Claude/review repository cd8g2

[Spenny24]

Summary by cubic

Repo overhaul to a production-ready Operating Model audit platform with new workflows, strong docs, and automated CI/CD. Improves performance and cost, hardens security, and removes exposed secrets.

• New Features

  • Added V4 optimized audit workflow (~70s runtime, ~40% cheaper).
  • Added Premium report workflow (6k–8k words with rich tables) and Google Sheets-only editions.
  • Organized workflows/ with a catalog; added comprehensive docs in docs/ and updated README, CHANGELOG, LICENSE.
  • Added utility scripts (Data Cleaner v3, environment guard fix, prompt updater).
  • Introduced CI/CD to validate workflows, lint docs, and summarize runs; enabled Dependabot.

• Security

  • Removed tracked .env files; added .env.example templates and expanded .gitignore.
  • Added SECURITY.md and CI secret scanning; blocked hardcoded credentials and removed a workflow with an exposed key.
  • Fixed environment guard to use $env only.
  • CI now validates Docker Compose and workflow JSON to prevent misconfigurations.
  • Corrected Traefik rule for subfolder + TLS routing.

^{Written for commit db65aa0. Summary will update on new commits.}

[cubic-dev-ai]

7 issues found across 37 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="scripts/update_premium_prompts.py">

<violation number="1" location="scripts/update_premium_prompts.py:388">
P1: Leading '=' forces n8n expression mode, making the prompt an invalid expression and breaking rendering</violation>
</file>

<file name="docs/GOOGLE_SHEETS_SETUP_GUIDE.md">

<violation number="1" location="docs/GOOGLE_SHEETS_SETUP_GUIDE.md:26">
P2: Setup misses renaming the tab—only the spreadsheet title is set, so the workflow may not find the expected sheet name</violation>
</file>

<file name="README.md">

<violation number="1" location="README.md:3">
P2: CI badge points to missing workflow file `actions/workflows/blank.yml`, resulting in a broken/misleading status badge.</violation>
</file>

<file name="docs/SESSION_SUMMARY.md">

<violation number="1" location="docs/SESSION_SUMMARY.md:282">
P2: Documentation contradicts itself: claims all sources must be in one Google Sheets document, but provides multiple different sheet document IDs.</violation>

<violation number="2" location="docs/SESSION_SUMMARY.md:292">
P2: Runbook points to the wrong path: recommended command cats a root-level SESSION_SUMMARY.md that doesn't exist, instead of docs/SESSION_SUMMARY.md.</violation>
</file>

<file name="docs/COST_ANALYSIS.md">

<violation number="1" location="docs/COST_ANALYSIS.md:11">
P2: GPT-4o-mini per-run costs are miscalculated and understated versus the stated pricing, leading to an incorrect total cost per audit.</violation>
</file>

<file name="scripts/DATA_CLEANER_V3_CODE.js">

<violation number="1" location="scripts/DATA_CLEANER_V3_CODE.js:14">
P1: items[0].json dereferenced without empty-input guard; crashes when no items are passed</violation>
</file>

---

Since this is your first cubic review, here's how it works:

• cubic automatically reviews your code and comments on bugs and improvements
• Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
• Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Leading '=' forces n8n expression mode, making the prompt an invalid expression and breaking rendering

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/update_premium_prompts.py, line 388:

<comment>Leading '=' forces n8n expression mode, making the prompt an invalid expression and breaking rendering</comment>

<file context>
@@ -0,0 +1,397 @@
+            # Find the content message
+            for msg in node['parameters']['messages']['values']:
+                if 'content' in msg and not msg.get('role'):
+                    msg['content'] = '=' + PROMPTS[node_name]
+                    updates_made += 1
+                    print(f"✅ Updated prompt: {node_name}")
</file context>

[cubic-dev-ai]

P1: items[0].json dereferenced without empty-input guard; crashes when no items are passed

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At scripts/DATA_CLEANER_V3_CODE.js, line 14:

<comment>items[0].json dereferenced without empty-input guard; crashes when no items are passed</comment>

<file context>
@@ -0,0 +1,208 @@
+console.log(`${'='.repeat(60)}\n`);
+
+const currentModelData = {
+  client_name: items[0].json.client_name,
+  audit_id: items[0].json.audit_id,
+  audit_timestamp: items[0].json.audit_timestamp || new Date().toISOString(),
</file context>

Suggested change

	client_name: items[0].json.client_name,
	audit_id: items[0].json.audit_id,
	audit_timestamp: items[0].json.audit_timestamp || new Date().toISOString(),
	client_name: items[0]?.json?.client_name,
	audit_id: items[0]?.json?.audit_id,
	audit_timestamp: (items[0]?.json?.audit_timestamp) || new Date().toISOString(),

[cubic-dev-ai]

P2: Setup misses renaming the tab—only the spreadsheet title is set, so the workflow may not find the expected sheet name

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/GOOGLE_SHEETS_SETUP_GUIDE.md, line 26:

<comment>Setup misses renaming the tab—only the spreadsheet title is set, so the workflow may not find the expected sheet name</comment>

<file context>
@@ -0,0 +1,252 @@
+#### **Create the sheet:**
+1. Go to [Google Sheets](https://sheets.google.com)
+2. Create a new spreadsheet
+3. Name it: **"Tools_Inventory"**
+4. Copy this sheet ID from the URL (you'll need it later)
+
</file context>

[cubic-dev-ai]

P2: CI badge points to missing workflow file actions/workflows/blank.yml, resulting in a broken/misleading status badge.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At README.md, line 3:

<comment>CI badge points to missing workflow file `actions/workflows/blank.yml`, resulting in a broken/misleading status badge.</comment>

<file context>
@@ -1 +1,370 @@
-# n8n-hosting
+# n8n AI Operating Model Audit Platform
+
+[![CI](https://github.com/Spenny24/n8n-hosting/actions/workflows/blank.yml/badge.svg)](https://github.com/Spenny24/n8n-hosting/actions/workflows/blank.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+
</file context>

[cubic-dev-ai]

P2: Documentation contradicts itself: claims all sources must be in one Google Sheets document, but provides multiple different sheet document IDs.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/SESSION_SUMMARY.md, line 282:

<comment>Documentation contradicts itself: claims all sources must be in one Google Sheets document, but provides multiple different sheet document IDs.</comment>

<file context>
@@ -0,0 +1,295 @@
+
+3. **Premium vs Standard:** User should use `workflow_premium_google_sheets.json` for client deliverables ($0.99/audit, consultant-grade) and standard for internal testing ($0.006/audit).
+
+4. **Google Sheets Required:** All data sources must be in the same Google Sheets document with specific sheet names.
+
+5. **Cost Calculation:** Premium report costs ~$0.99 per audit vs $15K-$50K consulting value = 0.002%-0.007% of value delivered.
</file context>

Suggested change

	4. **Google Sheets Required:** All data sources must be in the same Google Sheets document with specific sheet names.
	4. **Google Sheets Required:** Ensure each sheet ID in "Set Client Config" points to the correct document; sheets may reside in different Google Sheets documents as listed below.

[cubic-dev-ai]

P2: Runbook points to the wrong path: recommended command cats a root-level SESSION_SUMMARY.md that doesn't exist, instead of docs/SESSION_SUMMARY.md.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/SESSION_SUMMARY.md, line 292:

<comment>Runbook points to the wrong path: recommended command cats a root-level SESSION_SUMMARY.md that doesn't exist, instead of docs/SESSION_SUMMARY.md.</comment>

<file context>
@@ -0,0 +1,295 @@
+
+**Recommended First Command in Terminal Claude Code:**
+```bash
+cat /home/user/n8n-hosting/SESSION_SUMMARY.md
+```
+
</file context>

Suggested change

	cat /home/user/n8n-hosting/SESSION_SUMMARY.md
	cat /home/user/n8n-hosting/docs/SESSION_SUMMARY.md

[cubic-dev-ai]

P2: GPT-4o-mini per-run costs are miscalculated and understated versus the stated pricing, leading to an incorrect total cost per audit.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At docs/COST_ANALYSIS.md, line 11:

<comment>GPT-4o-mini per-run costs are miscalculated and understated versus the stated pricing, leading to an incorrect total cost per audit.</comment>

<file context>
@@ -0,0 +1,214 @@
+
+| Node | Purpose | Est. Input Tokens | Est. Output Tokens | Cost per Run |
+|------|---------|------------------|-------------------|--------------|
+| 2.2 Inefficiency Scorer | Analyze inefficiencies | 1,500 | 2,000 | $0.0011 |
+| 2.3 AI Fit Mapper | Identify AI use cases | 1,800 | 2,500 | $0.0013 |
+| 3.1 Blueprint Generator | Design target model | 2,200 | 4,000 | $0.0019 |
</file context>