GH#3554: fix(speech-to-speech): elevate API key security note to blockquote#4397
Conversation
…H#3554) Improve visibility of OpenAI API key security guidance in the LLM section. The plain-text note added in PR #403 is now formatted as a blockquote with explicit 'never hardcode' warning, making it harder to miss. All 10 PR #403 review findings verified addressed: - transcribe command reference removed (commit fd2aa84) - PyTorch version corrected 2.10+ -> 2.4+ (commit e8e1448) - API key storage guidance added and now elevated to blockquote (this commit) Closes #3554
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request enhances the documentation for the speech-to-speech tool by improving the presentation and clarity of API key security instructions. It specifically addresses a review finding to make the guidance on storing Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
|
Important Review skippedAuto reviews are limited based on label configuration. 🚫 Review skipped — only excluded labels are configured. (1)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
🔍 Code Quality Report�[0;35m[MONITOR]�[0m Code Review Monitoring Report �[0;34m[INFO]�[0m Latest Quality Status: �[0;34m[INFO]�[0m Recent monitoring activity: 📈 Current Quality Metrics
Generated on: Fri Mar 13 07:48:29 UTC 2026 Generated by AI DevOps Framework Code Review Monitoring |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request effectively addresses previous review feedback by elevating the API key security note to a more prominent blockquote. This improves visibility and aligns with security guidance patterns in other documents. I've added one suggestion to further improve the readability of the new security note by structuring it as separate paragraphs, which will help key information stand out and reinforce critical security practices.
| > **Security:** When using `--llm open_api`, store `OPENAI_API_KEY` via | ||
| > `aidevops secret set OPENAI_API_KEY` (gopass encrypted, preferred) or in | ||
| > `~/.config/aidevops/credentials.sh` (600 permissions, plaintext fallback). | ||
| > Never hardcode API keys in scripts or config files. | ||
| > See `tools/credentials/api-key-setup.md` for setup. |
There was a problem hiding this comment.
For better readability of this important security note, consider separating the sentences into distinct paragraphs within the blockquote. This makes the key points, especially the warning against hardcoding keys, stand out more clearly, aligning with best practices for documenting critical security information.
| > **Security:** When using `--llm open_api`, store `OPENAI_API_KEY` via | |
| > `aidevops secret set OPENAI_API_KEY` (gopass encrypted, preferred) or in | |
| > `~/.config/aidevops/credentials.sh` (600 permissions, plaintext fallback). | |
| > Never hardcode API keys in scripts or config files. | |
| > See `tools/credentials/api-key-setup.md` for setup. | |
| > **Security:** When using `--llm open_api`, store `OPENAI_API_KEY` via | |
| > `aidevops secret set OPENAI_API_KEY` (gopass encrypted, preferred) or in | |
| > `~/.config/aidevops/credentials.sh` (600 permissions, plaintext fallback). | |
| > | |
| > Never hardcode API keys in scripts or config files. | |
| > | |
| > See `tools/credentials/api-key-setup.md` for setup. |
References
- When documenting security practices, explicitly emphasize the preference for secure tools (e.g., gopass) over less secure alternatives (e.g., plaintext files), even if the alternatives are permitted with restrictions. Improving readability of this section enhances the visibility of this preference.
- When documenting critical rules, include a warning about the consequences of violating the rule. Separating the warning about hardcoding API keys into its own paragraph makes this critical consequence more prominent.
There was a problem hiding this comment.
Applied in follow-up PR #4411. The suggestion is valid — separating the three key points (storage instructions, hardcoding warning, reference link) into distinct blockquote paragraphs improves readability of this critical security note. Since PR #4397 was already merged, the fix is delivered as a new PR on the same branch.
|
…tinct paragraphs (#4411) * chore(new-task): remove redundant env-var prefix in shell command examples The TASK_TITLE="$TASK_TITLE" prefix before the command was redundant — the variable is already in scope after the assignment. Simplify to pass "$TASK_TITLE" directly as the quoted argument, which is equally secure and clearer to read. Addresses Gemini inline suggestion on PR #4388. * fix(speech-to-speech): separate security blockquote into distinct paragraphs Address gemini-code-assist inline suggestion on PR #4397: add blank lines between the three parts of the security blockquote so each key point (storage instructions, hardcoding warning, reference link) stands out as a distinct paragraph for improved readability. Closes #3554
1 participant
Summary
Closes #3554
Addresses the 10 review findings from PR #403 on
.agents/tools/voice/speech-to-speech.md.Findings Status
All 10 findings from PR #403 review are now addressed:
transcribecommand reference (non-existent)2.10+→ should be2.4+--llm open_apitranscribecommand docs reference non-existent commandChange in This PR
The API key security note added in PR #403 was a plain inline sentence. This PR elevates it to a
> **Security:**blockquote, making it:Quality