CodeVetter · Repo Unpack · Risk map
krahets/hello-algo
The dominant risks are duplication and drift: the same sample logic exists in up to five copies (codes/ + four locale trees) and again inline in the markdown tabs, with only human discipline and PR checklists keeping them consistent. CI has real holes (no zig workflow, no coverage of zh-hant/ja/ru code paths, compile-only checks for several languages). Secondary risks: a subprocess-based runner that executes contributor code, several apparently dead assets (starfield.js, pythontutor-iframe CSS, missing checkin.html), vendored third-party headers, stale GitHub Actions versions/runners, and heavy reliance on external services (giscus, pythontutor.com, CDNs).
- Code/text drift hazard: docs pages embed hand-copied code inside === 'Lang' tabs that duplicate codes/ files (array.md vs array.py); nothing mechanically verifies the inline snippets match the runnable files.
- Five-way duplication across locales: en/codes, zh-hant/codes, ja/codes, ru/codes are full copies of codes/ with translated comments; every fix to a sample must be replicated, and only codes/ + en/codes/ are CI-covered so zh-hant/ja/ru copies can silently break.
- test_all.py executes every contributed .py file via subprocess with the CI runner's full environment — adequate on ephemeral GitHub runners, but any agent running it locally executes all contributor code unsandboxed; it also assumes 'python' resolves on PATH.
- overrides/javascripts/starfield.js (~460 lines, UMD Starfield module) is not referenced by mkdocs.yml extra_javascript and docs/index.html contains no script tag for it — the .starfield div in the landing page renders an empty canvas, making this likely dead/unwired code. (inferred)
- extra.css defines .pythontutor-iframe scaling styles and comments.html includes 'partials/checkin.html' with 'ignore missing' (no such file exists in overrides/partials/) — residual hooks for features that are absent or external. (inferred)
- codes/c/utils/uthash.h is a vendored third-party single-header library shipped in-repo — an unversioned external dependency embedded in the source tree.
- Stale CI infrastructure: java.yml pins runs-on ubuntu-20.04 (a retired GitHub runner image) and uses actions/setup-java@v3; go.yml uses actions/setup-go@v3; rust.yml builds on nightly — all fragile against upstream changes.
- Single Docker build compiles all five locales serially at image-build time (five mkdocs build RUN steps); any locale's docs error fails the entire image and there is no incremental/caching strategy — and no workflow builds this Dockerfile, so site breakages are only caught on manual/deploy builds.
- Runtime third-party dependencies: giscus.app client script, cdnjs MathJax bundle, pythontutor.com render URLs, contrib.rocks images — a service outage or URL-format change degrades comments, math, visualizations, and the landing page with no fallback.
- python -m http.server is the production server inside the Docker image — a development-grade server (no TLS, caching, or compression), acceptable for static files but a scaling/security ceiling for hello-algo.com if used as-is. (inferred)
- Manual registries are easy to forget: a new Rust sample fails cargo build unless a [[bin]] is added to Cargo.toml, and a new C/C++ file needs add_executable in the chapter CMakeLists — CI will catch it, but only after push.
- License is CC BY-NC-SA 4.0 for all content including code — non-commercial share-alike; downstream reuse of the sample code is more restrictive than typical OSS licenses and worth flagging before repurposing.