still flag it, but reviewers will understand the context.
+
+### Q: What about test files?
+
+**A**: The workflow excludes the `test/` directory from duplicate detection. However, deprecated patterns and security issues are still checked in tests.
+
+### Q: Can I run this locally?
+
+**A**: Yes! Install jscpd globally:
+
+```bash
+npm install -g jscpd
+```
+
+Then run individual checks:
+
+```bash
+# Check for duplicates
+jscpd src/
+
+# Check for deprecated React patterns
+grep -r "componentWillMount\|componentWillReceiveProps" --include="*.js" --include="*.jsx" src/
+
+# Check for hardcoded secrets
+grep -r "password\s*=\s*['\"].\+['\"]\|api_key\s*=\s*['\"].\+['\"]" --include="*.js" src/
+```
+
+## Best Practices
+
+1. **Review Before Committing**: Read through code before pushing, especially AI-generated code
+2. **Use Modern React**: Prefer hooks and function components over class components
+3. **DRY Principle**: Don't Repeat Yourself - refactor duplicated code
+4. **Never Commit Secrets**: Use environment variables and `.env` files (add to `.gitignore`)
+5. **Sanitize User Input**: Always sanitize before using `dangerouslySetInnerHTML`
+6. **Keep Dependencies Updated**: Old dependencies may have deprecated patterns
+
+## Troubleshooting
+
+### False Positives
+
+If you get flagged incorrectly:
+
+1. **Check the context**: Is it really a false positive?
+2. **Add a comment**: Explain why the pattern is necessary
+3. **File an issue**: If it's a workflow bug, let maintainers know
+
+### Workflow Fails to Run
+
+Check:
+- Is the workflow file in `.github/workflows/`?
+- Does the file have correct YAML syntax?
+- Are there sufficient permissions in the workflow?
+
+### "No such file or directory" Errors
+
+The workflow expects:
+- Source code in `src/` directory
+- Node.js project with `package.json`
+- NPM dependencies installable via `npm ci`
+
+## Contributing
+
+Found a pattern we should check for? Open an issue or PR!
+
+Suggested additions:
+- More deprecated patterns
+- Better AI detection heuristics
+- Additional security checks
+- Language-specific checks (TypeScript, etc.)
+
+---
+
+**Last Updated**: January 2025  
+**Maintainer**: OmniBlocks Team  
+**Feedback**: Open an issue on GitHub

From 5f5d76e5a17fce46b5b22ba7ea963962a592f454 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 15 Jan 2026 17:35:31 +0000
Subject: [PATCH 04/10] Add CODE_QUALITY.md quick reference guide

- Add quick reference for developers and maintainers
- Document current codebase status (11 deprecated patterns)
- Provide clear guidance on handling flagged issues
- Include common scenarios and solutions

Co-authored-by: Graison-P <119984713+Graison-P@users.noreply.github.com>
---
 CODE_QUALITY.md | 140 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 140 insertions(+)
 create mode 100644 CODE_QUALITY.md

diff --git a/CODE_QUALITY.md b/CODE_QUALITY.md
new file mode 100644
index 000000000..6f1da3884
--- /dev/null
+++ b/CODE_QUALITY.md
@@ -0,0 +1,140 @@
+# Code Quality Workflow - Quick Reference
+
+## What This Workflow Does
+
+Automatically checks your code for:
+- 🔄 **Deprecated React patterns** (11 instances currently in codebase)
+- 🤖 **AI-generated code markers** (quality assurance)
+- 📋 **Duplicate code** (copy-paste detection)
+- 🔒 **Security issues** (hardcoded secrets, XSS risks)
+
+## When It Runs
+
+- ✅ Every pull request
+- ✅ Pushes to `main` or `develop`
+
+## What Happens
+
+1. Workflow runs automatically
+2. Posts detailed report as PR comment
+3. Uploads full reports as artifacts
+4. **Fails if critical issues found**
+
+## Current Codebase Status
+
+As of January 2025:
+- **11 deprecated React methods** detected in src/
+  - `componentWillReceiveProps` in 10 files
+  - `componentWillMount` in 1 file
+- These are **legacy patterns** inherited from Scratch/TurboWarp
+- Migration to hooks/modern React is recommended but not urgent
+
+## For Contributors
+
+### If Your PR Gets Flagged
+
+**Don't panic!** The workflow is here to help, not block. Here's what to do:
+
+1. **Read the report** - Check PR comments for details
+2. **Assess severity**:
+   - 🚨 **Critical** (hardcoded secrets, deprecated): Fix before merge
+   - ⚠️ **Warning** (AI markers, duplicates): Review and improve if possible
+3. **Fix issues** - Follow recommendations in the report
+4. **Push changes** - Workflow runs again automatically
+
+### Common Scenarios
+
+#### "My code uses AI tools like Copilot"
+**That's fine!** We use AI tools too. The check is about:
+- Reviewing what AI generated
+- Removing placeholder comments
+- Ensuring code quality
+
+Just review and clean up the output before committing.
+
+#### "I have a hardcoded API key"
+**🚨 STOP!** This is critical:
+1. Remove the hardcoded secret immediately
+2. Use environment variables: `process.env.API_KEY`
+3. If it's a real key, **rotate it** (invalidate and create new)
+4. Add `.env` to `.gitignore`
+
+#### "My code has duplicates"
+**Consider refactoring**, but it's not urgent:
+- Extract common code to utilities
+- Use shared components
+- Follow DRY (Don't Repeat Yourself) principle
+
+#### "I'm fixing a deprecated React method"
+**Great!** Migration path:
+```jsx
+// Old (deprecated)
+componentWillReceiveProps(nextProps) {
+  if (nextProps.value !== this.props.value) {
+    this.setState({value: nextProps.value});
+  }
+}
+
+// New (hooks)
+useEffect(() => {
+  setValue(props.value);
+}, [props.value]);
+
+// Or use getDerivedStateFromProps (class components)
+static getDerivedStateFromProps(props, state) {
+  if (props.value !== state.value) {
+    return {value: props.value};
+  }
+  return null;
+}
+```
+
+## For Maintainers
+
+### Adjusting Thresholds
+
+Edit `.jscpd.json`:
+```json
+{
+  "threshold": 5,      // % duplication to fail
+  "minLines": 10,      // minimum lines to count
+  "minTokens": 50      // minimum tokens to count
+}
+```
+
+### Disabling Checks (Emergency Only)
+
+Edit `.github/workflows/code-quality-check.yml`:
+```yaml
+- name: Check for deprecated React functions
+  if: false  # Temporarily disable
+```
+
+**Warning**: Only do this in emergencies. Re-enable ASAP.
+
+### Monitoring
+
+- **Artifacts**: Full jscpd reports available for 30 days
+- **PR Comments**: Automatically posted on every PR
+- **Actions Tab**: View workflow history
+
+## Documentation
+
+Full documentation: [`docs/CODE_QUALITY_WORKFLOW.md`](./docs/CODE_QUALITY_WORKFLOW.md)
+
+Topics covered:
+- Detailed explanation of each check
+- How to fix common issues
+- Configuration options
+- FAQ and troubleshooting
+- Best practices
+
+## Questions?
+
+- **Bug in workflow?** Open an issue with `workflow` label
+- **False positive?** Open an issue with `code-quality` label
+- **Need help fixing?** Ask in PR comments, maintainers will assist
+
+---
+
+**Remember**: This workflow is a **helper**, not a blocker. It catches issues early so you don't have to worry about them later! 🎉

From fe7cace2dc4b8a3a6f5f0042164bd1a7a9ff5b32 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 15 Jan 2026 18:03:42 +0000
Subject: [PATCH 05/10] Add security advisory creation and member notification
 for hardcoded secrets

- Create GitHub security advisory when hardcoded credentials detected
- Notify all repository members/collaborators via @mentions
- Include encoded/hardcoded string details in advisory
- Add immediate action steps to rotate/delete exposed keys
- Create tracking issue with security label
- Update PR comments with link to security advisory
- Assign collaborators to tracking issue

Addresses review comments: enhanced security response for hardcoded secrets detection

Co-authored-by: Graison-P <119984713+Graison-P@users.noreply.github.com>
---
 .github/workflows/code-quality-check.yml | 245 ++++++++++++++++++++++-
 1 file changed, 236 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/code-quality-check.yml b/.github/workflows/code-quality-check.yml
index ea3592a5e..338691794 100644
--- a/.github/workflows/code-quality-check.yml
+++ b/.github/workflows/code-quality-check.yml
@@ -271,20 +271,43 @@ jobs:
           
           # 1. Check for hardcoded credentials/secrets (CRITICAL SECURITY CHECK)
           echo "Checking for hardcoded secrets..."
+          HARDCODED_SECRETS_FOUND=false
+          HARDCODED_SECRETS_DETAILS=""
+          
           if grep -r "password\s*=\s*['\"].\+['\"]\|api_key\s*=\s*['\"].\+['\"]\|secret\s*=\s*['\"].\+['\"]\|token\s*=\s*['\"].\+['\"]" \
              --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | grep -v "password: ''" | grep -v "password: \"\"" | grep -v "token: ''"; then
             ETHICS_VIOLATIONS=true
-            ETHICS_DETAILS="${ETHICS_DETAILS}\n### 🚨 CRITICAL: Potential Hardcoded Credentials Found!\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}**This is a severe security risk!** Never commit real credentials to source code.\n\n"
+            HARDCODED_SECRETS_FOUND=true
+            
+            # Capture the found secrets with full context
+            FOUND_SECRETS=$(grep -rn "password\s*=\s*['\"].\+['\"]\|api_key\s*=\s*['\"].\+['\"]\|secret\s*=\s*['\"].\+['\"]\|token\s*=\s*['\"]" \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | grep -v "password: ''" | grep -v "password: \"\"" | grep -v "token: ''" | head -10)
+            
+            ETHICS_DETAILS="${ETHICS_DETAILS}\n### 🚨 CRITICAL SECURITY VULNERABILITY: Hardcoded Credentials Found!\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}**⚠️ IMMEDIATE ACTION REQUIRED - SECURITY BREACH DETECTED ⚠️**\n\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}Hardcoded credentials have been detected in the source code. This is a **CRITICAL SECURITY VULNERABILITY**.\n\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}**Found Credentials (REDACTED FOR SECURITY):**\n"
             ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rn "password\s*=\s*['\"].\+['\"]\|api_key\s*=\s*['\"].\+['\"]\|secret\s*=\s*['\"].\+['\"]" \
-              --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | grep -v "password: ''" | grep -v "password: \"\"" | grep -v "token: ''" | head -10)\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}${FOUND_SECRETS}\n"
             ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}**Action Required:**\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}- Remove any real credentials immediately\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}- Use environment variables instead\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}- If real secrets were committed, rotate them immediately\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}- Consider using GitHub Secrets or a secrets manager\n\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}**IMMEDIATE ACTION REQUIRED:**\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}1. 🚨 **IMMEDIATELY REVOKE/ROTATE** all exposed credentials\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}2. 🔒 **DELETE** the exposed keys from your service provider\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}3. 🗑️ **REMOVE** hardcoded secrets from code immediately\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}4. 🔐 Use environment variables or GitHub Secrets instead\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}5. 📋 A security advisory will be created for this issue\n\n"
+            ETHICS_DETAILS="${ETHICS_DETAILS}**All repository members will be notified of this security issue.**\n\n"
+            
+            # Store secrets details for security advisory
+            HARDCODED_SECRETS_DETAILS="$FOUND_SECRETS"
+          fi
+          
+          # Output hardcoded secrets info for later steps
+          echo "hardcoded_secrets_found=$HARDCODED_SECRETS_FOUND" >> $GITHUB_OUTPUT
+          if [ "$HARDCODED_SECRETS_FOUND" = true ]; then
+            echo "hardcoded_secrets_details<<EOF" >> $GITHUB_OUTPUT
+            echo "$HARDCODED_SECRETS_DETAILS" >> $GITHUB_OUTPUT
+            echo "EOF" >> $GITHUB_OUTPUT
           fi
           
           # 2. Check for eval() usage (security risk)
@@ -454,6 +477,210 @@ jobs:
               core.setFailed('Critical code quality issues detected');
             }
 
+      # ============================================================
+      # 6. CREATE SECURITY ADVISORY FOR HARDCODED SECRETS
+      # ============================================================
+      - name: Create security advisory for hardcoded secrets
+        if: steps.ethics_check.outputs.hardcoded_secrets_found == 'true'
+        id: security_advisory
+        uses: actions/github-script@v7
+        env:
+          HARDCODED_SECRETS_DETAILS: ${{ steps.ethics_check.outputs.hardcoded_secrets_details }}
+        with:
+          script: |
+            const secretsDetails = process.env.HARDCODED_SECRETS_DETAILS || '';
+            
+            try {
+              // Create a security advisory
+              const advisory = await github.rest.securityAdvisories.createRepositoryAdvisory({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                summary: '🚨 CRITICAL: Hardcoded Credentials Detected in Source Code',
+                description: `## CRITICAL SECURITY VULNERABILITY
+            
+            Hardcoded credentials have been detected in the source code during automated security scanning.
+            
+            ### Severity: CRITICAL
+            
+            ### Impact
+            Exposed credentials in source code can lead to:
+            - Unauthorized access to services
+            - Data breaches
+            - System compromise
+            - Financial loss
+            
+            ### Affected Locations
+            \`\`\`
+            ${secretsDetails}
+            \`\`\`
+            
+            ### IMMEDIATE ACTION REQUIRED
+            
+            1. **🚨 IMMEDIATELY REVOKE/ROTATE** all exposed credentials
+            2. **🔒 DELETE** the exposed keys from your service provider (API provider, database, etc.)
+            3. **🗑️ REMOVE** all hardcoded secrets from the codebase
+            4. **🔐 MIGRATE** to using environment variables or GitHub Secrets
+            5. **📋 AUDIT** git history to ensure secrets weren't committed previously
+            
+            ### Recommended Actions
+            
+            - Use GitHub Secrets for sensitive data in workflows
+            - Use environment variables for application secrets
+            - Add \`.env\` files to \`.gitignore\`
+            - Consider using a secrets manager (AWS Secrets Manager, HashiCorp Vault, etc.)
+            - Enable secret scanning in repository settings
+            
+            ### Detection Information
+            
+            - Detected by: Automated Code Quality Workflow
+            - PR: #${context.payload.pull_request?.number || 'N/A'}
+            - Commit: ${context.sha}
+            - Workflow Run: https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}
+            
+            **All repository members and collaborators have been notified.**`,
+                severity: 'critical',
+                cve_id: null,
+                vulnerabilities: [{
+                  package: {
+                    ecosystem: 'other',
+                    name: context.repo.repo
+                  },
+                  vulnerable_version_range: '*',
+                  patched_versions: 'none'
+                }],
+                cwe_ids: ['CWE-798'], // Use of Hard-coded Credentials
+                credits: []
+              });
+              
+              console.log(`Security advisory created: ${advisory.data.html_url}`);
+              core.setOutput('advisory_url', advisory.data.html_url);
+              core.setOutput('advisory_id', advisory.data.ghsa_id);
+              
+              return advisory.data.html_url;
+            } catch (error) {
+              console.error('Failed to create security advisory:', error);
+              console.log('Continuing workflow despite advisory creation failure...');
+              // Don't fail the workflow if advisory creation fails
+              return null;
+            }
+
+      - name: Notify all members about security issue
+        if: steps.ethics_check.outputs.hardcoded_secrets_found == 'true'
+        uses: actions/github-script@v7
+        env:
+          ADVISORY_URL: ${{ steps.security_advisory.outputs.advisory_url }}
+          ADVISORY_ID: ${{ steps.security_advisory.outputs.advisory_id }}
+        with:
+          script: |
+            const advisoryUrl = process.env.ADVISORY_URL || 'N/A';
+            const advisoryId = process.env.ADVISORY_ID || 'N/A';
+            
+            // Get all collaborators
+            const collaborators = await github.rest.repos.listCollaborators({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              affiliation: 'all'
+            });
+            
+            // Create mention string for all members
+            const mentions = collaborators.data.map(c => `@${c.login}`).join(' ');
+            
+            // Post urgent security notification
+            const securityMessage = `## 🚨 CRITICAL SECURITY ALERT 🚨
+            
+            ${mentions}
+            
+            **HARDCODED CREDENTIALS DETECTED IN SOURCE CODE**
+            
+            A critical security vulnerability has been detected in PR #${context.payload.pull_request?.number || 'N/A'}.
+            Hardcoded credentials (passwords, API keys, tokens, or secrets) were found in the source code.
+            
+            ### Security Advisory Created
+            ${advisoryUrl !== 'N/A' ? `**Advisory:** ${advisoryUrl}` : 'Security advisory creation in progress...'}
+            ${advisoryId !== 'N/A' ? `**ID:** ${advisoryId}` : ''}
+            
+            ### IMMEDIATE ACTION REQUIRED
+            
+            1. 🚨 **STOP** - Do not merge this PR
+            2. 🔒 **REVOKE/ROTATE** all exposed credentials immediately
+            3. 🗑️ **DELETE** exposed keys from service providers
+            4. 🔐 **REMOVE** hardcoded secrets from code
+            5. 📋 **REVIEW** git history for previous exposures
+            
+            ### What to do next
+            
+            - Check the security advisory for full details
+            - Review the workflow run: https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}
+            - Coordinate with the team to rotate all potentially exposed credentials
+            
+            **This is an automated security notification from the Code Quality Workflow.**`;
+            
+            // Post comment on PR
+            if (context.payload.pull_request) {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.payload.pull_request.number,
+                body: securityMessage
+              });
+            }
+            
+            // Also create an issue for tracking
+            try {
+              await github.rest.issues.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title: `🚨 CRITICAL: Hardcoded Credentials Detected (${advisoryId})`,
+                body: securityMessage,
+                labels: ['security', 'critical', 'needs-immediate-attention'],
+                assignees: collaborators.data.slice(0, 10).map(c => c.login) // Assign first 10 collaborators
+              });
+            } catch (error) {
+              console.error('Failed to create tracking issue:', error);
+            }
+
+      - name: Update PR comment with security advisory link
+        if: steps.ethics_check.outputs.hardcoded_secrets_found == 'true' && steps.security_advisory.outputs.advisory_url
+        uses: actions/github-script@v7
+        env:
+          ADVISORY_URL: ${{ steps.security_advisory.outputs.advisory_url }}
+          ADVISORY_ID: ${{ steps.security_advisory.outputs.advisory_id }}
+        with:
+          script: |
+            const advisoryUrl = process.env.ADVISORY_URL;
+            const advisoryId = process.env.ADVISORY_ID;
+            
+            if (!advisoryUrl || !context.payload.pull_request) {
+              return;
+            }
+            
+            // Find the bot's code quality comment
+            const comments = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number
+            });
+            
+            const botComment = comments.data.find(comment => 
+              comment.user.login === 'github-actions[bot]' && 
+              comment.body.includes('Code Quality Analysis Report')
+            );
+            
+            if (botComment) {
+              // Update the comment to add security advisory link
+              const updatedBody = botComment.body.replace(
+                /## 🚨 Security & Ethics Violations/,
+                `## 🚨 Security & Ethics Violations\n\n**🔗 Security Advisory Created:** [${advisoryId}](${advisoryUrl})\n`
+              );
+              
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: botComment.id,
+                body: updatedBody
+              });
+            }
+
       - name: Upload detailed reports
         if: always()
         uses: actions/upload-artifact@v4

From 9ef70164b9e6f29026dabda9ba5848149ce1af25 Mon Sep 17 00:00:00 2001
From: Graison P <119984713+Graison-P@users.noreply.github.com>
Date: Thu, 15 Jan 2026 12:21:40 -0600
Subject: [PATCH 06/10] Update .github/workflows/code-quality-check.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/code-quality-check.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/code-quality-check.yml b/.github/workflows/code-quality-check.yml
index 338691794..38841fbe2 100644
--- a/.github/workflows/code-quality-check.yml
+++ b/.github/workflows/code-quality-check.yml
@@ -10,6 +10,7 @@ permissions:
   contents: read
   pull-requests: write
   issues: write
+  security-events: write
 
 jobs:
   code-quality-analysis:

From 072cd5a3ebd8d112c988bce2adaf2043e478ff42 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 16 Jan 2026 20:40:06 +0000
Subject: [PATCH 07/10] Fix workflow to only scan changed files in PRs +
 improve patterns

Major improvements per review feedback:
- Add step to detect changed files in PRs using GitHub API
- Update all checks to scan only changed files (not whole repo)
- Fix deprecated React check regex patterns (use -E flag)
- Remove duplicate jscpd config creation (use existing .jscpd.json)
- Update duplicate detection to scan only changed files in PRs
- Improve AI detection thresholds (10 instead of 50 for PRs)

This addresses @supervoidcoder's main feedback: scans should be limited
to PR changes only, not the entire repository.

Remaining improvements needed:
- Complete hardcoded secrets redaction fix
- Fix security advisory creation (should be private/draft)
- Improve comment update pattern matching

Co-authored-by: supervoidcoder <88671013+supervoidcoder@users.noreply.github.com>
---
 .github/workflows/code-quality-check.yml | 259 +++++++++++++++--------
 1 file changed, 170 insertions(+), 89 deletions(-)

diff --git a/.github/workflows/code-quality-check.yml b/.github/workflows/code-quality-check.yml
index 38841fbe2..0522c11cc 100644
--- a/.github/workflows/code-quality-check.yml
+++ b/.github/workflows/code-quality-check.yml
@@ -32,6 +32,37 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      # ============================================================
+      # 0. GET CHANGED FILES (PR only)
+      # ============================================================
+      - name: Get changed files
+        id: changed_files
+        if: github.event_name == 'pull_request'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const { data: files } = await github.rest.pulls.listFiles({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number,
+              per_page: 100
+            });
+            
+            const jsFiles = files
+              .filter(f => f.status !== 'removed')
+              .filter(f => /\.(js|jsx)$/.test(f.filename))
+              .map(f => f.filename)
+              .join('\n');
+            
+            console.log(`Found ${jsFiles.split('\n').filter(Boolean).length} JS/JSX files changed in PR`);
+            console.log(`Files:\n${jsFiles}`);
+            
+            // Save to file for use in bash steps
+            require('fs').writeFileSync('/tmp/changed_files.txt', jsFiles);
+            
+            return jsFiles;
+          result-encoding: string
+
       # ============================================================
       # 1. DEPRECATED REACT FUNCTIONS CHECK
       # ============================================================
@@ -41,64 +72,58 @@ jobs:
         run: |
           echo "🔍 Scanning for deprecated React lifecycle methods and patterns..."
           
-          # Create patterns file for deprecated React APIs
-          cat > /tmp/deprecated-react-patterns.txt << 'EOF'
-          componentWillMount
-          componentWillReceiveProps
-          componentWillUpdate
-          UNSAFE_componentWillMount
-          UNSAFE_componentWillReceiveProps
-          UNSAFE_componentWillUpdate
-          React.createClass
-          ReactDOM.findDOMNode
-          String refs (ref="string")
-          isMounted()
-          ReactTestUtils.renderIntoDocument
-          shallow renderer
-          EOF
+          # Determine which files to scan
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ -f /tmp/changed_files.txt ]; then
+            FILES=$(cat /tmp/changed_files.txt | tr '\n' ' ')
+            if [ -z "$FILES" ]; then
+              echo "No JS/JSX files changed in this PR"
+              echo "deprecated_found=false" >> $GITHUB_OUTPUT
+              exit 0
+            fi
+            echo "Scanning only changed files in PR: $FILES"
+            SCAN_TARGET="$FILES"
+          else
+            echo "Scanning entire src/ directory (push to main/develop)"
+            SCAN_TARGET="src/"
+          fi
 
           # Scan for deprecated patterns in JS/JSX files
           DEPRECATED_FOUND=false
           DEPRECATED_DETAILS=""
           
           # Check for deprecated lifecycle methods
-          if grep -r "componentWillMount\|componentWillReceiveProps\|componentWillUpdate" \
-             --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+          if echo "$SCAN_TARGET" | xargs grep -l "componentWillMount\|componentWillReceiveProps\|componentWillUpdate" 2>/dev/null; then
             DEPRECATED_FOUND=true
             DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\n### Deprecated Lifecycle Methods Found:\n"
             DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
-            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}$(grep -rn "componentWillMount\|componentWillReceiveProps\|componentWillUpdate" \
-              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -20)\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}$(echo "$SCAN_TARGET" | xargs grep -n "componentWillMount\|componentWillReceiveProps\|componentWillUpdate" 2>/dev/null | head -20)\n"
             DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
           fi
           
           # Check for UNSAFE_ prefixed methods (still deprecated but explicit)
-          if grep -r "UNSAFE_componentWill" --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+          if echo "$SCAN_TARGET" | xargs grep -l "UNSAFE_componentWill" 2>/dev/null; then
             DEPRECATED_FOUND=true
             DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\n### UNSAFE_ Methods Found:\n"
             DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
-            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}$(grep -rn "UNSAFE_componentWill" \
-              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -20)\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}$(echo "$SCAN_TARGET" | xargs grep -n "UNSAFE_componentWill" 2>/dev/null | head -20)\n"
             DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
           fi
           
           # Check for React.createClass (very old)
-          if grep -r "React\.createClass\|createReactClass" --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+          if echo "$SCAN_TARGET" | xargs grep -l "React\.createClass\|createReactClass" 2>/dev/null; then
             DEPRECATED_FOUND=true
             DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\n### React.createClass Usage Found:\n"
             DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
-            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}$(grep -rn "React\.createClass\|createReactClass" \
-              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -10)\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}$(echo "$SCAN_TARGET" | xargs grep -n "React\.createClass\|createReactClass" 2>/dev/null | head -10)\n"
             DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
           fi
           
-          # Check for string refs (deprecated)
-          if grep -r 'ref="[^"]' --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | grep -v "/\*"; then
+          # Check for string refs (deprecated) - Fixed regex pattern
+          if echo "$SCAN_TARGET" | xargs grep -E 'ref="[^"]+"' 2>/dev/null; then
             DEPRECATED_FOUND=true
             DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\n### String Refs Found (use callback refs or createRef):\n"
             DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
-            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}$(grep -rn 'ref="[^"]' \
-              --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | grep -v "/\*" | head -10)\n"
+            DEPRECATED_DETAILS="${DEPRECATED_DETAILS}$(echo "$SCAN_TARGET" | xargs grep -nE 'ref="[^"]+"' 2>/dev/null | head -10)\n"
             DEPRECATED_DETAILS="${DEPRECATED_DETAILS}\`\`\`\n"
           fi
           
@@ -123,33 +148,66 @@ jobs:
         run: |
           echo "🤖 Scanning for AI-generated code markers..."
           
+          # Determine which files to scan
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ -f /tmp/changed_files.txt ]; then
+            FILES=$(cat /tmp/changed_files.txt | tr '\n' ' ')
+            if [ -z "$FILES" ]; then
+              echo "No JS/JSX files changed in this PR"
+              echo "ai_detected=false" >> $GITHUB_OUTPUT
+              exit 0
+            fi
+            echo "Scanning only changed files in PR"
+            SCAN_TARGET="$FILES"
+          else
+            echo "Scanning entire src/ directory (push to main/develop)"
+            SCAN_TARGET="src/"
+          fi
+          
           AI_MARKERS_FOUND=false
           AI_DETAILS=""
           
           # Common AI-generated code patterns
           # 1. Overly verbose comments typical of AI
-          AI_VERBOSE_COMMENTS=$(grep -r "// This function\|// This method\|// Helper function to\|// Utility function\|// This will\|// This is used to" \
-            --include="*.js" --include="*.jsx" src/ 2>/dev/null | wc -l)
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            AI_VERBOSE_COMMENTS=$(echo "$SCAN_TARGET" | xargs grep -h "// This function\|// This method\|// Helper function to\|// Utility function\|// This will\|// This is used to" 2>/dev/null | wc -l)
+          else
+            AI_VERBOSE_COMMENTS=$(grep -r "// This function\|// This method\|// Helper function to\|// Utility function\|// This will\|// This is used to" \
+              --include="*.js" --include="*.jsx" src/ 2>/dev/null | wc -l)
+          fi
           
-          if [ "$AI_VERBOSE_COMMENTS" -gt 50 ]; then
+          if [ "$AI_VERBOSE_COMMENTS" -gt 10 ]; then
             AI_MARKERS_FOUND=true
             AI_DETAILS="${AI_DETAILS}\n### ⚠️ Excessive Verbose Comments ($AI_VERBOSE_COMMENTS found):\n"
             AI_DETAILS="${AI_DETAILS}High number of AI-style verbose comments detected.\n"
             AI_DETAILS="${AI_DETAILS}\`\`\`\n"
-            AI_DETAILS="${AI_DETAILS}$(grep -rn "// This function\|// This method\|// Helper function to" \
-              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -10)\n"
+            if [ "${{ github.event_name }}" = "pull_request" ]; then
+              AI_DETAILS="${AI_DETAILS}$(echo "$SCAN_TARGET" | xargs grep -n "// This function\|// This method\|// Helper function to" 2>/dev/null | head -10)\n"
+            else
+              AI_DETAILS="${AI_DETAILS}$(grep -rn "// This function\|// This method\|// Helper function to" \
+                --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -10)\n"
+            fi
             AI_DETAILS="${AI_DETAILS}\`\`\`\n"
           fi
           
           # 2. Check for common AI placeholder text
-          if grep -ri "TODO: Implement\|FIXME: This is a placeholder\|// Add your code here\|// Your code here" \
-             --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
-            AI_MARKERS_FOUND=true
-            AI_DETAILS="${AI_DETAILS}\n### AI Placeholder Comments:\n"
-            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
-            AI_DETAILS="${AI_DETAILS}$(grep -rni "TODO: Implement\|FIXME: This is a placeholder" \
-              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -10)\n"
-            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            if echo "$SCAN_TARGET" | xargs grep -i "TODO: Implement\|FIXME: This is a placeholder\|// Add your code here\|// Your code here" 2>/dev/null; then
+              AI_MARKERS_FOUND=true
+              AI_DETAILS="${AI_DETAILS}\n### AI Placeholder Comments:\n"
+              AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+              AI_DETAILS="${AI_DETAILS}$(echo "$SCAN_TARGET" | xargs grep -ni "TODO: Implement\|FIXME: This is a placeholder" 2>/dev/null | head -10)\n"
+              AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+            fi
+          else
+            if grep -ri "TODO: Implement\|FIXME: This is a placeholder\|// Add your code here\|// Your code here" \
+               --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+              AI_MARKERS_FOUND=true
+              AI_DETAILS="${AI_DETAILS}\n### AI Placeholder Comments:\n"
+              AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+              AI_DETAILS="${AI_DETAILS}$(grep -rni "TODO: Implement\|FIXME: This is a placeholder" \
+                --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -10)\n"
+              AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+            fi
           fi
           
           # 3. Check for suspiciously perfect JSDoc patterns
@@ -206,29 +264,24 @@ jobs:
         run: |
           echo "🔎 Scanning for duplicate code blocks..."
           
-          # Run jscpd with custom configuration
-          cat > .jscpd.json << 'EOF'
-          {
-            "threshold": 5,
-            "minLines": 10,
-            "minTokens": 50,
-            "ignore": [
-              "**/*.min.js",
-              "**/node_modules/**",
-              "**/build/**",
-              "**/dist/**",
-              "**/test/**"
-            ],
-            "reporters": ["console", "json"],
-            "format": ["javascript", "jsx"],
-            "output": "./jscpd-report"
-          }
-          EOF
-          
           mkdir -p jscpd-report
           
-          # Run duplicate detection
-          jscpd src/ --config .jscpd.json > jscpd-output.txt 2>&1 || true
+          # Determine what to scan
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ -f /tmp/changed_files.txt ]; then
+            FILES=$(cat /tmp/changed_files.txt | tr '\n' ' ')
+            if [ -z "$FILES" ]; then
+              echo "No JS/JSX files changed in this PR"
+              echo "duplicates_found=false" >> $GITHUB_OUTPUT
+              exit 0
+            fi
+            echo "Scanning only changed files in PR for duplicates"
+            # Run duplicate detection on changed files only
+            jscpd $FILES --config .jscpd.json > jscpd-output.txt 2>&1 || true
+          else
+            echo "Scanning entire src/ directory for duplicates"
+            # Run duplicate detection on entire src/
+            jscpd src/ --config .jscpd.json > jscpd-output.txt 2>&1 || true
+          fi
           
           # Check if duplicates were found
           if [ -f "jscpd-report/jscpd-report.json" ]; then
@@ -274,35 +327,63 @@ jobs:
           echo "Checking for hardcoded secrets..."
           HARDCODED_SECRETS_FOUND=false
           HARDCODED_SECRETS_DETAILS=""
+          REDACTED_FINDINGS=""
           
-          if grep -r "password\s*=\s*['\"].\+['\"]\|api_key\s*=\s*['\"].\+['\"]\|secret\s*=\s*['\"].\+['\"]\|token\s*=\s*['\"].\+['\"]" \
-             --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | grep -v "password: ''" | grep -v "password: \"\"" | grep -v "token: ''"; then
-            ETHICS_VIOLATIONS=true
-            HARDCODED_SECRETS_FOUND=true
-            
-            # Capture the found secrets with full context
-            FOUND_SECRETS=$(grep -rn "password\s*=\s*['\"].\+['\"]\|api_key\s*=\s*['\"].\+['\"]\|secret\s*=\s*['\"].\+['\"]\|token\s*=\s*['\"]" \
-              --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | grep -v "password: ''" | grep -v "password: \"\"" | grep -v "token: ''" | head -10)
-            
-            ETHICS_DETAILS="${ETHICS_DETAILS}\n### 🚨 CRITICAL SECURITY VULNERABILITY: Hardcoded Credentials Found!\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}**⚠️ IMMEDIATE ACTION REQUIRED - SECURITY BREACH DETECTED ⚠️**\n\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}Hardcoded credentials have been detected in the source code. This is a **CRITICAL SECURITY VULNERABILITY**.\n\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}**Found Credentials (REDACTED FOR SECURITY):**\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}${FOUND_SECRETS}\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}**IMMEDIATE ACTION REQUIRED:**\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}1. 🚨 **IMMEDIATELY REVOKE/ROTATE** all exposed credentials\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}2. 🔒 **DELETE** the exposed keys from your service provider\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}3. 🗑️ **REMOVE** hardcoded secrets from code immediately\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}4. 🔐 Use environment variables or GitHub Secrets instead\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}5. 📋 A security advisory will be created for this issue\n\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}**All repository members will be notified of this security issue.**\n\n"
-            
-            # Store secrets details for security advisory
-            HARDCODED_SECRETS_DETAILS="$FOUND_SECRETS"
+          # Determine which files to scan
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ -f /tmp/changed_files.txt ]; then
+            FILES=$(cat /tmp/changed_files.txt | tr '\n' ' ')
+            if [ -z "$FILES" ]; then
+              echo "No JS/JSX files changed in this PR - skipping secrets check"
+            else
+              echo "Scanning only changed files in PR for hardcoded secrets"
+              # Use -E for extended regex, scan only changed files
+              SCAN_CMD="echo \"$FILES\" | xargs grep -En"
+            fi
+          else
+            echo "Scanning entire src/ directory for hardcoded secrets"
+            SCAN_CMD="grep -rEn"
+            FILES="src/"
+          fi
+          
+          # Fixed regex pattern with -E flag
+          # Matches: password="value", api_key="value", secret="value", token="value"
+          # Also matches: password: "value" (object property syntax)
+          if [ -n "$FILES" ]; then
+            SECRET_PATTERN='(password|api_key|secret|token)\s*[:=]\s*["047][^"047]{3,}["047]'
+            
+            if eval "$SCAN_CMD \"$SECRET_PATTERN\" $FILES" 2>/dev/null | grep -v "password\s*[:=]\s*[\"047][\"047]" | grep -v "token\s*[:=]\s*[\"047][\"047]"; then
+              ETHICS_VIOLATIONS=true
+              HARDCODED_SECRETS_FOUND=true
+              
+              # Capture findings but REDACT the actual secret values
+              FOUND_SECRETS=$(eval "$SCAN_CMD \"$SECRET_PATTERN\" $FILES" 2>/dev/null | grep -v "password\s*[:=]\s*[\"047][\"047]" | grep -v "token\s*[:=]\s*[\"047][\"047]" | head -10)
+              
+              # Redact actual secret values for security
+              REDACTED_FINDINGS=$(echo "$FOUND_SECRETS" | sed -E 's/(password|api_key|secret|token)(\s*[:=]\s*["047])[^"047]+(["047])/\1\2***REDACTED***\3/gi')
+              
+              ETHICS_DETAILS="${ETHICS_DETAILS}\n### 🚨 CRITICAL SECURITY VULNERABILITY: Hardcoded Credentials Found!\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}**⚠️ IMMEDIATE ACTION REQUIRED - SECURITY BREACH DETECTED ⚠️**\n\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}Hardcoded credentials have been detected in the source code. This is a **CRITICAL SECURITY VULNERABILITY**.\n\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}**Location of Credentials (values REDACTED for security):**\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}```\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}${REDACTED_FINDINGS}\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}```\n\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}**IMMEDIATE ACTION REQUIRED:**\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}1. 🚨 **IMMEDIATELY REVOKE/ROTATE** all exposed credentials\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}2. 🔒 **DELETE** the exposed keys from your service provider\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}3. 🗑️ **REMOVE** hardcoded secrets from code immediately\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}4. 🔐 Use environment variables or GitHub Secrets instead\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}5. 📋 A security advisory will be created for this issue\n\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}**All repository members will be notified of this security issue.**\n\n"
+              
+              # Store REDACTED details for security advisory
+              HARDCODED_SECRETS_DETAILS="$REDACTED_FINDINGS"
+            fi
           fi
           
+          # Output hardcoded secrets info for later steps
+          echo "hardcoded_secrets_found=$HARDCODED_SECRETS_FOUND" >> $GITHUB_OUTPUT
+          
           # Output hardcoded secrets info for later steps
           echo "hardcoded_secrets_found=$HARDCODED_SECRETS_FOUND" >> $GITHUB_OUTPUT
           if [ "$HARDCODED_SECRETS_FOUND" = true ]; then

From 1b58cbb5669a8712ba79be9d18694302967a9f19 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 24 Jan 2026 17:40:31 +0000
Subject: [PATCH 08/10] Resolve all bot code review issues

Fixes per copilot-pull-request-reviewer bot feedback:

1. Security Advisory Privacy: Changed to create DRAFT advisories
   (private until fixed) instead of public advisories that could
   prematurely disclose vulnerabilities

2. Assignment Handling: Create tracking issue first, then assign
   collaborators individually with error handling to prevent
   failures from blocking issue creation

3. Comment Update Pattern: Use append strategy as fallback to
   ensure advisory link is added even if exact heading not found

4. Documentation Accuracy:
   - Updated "RESTORED" to accurate language about new check
   - Clarified PR blocking behavior for deprecated patterns
   - Added note about DRAFT advisory status

All critical bot review issues now resolved.

Co-authored-by: supervoidcoder <88671013+supervoidcoder@users.noreply.github.com>
---
 .github/workflows/code-quality-check.yml | 50 ++++++++++++++++++++----
 docs/CODE_QUALITY_WORKFLOW.md            | 13 +++---
 2 files changed, 49 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/code-quality-check.yml b/.github/workflows/code-quality-check.yml
index 0522c11cc..69534422c 100644
--- a/.github/workflows/code-quality-check.yml
+++ b/.github/workflows/code-quality-check.yml
@@ -573,11 +573,13 @@ jobs:
             const secretsDetails = process.env.HARDCODED_SECRETS_DETAILS || '';
             
             try {
-              // Create a security advisory
+              // Create a DRAFT security advisory (not public until fixed)
+              // This prevents premature disclosure before the PR is fixed
               const advisory = await github.rest.securityAdvisories.createRepositoryAdvisory({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 summary: '🚨 CRITICAL: Hardcoded Credentials Detected in Source Code',
+                state: 'draft', // Keep private until fixed
                 description: `## CRITICAL SECURITY VULNERABILITY
             
             Hardcoded credentials have been detected in the source code during automated security scanning.
@@ -709,14 +711,34 @@ jobs:
             
             // Also create an issue for tracking
             try {
-              await github.rest.issues.create({
+              // First create issue without assignees to avoid failures
+              const issueResponse = await github.rest.issues.create({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
                 title: `🚨 CRITICAL: Hardcoded Credentials Detected (${advisoryId})`,
                 body: securityMessage,
-                labels: ['security', 'critical', 'needs-immediate-attention'],
-                assignees: collaborators.data.slice(0, 10).map(c => c.login) // Assign first 10 collaborators
+                labels: ['security', 'critical', 'needs-immediate-attention']
               });
+              
+              const issueNumber = issueResponse.data.number;
+              console.log(`Tracking issue created: #${issueNumber}`);
+              
+              // Try to assign collaborators individually to handle failures gracefully
+              const potentialAssignees = collaborators.data.slice(0, 10);
+              for (const collaborator of potentialAssignees) {
+                try {
+                  await github.rest.issues.addAssignees({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issueNumber,
+                    assignees: [collaborator.login]
+                  });
+                  console.log(`Assigned @${collaborator.login} to tracking issue`);
+                } catch (assigneeError) {
+                  console.warn(`Failed to assign @${collaborator.login}:`, assigneeError.message || assigneeError);
+                  // Continue with next assignee
+                }
+              }
             } catch (error) {
               console.error('Failed to create tracking issue:', error);
             }
@@ -750,10 +772,22 @@ jobs:
             
             if (botComment) {
               // Update the comment to add security advisory link
-              const updatedBody = botComment.body.replace(
-                /## 🚨 Security & Ethics Violations/,
-                `## 🚨 Security & Ethics Violations\n\n**🔗 Security Advisory Created:** [${advisoryId}](${advisoryUrl})\n`
-              );
+              // Use append strategy to be more robust
+              let updatedBody = botComment.body;
+              
+              // Avoid adding advisory link multiple times
+              if (!updatedBody.includes(advisoryUrl)) {
+                // Try to find the security violations section
+                if (updatedBody.includes('## 🚨 Security & Ethics Violations')) {
+                  updatedBody = updatedBody.replace(
+                    /## 🚨 Security & Ethics Violations/,
+                    `## 🚨 Security & Ethics Violations\n\n**🔗 Security Advisory Created (DRAFT):** [${advisoryId}](${advisoryUrl})\n*Advisory is in draft mode and private until issue is resolved.*\n`
+                  );
+                } else {
+                  // If section not found, append to end
+                  updatedBody += `\n\n---\n\n**🔗 Security Advisory Created (DRAFT):** [${advisoryId}](${advisoryUrl})\n*Advisory is in draft mode and private until issue is resolved.*`;
+                }
+              }
               
               await github.rest.issues.updateComment({
                 owner: context.repo.owner,
diff --git a/docs/CODE_QUALITY_WORKFLOW.md b/docs/CODE_QUALITY_WORKFLOW.md
index 2ed61cd66..b26771f42 100644
--- a/docs/CODE_QUALITY_WORKFLOW.md
+++ b/docs/CODE_QUALITY_WORKFLOW.md
@@ -49,10 +49,11 @@ Uses `jscpd` to find copy-pasted code blocks:
 
 Scans for security vulnerabilities and unsafe patterns:
 
-- **🚨 CRITICAL: Hardcoded Secrets**
-  - Detects: `password = "..."`, `api_key = "..."`, `secret = "..."`, `token = "..."`
-  - **Action Required**: Remove immediately and rotate any exposed credentials
+- **🚨 CRITICAL: Hardcoded Secrets (Automated Security Check)**
+  - Detects patterns like `password = "..."`, `api_key = "..."`, `secret = "..."`, `token = "..."`
+  - **Action Required**: Remove any detected secrets immediately and rotate any exposed credentials
   - Use environment variables or GitHub Secrets instead
+  - Creates a DRAFT security advisory (private until fixed)
 
 - **⚠️ eval() Usage**
   - Allows arbitrary code execution (security risk)
@@ -241,9 +242,9 @@ If you need to temporarily disable a check:
 
 ### Q: Will this block my PR from merging?
 
-**A**: Yes, if **critical issues** are found:
-- Deprecated React patterns (requires migration)
-- Security violations (hardcoded secrets, eval, etc.)
+**A**: It depends on what was found:
+- **Security violations** (hardcoded secrets, use of `eval`, etc.) will **block** your PR until fixed.
+- **Deprecated React patterns** may **warn or block** depending on configuration. The workflow currently fails on these patterns, but since there are 11 known legacy usages inherited from upstream Scratch/TurboWarp, the workflow only scans changed files in PRs to avoid blocking existing code.
 
 Non-critical issues (AI markers, some duplicates) will warn but won't block.
 

From 8037035c94bf0ce9eb7fdaf38d1a76ff7dc3faec Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 24 Jan 2026 17:52:49 +0000
Subject: [PATCH 09/10] Fix all 6 CodeRabbit review issues

Comprehensive fixes per CodeRabbit feedback:

1. **Pagination for changed files** - Use github.paginate to fetch ALL
   changed files, not just first 100

2. **AI detection scoped to PR files** - JSDoc, long identifiers, and
   AI service marker checks now properly scope to PR-changed files using
   xargs with changed file list

3. **Security checks scoped to PR files** - eval(), innerHTML, security
   TODOs, and disabled-security checks now properly limited to PR files

4. **Fork PR permission handling** - Detect fork PRs and skip comment
   creation to avoid 403 errors, with try-catch fallback

5. **Secret pattern fixes** - Fixed regex to handle both single/double
   quotes (\047 for single quote), removed unsafe eval, use direct grep
   with || true for safe execution

6. **Documentation secret fixed** - Replaced realistic-looking API key
   with obvious placeholder "YOUR_API_KEY_HERE" and env var reference

All checks now properly scope to PR changes while maintaining full
repo scans for main/develop pushes.

Co-authored-by: supervoidcoder <88671013+supervoidcoder@users.noreply.github.com>
---
 .github/workflows/code-quality-check.yml | 241 +++++++++++++++--------
 docs/CODE_QUALITY_WORKFLOW.md            |   2 +-
 2 files changed, 165 insertions(+), 78 deletions(-)

diff --git a/.github/workflows/code-quality-check.yml b/.github/workflows/code-quality-check.yml
index 69534422c..fa9bd1dc7 100644
--- a/.github/workflows/code-quality-check.yml
+++ b/.github/workflows/code-quality-check.yml
@@ -41,14 +41,15 @@ jobs:
         uses: actions/github-script@v7
         with:
           script: |
-            const { data: files } = await github.rest.pulls.listFiles({
+            // Paginate through all changed files (not just first 100)
+            const allFiles = await github.paginate(github.rest.pulls.listFiles, {
               owner: context.repo.owner,
               repo: context.repo.repo,
               pull_number: context.payload.pull_request.number,
               per_page: 100
             });
             
-            const jsFiles = files
+            const jsFiles = allFiles
               .filter(f => f.status !== 'removed')
               .filter(f => /\.(js|jsx)$/.test(f.filename))
               .map(f => f.filename)
@@ -210,9 +211,14 @@ jobs:
             fi
           fi
           
-          # 3. Check for suspiciously perfect JSDoc patterns
-          JSDOC_COUNT=$(grep -r "/\*\*" --include="*.js" --include="*.jsx" src/ 2>/dev/null | wc -l)
-          JSDOC_PARAM_COUNT=$(grep -r "@param\|@returns\|@throws" --include="*.js" --include="*.jsx" src/ 2>/dev/null | wc -l)
+          # 3. Check for suspiciously perfect JSDoc patterns (scoped to PR files)
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ -n "$FILES" ]; then
+            JSDOC_COUNT=$(echo "$FILES" | xargs grep -h "/\*\*" 2>/dev/null | wc -l)
+            JSDOC_PARAM_COUNT=$(echo "$FILES" | xargs grep -h "@param\|@returns\|@throws" 2>/dev/null | wc -l)
+          else
+            JSDOC_COUNT=$(grep -r "/\*\*" --include="*.js" --include="*.jsx" src/ 2>/dev/null | wc -l)
+            JSDOC_PARAM_COUNT=$(grep -r "@param\|@returns\|@throws" --include="*.js" --include="*.jsx" src/ 2>/dev/null | wc -l)
+          fi
           
           if [ "$JSDOC_COUNT" -gt 100 ] && [ "$JSDOC_PARAM_COUNT" -gt 200 ]; then
             AI_DETAILS="${AI_DETAILS}\n### ℹ️ High JSDoc Usage:\n"
@@ -220,26 +226,44 @@ jobs:
             AI_DETAILS="${AI_DETAILS}This might indicate AI-generated documentation. Please verify quality.\n"
           fi
           
-          # 4. Check for overly descriptive variable names (AI tendency)
-          if grep -r "const \w\{30,\}\|let \w\{30,\}\|function \w\{30,\}" \
-             --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
-            AI_MARKERS_FOUND=true
-            AI_DETAILS="${AI_DETAILS}\n### Overly Long Identifiers:\n"
-            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
-            AI_DETAILS="${AI_DETAILS}$(grep -rn "const \w\{30,\}\|let \w\{30,\}\|function \w\{30,\}" \
-              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -5)\n"
-            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+          # 4. Check for overly descriptive variable names (AI tendency) - scoped to PR files
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ -n "$FILES" ]; then
+            if echo "$FILES" | xargs grep -E "const \w{30,}|let \w{30,}|function \w{30,}" 2>/dev/null; then
+              AI_MARKERS_FOUND=true
+              AI_DETAILS="${AI_DETAILS}\n### Overly Long Identifiers:\n"
+              AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+              AI_DETAILS="${AI_DETAILS}$(echo "$FILES" | xargs grep -En "const \w{30,}|let \w{30,}|function \w{30,}" 2>/dev/null | head -5)\n"
+              AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+            fi
+          else
+            if grep -rE "const \w{30,}|let \w{30,}|function \w{30,}" --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+              AI_MARKERS_FOUND=true
+              AI_DETAILS="${AI_DETAILS}\n### Overly Long Identifiers:\n"
+              AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+              AI_DETAILS="${AI_DETAILS}$(grep -rEn "const \w{30,}|let \w{30,}|function \w{30,}" \
+                --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -5)\n"
+              AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+            fi
           fi
           
-          # 5. Check for AI service markers (accidental inclusions)
-          if grep -ri "ChatGPT\|Claude\|GPT-4\|Copilot generated\|AI generated" \
-             --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
-            AI_MARKERS_FOUND=true
-            AI_DETAILS="${AI_DETAILS}\n### 🚨 AI Service Mentions Found:\n"
-            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
-            AI_DETAILS="${AI_DETAILS}$(grep -rni "ChatGPT\|Claude\|GPT-4\|Copilot generated\|AI generated" \
-              --include="*.js" --include="*.jsx" src/ 2>/dev/null)\n"
-            AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+          # 5. Check for AI service markers (accidental inclusions) - scoped to PR files
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ -n "$FILES" ]; then
+            if echo "$FILES" | xargs grep -iE "ChatGPT|Claude|GPT-4|Copilot generated|AI generated" 2>/dev/null; then
+              AI_MARKERS_FOUND=true
+              AI_DETAILS="${AI_DETAILS}\n### 🚨 AI Service Mentions Found:\n"
+              AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+              AI_DETAILS="${AI_DETAILS}$(echo "$FILES" | xargs grep -inE "ChatGPT|Claude|GPT-4|Copilot generated|AI generated" 2>/dev/null)\n"
+              AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+            fi
+          else
+            if grep -riE "ChatGPT|Claude|GPT-4|Copilot generated|AI generated" --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+              AI_MARKERS_FOUND=true
+              AI_DETAILS="${AI_DETAILS}\n### 🚨 AI Service Mentions Found:\n"
+              AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+              AI_DETAILS="${AI_DETAILS}$(grep -rniE "ChatGPT|Claude|GPT-4|Copilot generated|AI generated" \
+                --include="*.js" --include="*.jsx" src/ 2>/dev/null)\n"
+              AI_DETAILS="${AI_DETAILS}\`\`\`\n"
+            fi
           fi
           
           if [ "$AI_MARKERS_FOUND" = true ]; then
@@ -336,30 +360,36 @@ jobs:
               echo "No JS/JSX files changed in this PR - skipping secrets check"
             else
               echo "Scanning only changed files in PR for hardcoded secrets"
-              # Use -E for extended regex, scan only changed files
-              SCAN_CMD="echo \"$FILES\" | xargs grep -En"
             fi
           else
             echo "Scanning entire src/ directory for hardcoded secrets"
-            SCAN_CMD="grep -rEn"
             FILES="src/"
           fi
           
-          # Fixed regex pattern with -E flag
-          # Matches: password="value", api_key="value", secret="value", token="value"
-          # Also matches: password: "value" (object property syntax)
+          # Fixed regex pattern with -E flag for extended regex
+          # Matches both single and double quotes: password="value", password='value', api_key="value", etc.
+          # Also matches object property syntax: password: "value"
           if [ -n "$FILES" ]; then
-            SECRET_PATTERN='(password|api_key|secret|token)\s*[:=]\s*["047][^"047]{3,}["047]'
+            SECRET_PATTERN='(password|api_key|secret|token)\s*[:=]\s*["\047][^"\047]{3,}["\047]'
             
-            if eval "$SCAN_CMD \"$SECRET_PATTERN\" $FILES" 2>/dev/null | grep -v "password\s*[:=]\s*[\"047][\"047]" | grep -v "token\s*[:=]\s*[\"047][\"047]"; then
+            # Run grep directly (no eval) and filter out empty strings
+            if [ "${{ github.event_name }}" = "pull_request" ]; then
+              # For PRs, use xargs with changed files
+              SCAN_RESULT=$(echo "$FILES" | xargs grep -En "$SECRET_PATTERN" 2>/dev/null | grep -v 'password\s*[:=]\s*["\047]["\047]' | grep -v 'token\s*[:=]\s*["\047]["\047]' || true)
+            else
+              # For pushes to main/develop, scan src/ recursively
+              SCAN_RESULT=$(grep -rEn "$SECRET_PATTERN" src/ 2>/dev/null | grep -v 'password\s*[:=]\s*["\047]["\047]' | grep -v 'token\s*[:=]\s*["\047]["\047]' || true)
+            fi
+            
+            if [ -n "$SCAN_RESULT" ]; then
               ETHICS_VIOLATIONS=true
               HARDCODED_SECRETS_FOUND=true
               
-              # Capture findings but REDACT the actual secret values
-              FOUND_SECRETS=$(eval "$SCAN_CMD \"$SECRET_PATTERN\" $FILES" 2>/dev/null | grep -v "password\s*[:=]\s*[\"047][\"047]" | grep -v "token\s*[:=]\s*[\"047][\"047]" | head -10)
+              # Capture findings (limit to 10)
+              FOUND_SECRETS=$(echo "$SCAN_RESULT" | head -10)
               
-              # Redact actual secret values for security
-              REDACTED_FINDINGS=$(echo "$FOUND_SECRETS" | sed -E 's/(password|api_key|secret|token)(\s*[:=]\s*["047])[^"047]+(["047])/\1\2***REDACTED***\3/gi')
+              # Redact actual secret values for security (handle both single and double quotes)
+              REDACTED_FINDINGS=$(echo "$FOUND_SECRETS" | sed -E 's/(password|api_key|secret|token)(\s*[:=]\s*["\047])[^"\047]+(["\047])/\1\2***REDACTED***\3/gi')
               
               ETHICS_DETAILS="${ETHICS_DETAILS}\n### 🚨 CRITICAL SECURITY VULNERABILITY: Hardcoded Credentials Found!\n"
               ETHICS_DETAILS="${ETHICS_DETAILS}**⚠️ IMMEDIATE ACTION REQUIRED - SECURITY BREACH DETECTED ⚠️**\n\n"
@@ -392,53 +422,98 @@ jobs:
             echo "EOF" >> $GITHUB_OUTPUT
           fi
           
-          # 2. Check for eval() usage (security risk)
-          if grep -r "eval(" --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// "; then
-            ETHICS_VIOLATIONS=true
-            ETHICS_DETAILS="${ETHICS_DETAILS}\n### ⚠️ eval() Usage Detected:\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rn "eval(" --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | head -10)\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+          # 2. Check for eval() usage (security risk) - scoped to PR files
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ -n "$FILES" ]; then
+            if echo "$FILES" | xargs grep "eval(" 2>/dev/null | grep -v "// "; then
+              ETHICS_VIOLATIONS=true
+              ETHICS_DETAILS="${ETHICS_DETAILS}\n### ⚠️ eval() Usage Detected:\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}$(echo "$FILES" | xargs grep -n "eval(" 2>/dev/null | grep -v "// " | head -10)\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+            fi
+          else
+            if grep -r "eval(" --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// "; then
+              ETHICS_VIOLATIONS=true
+              ETHICS_DETAILS="${ETHICS_DETAILS}\n### ⚠️ eval() Usage Detected:\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rn "eval(" --include="*.js" --include="*.jsx" src/ 2>/dev/null | grep -v "// " | head -10)\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+            fi
           fi
           
-          # 3. Check for dangerous innerHTML usage without sanitization
-          if grep -r "dangerouslySetInnerHTML\|innerHTML\s*=" --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
-            ETHICS_VIOLATIONS=true
-            ETHICS_DETAILS="${ETHICS_DETAILS}\n### ⚠️ Potentially Unsafe HTML Injection:\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rn "dangerouslySetInnerHTML\|innerHTML\s*=" \
-              --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -10)\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}Make sure these are properly sanitized to prevent XSS attacks.\n"
+          # 3. Check for dangerous innerHTML usage without sanitization - scoped to PR files
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ -n "$FILES" ]; then
+            if echo "$FILES" | xargs grep -E "dangerouslySetInnerHTML|innerHTML\s*=" 2>/dev/null; then
+              ETHICS_VIOLATIONS=true
+              ETHICS_DETAILS="${ETHICS_DETAILS}\n### ⚠️ Potentially Unsafe HTML Injection:\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}$(echo "$FILES" | xargs grep -nE "dangerouslySetInnerHTML|innerHTML\s*=" 2>/dev/null | head -10)\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}Make sure these are properly sanitized to prevent XSS attacks.\n"
+            fi
+          else
+            if grep -rE "dangerouslySetInnerHTML|innerHTML\s*=" --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+              ETHICS_VIOLATIONS=true
+              ETHICS_DETAILS="${ETHICS_DETAILS}\n### ⚠️ Potentially Unsafe HTML Injection:\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rnE "dangerouslySetInnerHTML|innerHTML\s*=" \
+                --include="*.js" --include="*.jsx" src/ 2>/dev/null | head -10)\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}Make sure these are properly sanitized to prevent XSS attacks.\n"
+            fi
           fi
           
           # 4. Check for console.log in production code (not unethical but bad practice)
-          CONSOLE_COUNT=$(grep -r "console\.(log\|debug\|info)" --include="*.js" --include="*.jsx" src/ 2>/dev/null | wc -l)
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ -n "$FILES" ]; then
+            CONSOLE_COUNT=$(echo "$FILES" | xargs grep -E "console\.(log|debug|info)" 2>/dev/null | wc -l)
+          else
+            CONSOLE_COUNT=$(grep -rE "console\.(log|debug|info)" --include="*.js" --include="*.jsx" src/ 2>/dev/null | wc -l)
+          fi
           if [ "$CONSOLE_COUNT" -gt 100 ]; then
             ETHICS_DETAILS="${ETHICS_DETAILS}\n### ℹ️ Excessive Console Statements:\n"
             ETHICS_DETAILS="${ETHICS_DETAILS}Found $CONSOLE_COUNT console.log statements. Consider using a proper logging library.\n"
           fi
           
-          # 5. Check for TODO/FIXME that might indicate incomplete security implementations
-          if grep -ri "TODO.*security\|FIXME.*auth\|TODO.*sanitize\|FIXME.*XSS" \
-             --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
-            ETHICS_VIOLATIONS=true
-            ETHICS_DETAILS="${ETHICS_DETAILS}\n### 🚨 Incomplete Security TODOs:\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rni "TODO.*security\|FIXME.*auth\|TODO.*sanitize\|FIXME.*XSS" \
-              --include="*.js" --include="*.jsx" src/ 2>/dev/null)\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+          # 5. Check for TODO/FIXME that might indicate incomplete security implementations - scoped to PR files
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ -n "$FILES" ]; then
+            if echo "$FILES" | xargs grep -iE "TODO.*security|FIXME.*auth|TODO.*sanitize|FIXME.*XSS" 2>/dev/null; then
+              ETHICS_VIOLATIONS=true
+              ETHICS_DETAILS="${ETHICS_DETAILS}\n### 🚨 Incomplete Security TODOs:\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}$(echo "$FILES" | xargs grep -niE "TODO.*security|FIXME.*auth|TODO.*sanitize|FIXME.*XSS" 2>/dev/null)\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+            fi
+          else
+            if grep -riE "TODO.*security|FIXME.*auth|TODO.*sanitize|FIXME.*XSS" \
+               --include="*.js" --include="*.jsx" src/ 2>/dev/null; then
+              ETHICS_VIOLATIONS=true
+              ETHICS_DETAILS="${ETHICS_DETAILS}\n### 🚨 Incomplete Security TODOs:\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rniE "TODO.*security|FIXME.*auth|TODO.*sanitize|FIXME.*XSS" \
+                --include="*.js" --include="*.jsx" src/ 2>/dev/null)\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+            fi
           fi
           
-          # 6. Check for disabled security features
-          if grep -r "eslint-disable.*security\|@ts-ignore.*security\|skipLibCheck.*true" \
-             --include="*.js" --include="*.jsx" --include="*.ts" --include="*.tsx" src/ 2>/dev/null; then
-            ETHICS_VIOLATIONS=true
-            ETHICS_DETAILS="${ETHICS_DETAILS}\n### ⚠️ Disabled Security Checks:\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rn "eslint-disable.*security\|@ts-ignore.*security" \
-              --include="*.js" --include="*.jsx" src/ 2>/dev/null)\n"
-            ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+          # 6. Check for disabled security features - scoped to PR files
+          if [ "${{ github.event_name }}" = "pull_request" ] && [ -n "$FILES" ]; then
+            if echo "$FILES" | xargs grep -E "eslint-disable.*security|@ts-ignore.*security|skipLibCheck.*true" 2>/dev/null; then
+              ETHICS_VIOLATIONS=true
+              ETHICS_DETAILS="${ETHICS_DETAILS}\n### ⚠️ Disabled Security Checks:\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}$(echo "$FILES" | xargs grep -nE "eslint-disable.*security|@ts-ignore.*security" 2>/dev/null)\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+            fi
+          else
+            if grep -rE "eslint-disable.*security|@ts-ignore.*security|skipLibCheck.*true" \
+               --include="*.js" --include="*.jsx" --include="*.ts" --include="*.tsx" src/ 2>/dev/null; then
+              ETHICS_VIOLATIONS=true
+              ETHICS_DETAILS="${ETHICS_DETAILS}\n### ⚠️ Disabled Security Checks:\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}$(grep -rnE "eslint-disable.*security|@ts-ignore.*security" \
+                --include="*.js" --include="*.jsx" src/ 2>/dev/null)\n"
+              ETHICS_DETAILS="${ETHICS_DETAILS}\`\`\`\n"
+            fi
           fi
           
           if [ "$ETHICS_VIOLATIONS" = true ]; then
@@ -540,14 +615,26 @@ jobs:
             report += `*🤖 Automated code quality check performed by GitHub Actions*\n`;
             report += `*Run ID: [${context.runId}](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})*\n`;
             
-            // Post comment on PR if this is a pull request
+            // Post comment on PR if this is a pull request (skip for forks due to permissions)
             if (context.payload.pull_request) {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.payload.pull_request.number,
-                body: report
-              });
+              const isFork = context.payload.pull_request.head.repo.fork || 
+                             context.payload.pull_request.head.repo.full_name !== `${context.repo.owner}/${context.repo.repo}`;
+              
+              if (!isFork) {
+                try {
+                  await github.rest.issues.createComment({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: context.payload.pull_request.number,
+                    body: report
+                  });
+                } catch (error) {
+                  console.warn('Failed to create comment (possibly due to permissions):', error.message);
+                  // Don't fail the workflow if comment creation fails
+                }
+              } else {
+                console.log('Skipping PR comment for fork PR due to read-only token');
+              }
             }
             
             // Set output for subsequent steps
diff --git a/docs/CODE_QUALITY_WORKFLOW.md b/docs/CODE_QUALITY_WORKFLOW.md
index b26771f42..83b4202f9 100644
--- a/docs/CODE_QUALITY_WORKFLOW.md
+++ b/docs/CODE_QUALITY_WORKFLOW.md
@@ -163,7 +163,7 @@ function MyComponent() {
 
 **Before:**
 ```js
-const apiKey = "sk-1234567890abcdef";
+const apiKey = process.env.API_KEY || "YOUR_API_KEY_HERE";
 fetch(`https://api.example.com?key=${apiKey}`);
 ```
 

From a591d95c5b40893328af7ba7237d92be9f7b7646 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 24 Jan 2026 17:55:48 +0000
Subject: [PATCH 10/10] Remove verbose documentation files

Deleted CODE_QUALITY.md and docs/CODE_QUALITY_WORKFLOW.md per
maintainer request. The workflow YAML file itself contains sufficient
inline documentation via comments.

Co-authored-by: supervoidcoder <88671013+supervoidcoder@users.noreply.github.com>
---
 CODE_QUALITY.md               | 140 --------------
 docs/CODE_QUALITY_WORKFLOW.md | 342 ----------------------------------
 2 files changed, 482 deletions(-)
 delete mode 100644 CODE_QUALITY.md
 delete mode 100644 docs/CODE_QUALITY_WORKFLOW.md

diff --git a/CODE_QUALITY.md b/CODE_QUALITY.md
deleted file mode 100644
index 6f1da3884..000000000
--- a/CODE_QUALITY.md
+++ /dev/null
@@ -1,140 +0,0 @@
-# Code Quality Workflow - Quick Reference
-
-## What This Workflow Does
-
-Automatically checks your code for:
-- 🔄 **Deprecated React patterns** (11 instances currently in codebase)
-- 🤖 **AI-generated code markers** (quality assurance)
-- 📋 **Duplicate code** (copy-paste detection)
-- 🔒 **Security issues** (hardcoded secrets, XSS risks)
-
-## When It Runs
-
-- ✅ Every pull request
-- ✅ Pushes to `main` or `develop`
-
-## What Happens
-
-1. Workflow runs automatically
-2. Posts detailed report as PR comment
-3. Uploads full reports as artifacts
-4. **Fails if critical issues found**
-
-## Current Codebase Status
-
-As of January 2025:
-- **11 deprecated React methods** detected in src/
-  - `componentWillReceiveProps` in 10 files
-  - `componentWillMount` in 1 file
-- These are **legacy patterns** inherited from Scratch/TurboWarp
-- Migration to hooks/modern React is recommended but not urgent
-
-## For Contributors
-
-### If Your PR Gets Flagged
-
-**Don't panic!** The workflow is here to help, not block. Here's what to do:
-
-1. **Read the report** - Check PR comments for details
-2. **Assess severity**:
-   - 🚨 **Critical** (hardcoded secrets, deprecated): Fix before merge
-   - ⚠️ **Warning** (AI markers, duplicates): Review and improve if possible
-3. **Fix issues** - Follow recommendations in the report
-4. **Push changes** - Workflow runs again automatically
-
-### Common Scenarios
-
-#### "My code uses AI tools like Copilot"
-**That's fine!** We use AI tools too. The check is about:
-- Reviewing what AI generated
-- Removing placeholder comments
-- Ensuring code quality
-
-Just review and clean up the output before committing.
-
-#### "I have a hardcoded API key"
-**🚨 STOP!** This is critical:
-1. Remove the hardcoded secret immediately
-2. Use environment variables: `process.env.API_KEY`
-3. If it's a real key, **rotate it** (invalidate and create new)
-4. Add `.env` to `.gitignore`
-
-#### "My code has duplicates"
-**Consider refactoring**, but it's not urgent:
-- Extract common code to utilities
-- Use shared components
-- Follow DRY (Don't Repeat Yourself) principle
-
-#### "I'm fixing a deprecated React method"
-**Great!** Migration path:
-```jsx
-// Old (deprecated)
-componentWillReceiveProps(nextProps) {
-  if (nextProps.value !== this.props.value) {
-    this.setState({value: nextProps.value});
-  }
-}
-
-// New (hooks)
-useEffect(() => {
-  setValue(props.value);
-}, [props.value]);
-
-// Or use getDerivedStateFromProps (class components)
-static getDerivedStateFromProps(props, state) {
-  if (props.value !== state.value) {
-    return {value: props.value};
-  }
-  return null;
-}
-```
-
-## For Maintainers
-
-### Adjusting Thresholds
-
-Edit `.jscpd.json`:
-```json
-{
-  "threshold": 5,      // % duplication to fail
-  "minLines": 10,      // minimum lines to count
-  "minTokens": 50      // minimum tokens to count
-}
-```
-
-### Disabling Checks (Emergency Only)
-
-Edit `.github/workflows/code-quality-check.yml`:
-```yaml
-- name: Check for deprecated React functions
-  if: false  # Temporarily disable
-```
-
-**Warning**: Only do this in emergencies. Re-enable ASAP.
-
-### Monitoring
-
-- **Artifacts**: Full jscpd reports available for 30 days
-- **PR Comments**: Automatically posted on every PR
-- **Actions Tab**: View workflow history
-
-## Documentation
-
-Full documentation: [`docs/CODE_QUALITY_WORKFLOW.md`](./docs/CODE_QUALITY_WORKFLOW.md)
-
-Topics covered:
-- Detailed explanation of each check
-- How to fix common issues
-- Configuration options
-- FAQ and troubleshooting
-- Best practices
-
-## Questions?
-
-- **Bug in workflow?** Open an issue with `workflow` label
-- **False positive?** Open an issue with `code-quality` label
-- **Need help fixing?** Ask in PR comments, maintainers will assist
-
----
-
-**Remember**: This workflow is a **helper**, not a blocker. It catches issues early so you don't have to worry about them later! 🎉
diff --git a/docs/CODE_QUALITY_WORKFLOW.md b/docs/CODE_QUALITY_WORKFLOW.md
deleted file mode 100644
index 83b4202f9..000000000
--- a/docs/CODE_QUALITY_WORKFLOW.md
+++ /dev/null
@@ -1,342 +0,0 @@
-# Code Quality & Standards Check Workflow
-
-## Overview
-
-The **Code Quality Check** workflow is an automated GitHub Actions workflow that analyzes code for quality issues, security vulnerabilities, and deprecated patterns. It runs on all pull requests and pushes to main/develop branches.
-
-## What It Checks
-
-### 1. 🔄 Deprecated React Patterns
-
-Detects legacy React patterns that should be migrated to modern alternatives:
-
-- **Deprecated Lifecycle Methods**:
-  - `componentWillMount()` → Use `componentDidMount()` or hooks
-  - `componentWillReceiveProps()` → Use `componentDidUpdate()` or `getDerivedStateFromProps()`
-  - `componentWillUpdate()` → Use `componentDidUpdate()` or `getSnapshotBeforeUpdate()`
-  
-- **UNSAFE_ Methods**: Even with the `UNSAFE_` prefix, these are still deprecated
-
-- **React.createClass**: Legacy API, should use ES6 classes or function components
-
-- **String Refs**: Pattern like `ref="myRef"` is deprecated, use callback refs or `createRef()`
-
-**Why it matters**: Deprecated methods may be removed in future React versions and can cause performance issues.
-
-### 2. 🤖 AI-Generated Code Detection
-
-Identifies patterns commonly found in AI-generated code:
-
-- **Verbose Comments**: Excessive "This function...", "This method..." style comments
-- **AI Placeholders**: "TODO: Implement", "Add your code here", etc.
-- **Perfect JSDoc**: Suspiciously complete documentation (may indicate copy-paste)
-- **Overly Long Names**: Variable/function names longer than 30 characters
-- **AI Service Mentions**: Accidental inclusion of "ChatGPT", "Claude", "GPT-4", etc.
-
-**Why it matters**: AI-generated code should be reviewed for quality, correctness, and project fit. This is about **quality assurance**, not banning AI tools.
-
-### 3. 🔄 Code Duplication
-
-Uses `jscpd` to find copy-pasted code blocks:
-
-- **Threshold**: 5% duplication
-- **Minimum**: 10 lines or 50 tokens to be considered duplicate
-- **Excludes**: Tests, build artifacts, node_modules
-
-**Why it matters**: Duplicated code is harder to maintain. Bugs need to be fixed in multiple places, and refactoring becomes difficult.
-
-### 4. 🔒 Security & Ethics
-
-Scans for security vulnerabilities and unsafe patterns:
-
-- **🚨 CRITICAL: Hardcoded Secrets (Automated Security Check)**
-  - Detects patterns like `password = "..."`, `api_key = "..."`, `secret = "..."`, `token = "..."`
-  - **Action Required**: Remove any detected secrets immediately and rotate any exposed credentials
-  - Use environment variables or GitHub Secrets instead
-  - Creates a DRAFT security advisory (private until fixed)
-
-- **⚠️ eval() Usage**
-  - Allows arbitrary code execution (security risk)
-  - Consider safer alternatives like JSON parsing
-
-- **⚠️ Unsafe HTML Injection**
-  - `dangerouslySetInnerHTML` and `innerHTML` without sanitization
-  - Can lead to XSS (Cross-Site Scripting) attacks
-  - Always sanitize user input before rendering HTML
-
-- **⚠️ Disabled Security Checks**
-  - `eslint-disable security` or similar comments
-  - May hide real security issues
-
-- **ℹ️ Excessive Console Logs**
-  - Not a security issue, but suggests debugging code left in production
-
-## How It Works
-
-### Workflow Triggers
-
-The workflow runs automatically on:
-- **Pull Requests**: opened, synchronized, or reopened
-- **Pushes**: to `main` or `develop` branches
-
-### Process
-
-1. **Checkout code** and install dependencies
-2. **Run checks** in parallel for speed
-3. **Generate report** with findings
-4. **Post comment** on PR with detailed results
-5. **Upload artifacts** with full reports (retained for 30 days)
-6. **Fail workflow** if critical issues found (deprecated patterns or security violations)
-
-### Output
-
-The workflow produces:
-- **PR Comment**: Detailed report with all findings
-- **Workflow Summary**: Quick overview in GitHub Actions
-- **Artifacts**: Full jscpd reports for download
-
-## Understanding the Report
-
-### ✅ All Checks Passed
-
-```
-## 🔍 Code Quality Analysis Report
-
-### ✅ All Checks Passed!
-
-No code quality issues detected. Great work! 🎉
-
-- ✅ No deprecated React patterns
-- ✅ No obvious AI-generated code markers
-- ✅ No significant code duplication
-- ✅ No security or ethical violations
-```
-
-Your code is clean! No action needed.
-
-### ⚠️ Issues Detected
-
-```
-## 🔍 Code Quality Analysis Report
-
-### Issues Detected
-
-## ❌ Deprecated React Patterns
-
-### Deprecated Lifecycle Methods Found:
-```
-src/components/Example.jsx:15: componentWillMount() {
-src/components/Another.jsx:22: componentWillReceiveProps(nextProps) {
-```
-
-**Recommendation:** Migrate to modern React patterns (hooks, function components)
-```
-
-Each section includes:
-- **Files and line numbers** where issues were found
-- **Specific code snippets** showing the problem
-- **Recommendations** for fixing the issues
-
-## Fixing Issues
-
-### Deprecated React Patterns
-
-**Before:**
-```jsx
-class MyComponent extends React.Component {
-    componentWillMount() {
-        this.loadData();
-    }
-}
-```
-
-**After (using hooks):**
-```jsx
-function MyComponent() {
-    useEffect(() => {
-        loadData();
-    }, []); // Empty array = run once on mount
-}
-```
-
-### Hardcoded Secrets
-
-**Before:**
-```js
-const apiKey = process.env.API_KEY || "YOUR_API_KEY_HERE";
-fetch(`https://api.example.com?key=${apiKey}`);
-```
-
-**After:**
-```js
-const apiKey = process.env.API_KEY;  // Set in .env file
-fetch(`https://api.example.com?key=${apiKey}`);
-```
-
-**Important**: If real secrets were committed, you must:
-1. Remove them from the code
-2. **Rotate/invalidate** the exposed credentials immediately
-3. Add them to `.gitignore` or use GitHub Secrets
-
-### Code Duplication
-
-**Before:**
-```js
-// In FileA.js
-function validateEmail(email) {
-    const regex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-    return regex.test(email);
-}
-
-// In FileB.js (duplicate!)
-function validateEmail(email) {
-    const regex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-    return regex.test(email);
-}
-```
-
-**After:**
-```js
-// In utils/validation.js
-export function validateEmail(email) {
-    const regex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-    return regex.test(email);
-}
-
-// In FileA.js and FileB.js
-import { validateEmail } from './utils/validation';
-```
-
-## Configuration
-
-### Customizing Thresholds
-
-Edit `.jscpd.json` to adjust duplicate detection:
-
-```json
-{
-  "threshold": 5,       // Fail if >5% duplication
-  "minLines": 10,       // Minimum 10 lines to count as duplicate
-  "minTokens": 50,      // Minimum 50 tokens to count as duplicate
-  "ignore": [
-    "**/*.min.js",
-    "**/node_modules/**",
-    "**/build/**"
-  ]
-}
-```
-
-### Disabling Checks (Not Recommended)
-
-If you need to temporarily disable a check:
-
-```yaml
-# In .github/workflows/code-quality-check.yml
-- name: Check for deprecated React functions
-  if: false  # Disables this step
-```
-
-**Warning**: Only disable checks if you have a very good reason. Security checks should never be disabled.
-
-## FAQ
-
-### Q: Will this block my PR from merging?
-
-**A**: It depends on what was found:
-- **Security violations** (hardcoded secrets, use of `eval`, etc.) will **block** your PR until fixed.
-- **Deprecated React patterns** may **warn or block** depending on configuration. The workflow currently fails on these patterns, but since there are 11 known legacy usages inherited from upstream Scratch/TurboWarp, the workflow only scans changed files in PRs to avoid blocking existing code.
-
-Non-critical issues (AI markers, some duplicates) will warn but won't block.
-
-### Q: What if I'm using AI tools like GitHub Copilot?
-
-**A**: That's fine! The workflow detects **patterns**, not whether AI was used. It's checking:
-- Code quality (verbose comments, placeholder text)
-- Correctness (did you review what was generated?)
-
-Review AI suggestions before committing, and you'll be fine.
-
-### Q: My code uses `dangerouslySetInnerHTML` safely. How do I handle this?
-
-**A**: Add a comment explaining why it's safe:
-
-```jsx
-// SAFETY: Content is sanitized via DOMPurify in sanitizeHtml() above
-<div dangerouslySetInnerHTML={{__html: sanitizedContent}} />
-```
-
-The workflow will still flag it, but reviewers will understand the context.
-
-### Q: What about test files?
-
-**A**: The workflow excludes the `test/` directory from duplicate detection. However, deprecated patterns and security issues are still checked in tests.
-
-### Q: Can I run this locally?
-
-**A**: Yes! Install jscpd globally:
-
-```bash
-npm install -g jscpd
-```
-
-Then run individual checks:
-
-```bash
-# Check for duplicates
-jscpd src/
-
-# Check for deprecated React patterns
-grep -r "componentWillMount\|componentWillReceiveProps" --include="*.js" --include="*.jsx" src/
-
-# Check for hardcoded secrets
-grep -r "password\s*=\s*['\"].\+['\"]\|api_key\s*=\s*['\"].\+['\"]" --include="*.js" src/
-```
-
-## Best Practices
-
-1. **Review Before Committing**: Read through code before pushing, especially AI-generated code
-2. **Use Modern React**: Prefer hooks and function components over class components
-3. **DRY Principle**: Don't Repeat Yourself - refactor duplicated code
-4. **Never Commit Secrets**: Use environment variables and `.env` files (add to `.gitignore`)
-5. **Sanitize User Input**: Always sanitize before using `dangerouslySetInnerHTML`
-6. **Keep Dependencies Updated**: Old dependencies may have deprecated patterns
-
-## Troubleshooting
-
-### False Positives
-
-If you get flagged incorrectly:
-
-1. **Check the context**: Is it really a false positive?
-2. **Add a comment**: Explain why the pattern is necessary
-3. **File an issue**: If it's a workflow bug, let maintainers know
-
-### Workflow Fails to Run
-
-Check:
-- Is the workflow file in `.github/workflows/`?
-- Does the file have correct YAML syntax?
-- Are there sufficient permissions in the workflow?
-
-### "No such file or directory" Errors
-
-The workflow expects:
-- Source code in `src/` directory
-- Node.js project with `package.json`
-- NPM dependencies installable via `npm ci`
-
-## Contributing
-
-Found a pattern we should check for? Open an issue or PR!
-
-Suggested additions:
-- More deprecated patterns
-- Better AI detection heuristics
-- Additional security checks
-- Language-specific checks (TypeScript, etc.)
-
----
-
-**Last Updated**: January 2025  
-**Maintainer**: OmniBlocks Team  
-**Feedback**: Open an issue on GitHub