Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CHANGELOG.md`:
- Line 7: Insert a blank line before the "### Added" heading in CHANGELOG.md so
the heading is separated by an empty line from the preceding content; update the
file to ensure the "### Added" line is surrounded by blank lines to follow
Markdown best practices.

In `@go.mod`:
- Line 27: The go.mod currently contains a local replace directive "replace
github.com/GoHyperrr/mdk => ../mdk" which forces builds to depend on a relative
path; remove this line from go.mod and either add the local replacement to a
go.work file or document using a local go.work for dev only so CI and other devs
use the canonical module; update references to the replace directive (the
"replace github.com/GoHyperrr/mdk => ../mdk" entry) and ensure go.mod is
committed without the local replace before merging.

In `@product/graphql.go`:
- Around line 40-48: The current conversion in product/graphql.go uses
json.Marshal followed by json.Unmarshal (variables inputBytes and workflowInput)
to turn the typed input into map[string]any; replace this inefficient round-trip
with a direct struct->map conversion (e.g., use a dedicated library such as
github.com/mitchellh/mapstructure or a small reflection helper) so you eliminate
the encode/decode overhead—locate the block that calls json.Marshal(input) and
json.Unmarshal(..., &workflowInput) and replace it with a direct conversion that
produces the same map[string]any for the workflow context.

In `@product/handlers.go`:
- Around line 128-138: The struct literal for p currently sets Description: ""
and then later mutates p.Description when in.Description != nil; instead set
Description directly in the literal (use a conditional/dereference of
in.Description or omit the field to rely on the zero value) so you can remove
the separate if block; update the struct literal where p is created (and remove
the subsequent if in.Description != nil { p.Description = *in.Description }).
- Around line 42-49: Add enum validation for Type and Status inside the existing
variants loop (the code iterating over in.Variants and checking v.Title and
v.Price). Ensure v.Type is one of ["PHYSICAL","DIGITAL","SERVICE"] and v.Status
is one of ["DRAFT","PUBLISHED","ARCHIVED"]; if not, return a descriptive error
via fmt.Errorf (e.g., "invalid variant type: %q" or "invalid variant status:
%q"). Place these checks alongside the existing v.Title and v.Price validations
so invalid Type/Status values are rejected before persistence.

In `@product/model.go`:
- Around line 104-124: The ProductVariant struct uses float64 for Price and
CompareAtPrice which risks monetary precision issues; change Price to int64
(cents) and CompareAtPrice to *int64, update the JSON tags to reflect cents
semantics (or implement custom marshal/unmarshal if you want JSON in dollars),
and update any code interacting with ProductVariant.Price/CompareAtPrice
(creation, updates, calculations, and DB queries) to convert between dollars and
cents; locate these fields on the ProductVariant type and adjust related
functions (e.g., BeforeCreate usage, any validators, services, or DB callers) to
use integer cents for safe arithmetic.
- Around line 19-28: The StringList.Value method currently returns the JSON
string "[]" for a nil receiver, losing the nil vs empty distinction; if you want
nil to map to SQL NULL, change StringList.Value (the method on type StringList)
to return (nil, nil) when sl == nil, and ensure the complementary
StringList.Scan implementation correctly handles sql NULLs (e.g., treats nil
source as nil slice) so the database can represent "no value" vs "explicitly
empty".

In `@product/product_test.go`:
- Around line 22-23: Replace the unchecked type assertion on rt.Workflows() with
the two-value form and fail the test with a clear message if the assertion
fails: get the value via runner, ok :=
rt.Workflows().(*mdktest.TestWorkflowEngine) and if !ok call t.Fatalf or
require.Failf with the actual type (e.g., using %T) so the test reports a clear
error instead of panicking; update the variable name runner and any downstream
usage accordingly.

In `@product/product.graphqls`:
- Around line 146-156: UpdateProductInput currently omits nested resources
(variants, options, images) so updateProduct cannot modify them; add explicit
nested update input fields (e.g., variants: [UpdateProductVariantInput],
options: [UpdateProductOptionInput], images: [UpdateProductImageInput]) to
UpdateProductInput or add separate mutations (e.g., updateProductVariant,
updateProductOption, replaceProductImages) and corresponding input types; ensure
the new input types mirror createProduct's nested inputs and include identifiers
for existing nested entities (ids) plus mutate operations (patch, replace, add,
remove) so Product consumers can adjust pricing/options/media after creation.
- Around line 25-27: The schema declares options, variants, images as non-null
lists but PersistProduct in product/handlers.go leaves Product.Options,
Product.Variants, Product.Images and ProductVariant.Options nil when omitted;
either (A) ensure PersistProduct (and any other product-returning functions)
always initializes those fields to empty slices (e.g., set Product.Options =
[]ProductOption{} etc., and ProductVariant.Options = []VariantOption{} before
returning) so resolvers never return nil, or (B) relax the GraphQL schema by
changing those fields from [Type!]! to [Type!] or [Type] as appropriate (also
adjust the field at the other location noted around line 64) so null/nil slices
are allowed. Ensure whichever approach you pick is applied consistently across
PersistProduct and any code paths that construct Product and ProductVariant
objects.

In `@product/repository.go`:
- Around line 54-64: The List method on Repository currently loads all Product
rows (Repository.List) which can OOM for large catalogs; change its signature to
accept pagination parameters (e.g., limit and offset or a cursor token) and
apply GORM's Limit/Offset (or cursor WHERE + Order) before Find, keep the same
Preload calls (Options, Variants, Variants.Options, Images), validate/clip the
limit to a sane max, and update any callers of Repository.List to pass the new
pagination arguments (or provide a wrapper that defaults to safe page sizes).

In `@search/search_test.go`:
- Around line 29-30: The unguarded type assertion on rt.Workflows() to
*mdktest.TestWorkflowEngine may panic; change it to the two-value form (e.g. w,
ok := rt.Workflows().(*mdktest.TestWorkflowEngine)) and if ok is false call the
test failure helper (t.Fatalf or t.Fatalf-like) with a clear message including
the actual type (use %T) so the test fails with a readable error instead of
panicking.

In `@taxonomy/repository.go`:
- Around line 119-121: In GetTermsForResource, when no relations are found
currently it returns nil, nil; change this to return an empty slice (e.g.,
[]TaxonomyTerm{}) and nil error to avoid nil/empty ambiguity downstream—update
the branch that checks len(relations) == 0 to return an empty TaxonomyTerm slice
instead of nil, preserving the function signature and behavior elsewhere.
- Around line 71-87: GetTermTree currently appends term values (append(roots,
*t)) so later updates to nodes in termMap (like adding children) don't propagate
into previously-copied ancestors; fix by building the tree using pointer links
from the termMap so mutations propagate deterministically: create termMap as
map[string]*Term, populate it with pointers to the original slice items, link
children by appending pointers (parent.Children = append(parent.Children,
child)) or by setting Children to slices of pointers, and finally collect roots
by referencing the map entries (roots = append(roots, *termMap[id]) or return
[]*Term) so all child additions are visible on ancestors; update
functions/variables GetTermTree, termMap, roots, and the loop that processes
ParentID/Children accordingly.

---

Outside diff comments:
In `@cart/module.go`:
- Around line 28-67: The workflow and handler registration calls currently
ignore returned errors (rt.Workflows().Register and
rt.Workflows().RegisterHandler), which can leave the cart module partially
registered; update the init/registration code to check each error from Register
for workflows "cart.add", "cart.remove", "cart.checkout" and from
RegisterHandler for "cart.add_item" (m.AddItemStep), "cart.remove_item"
(m.RemoveItemStep) and "cart.checkout" (m.CheckoutStep) and fail fast—propagate
or return the error (or log and panic) so initialization aborts on any
registration failure instead of discarding the error.

In `@product/handlers.go`:
- Around line 218-222: The code reads productID from workflowInput via
productID, _ := workflowInput["id"].(string) and calls m.repo.GetByID(ctx,
productID) without validating it; update the handler to check the type assertion
result and that productID is not an empty string (e.g., ensure the "ok" from
workflowInput["id"].(string) is true and productID != "") and return a clear
error (e.g., "missing product id" or validation error) before calling
m.repo.GetByID so you don't query the repo with an empty ID.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.coderabbit.yaml:
- Line 3: The schema URL in .coderabbit.yaml currently points to
https://coderabbit.ai/integrations/schema.v2.json (which is valid for
validation) but the human-facing docs link referenced in your config points to a
404 at https://docs.coderabbit.ai/spec/configuration; update that documentation
URL to the correct, reachable docs page (or remove the dead docs reference) so
users can follow the spec; check any occurrences of reviews.tone_instructions in
the file remain valid per the schema after updating the URL.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 15-22: Update both checkout steps to pin the actions/checkout
action to a specific commit SHA instead of the floating `@v4` tag and disable
credential persistence by setting persist-credentials: false; specifically
modify the first "uses: actions/checkout@v4" and the second "uses:
actions/checkout@v4" (the step that includes repository/ref/path) to use a fixed
commit SHA (e.g., the provided 11bd71901bbe5b1630ceea73d27597364c9af683 after
you verify it) and add persist-credentials: false under their step inputs so the
GitHub token is not left available to later steps or artifacts.
- Around line 17-22: The "Checkout mdk" step currently checks out the branch tip
and uses actions/checkout@v4 without hard pinning or disabling credentials;
update that step to check out the go.mod-pinned commit SHA
(3d2ab0d97ca9a28fd984dc4a29f6bb611cb62661) by setting the ref to that exact
commit, pin the actions/checkout action to a fixed commit SHA (replace
actions/checkout@v4 with the action's repository@<commit-sha>) and add
persist-credentials: false under the with: block for the "Checkout mdk" step
(the step named "Checkout mdk" and its uses: actions/checkout and with:
repository/ref/path settings).

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 23-24: The "Move mdk to parent directory" step uses "mv mdk
../mdk" with no guards; update that step to first check that the source "mdk"
exists and fail with a clear message if not, remove or rename the destination
"../mdk" if it already exists (e.g., rm -rf ../mdk) before performing the move,
perform the move ("mv mdk ../mdk") and then verify success (check that ../mdk
now exists) and fail with an explicit error message if the move failed;
reference the step name "Move mdk to parent directory" and the command "mv mdk
../mdk" when making the changes.

---

Duplicate comments:
In @.github/workflows/ci.yml:
- Around line 15-16: The workflow uses an unpinned checkout action and leaves
persist-credentials at its default; update the checkout step that currently uses
actions/checkout@v4 to reference a specific commit SHA for that action (pin to
the exact git sha) and explicitly set persist-credentials: false in the same
step to avoid leaking GITHUB_TOKEN to subsequent steps (locate the step using
the identifier actions/checkout@v4 and modify its configuration to include the
commit SHA and persist-credentials: false).
- Around line 17-22: The checkout step is insecure and uses the branch tip
instead of the go.mod‑pinned commit; update the checkout step (the "Checkout
mdk" step that uses actions/checkout) to: pin the actions/checkout action to its
full commit SHA instead of `@v4`, set with.ref to the exact commit SHA
"3d2ab0d97ca9a28fd984dc4a29f6bb611cb62661" (so CI tests the pinned mdk
revision), and add with.persist-credentials: false to avoid leaking repo
credentials; keep the existing repository and path fields unchanged.