AI & CI/CD Security Skills
Relevant source files
The following files were used as context for generating this wiki page:
DJ-Assistant implements a specialized Skills System to manage automated processing units for music library analysis and continuous integration security. These skills function as scoped, reversible units backed by database snapshots to ensure non-destructive operations and local-first privacy. The system combines local AI inference via ONNX Runtime with a rigorous CI/CD pipeline that enforces security audits and dependency validation.
Sources: README.md:124-135, apps/desktop/src-tauri/migrations/001_initial_schema.sql:56-66
AI Analysis Skills Architecture
The AI analysis pipeline executes local ONNX models to extract musical features. The system processes tracks through a background queue to maintain UI responsiveness.
Core Components
- ONNX Runtime: Executes models for BPM detection, key estimation, and phrase segmentation entirely on the local machine.
- Symphonia: Decodes multiple audio formats (MP3, WAV, FLAC, AIFF) into PCM data for analysis.
- Analysis Queue: Drains a list of track IDs on a background thread and persists results to SQLite.
Sources: README.md:162-170, apps/desktop/src-tauri/src/analysis.rs:18-30, CHANGELOG.md:118-125
The diagram above illustrates the data flow from raw audio decoding to the final persistence of AI-derived metadata.
Sources: apps/desktop/src-tauri/src/analysis.rs:88-140
Status Classification Logic
The system automatically classifies the analysis_status of a track based on the confidence scores returned by the AI models.
| Status | Condition |
|---|---|
| complete | All AI signals (BPM, Key, Phrases) are present with high confidence. |
| needs_review | Any primary signal is missing or falls below confidence thresholds. |
| failed | The analyzer encountered a hard error during processing. |
| pending | The track is imported but not yet processed by the AI pipeline. |
Sources: apps/desktop/src-tauri/src/analysis.rs:158-185, apps/desktop/src-tauri/migrations/001_initial_schema.sql:35
CI/CD Security Pipeline
The project employs a multi-layered security strategy within its GitHub Actions workflows to prevent the introduction of vulnerabilities.
Automated Security Audits
The nightly-audit.yml workflow performs weekly security checks on both Rust and JavaScript dependencies:
- Rust Security: Uses
cargo auditto check the workspaceCargo.lockfor known vulnerabilities in the RustSec advisory database. - JavaScript Security: Executes
pnpm audit --prod --audit-level=highto gate the build on high-priority security advisories. - Action Security: Regularly updates GitHub Actions to use Node 24 runtimes to avoid deprecated environments.
Sources: CHANGELOG.md:243-255, CHANGELOG.md:214-220
This sequence diagram shows the automated dependency verification process used to gate project releases.
Sources: CHANGELOG.md:243-255
Skill Run Management and Provenance
Every automated AI action is tracked in the skill_runs table. This provides a transparent audit trail (provenance) for AI-generated decisions, such as cue point placement.
Data Model for Skill Runs
The skill_runs table stores snapshots of track states before and after a skill executes.
| Field | Type | Description |
|---|---|---|
skill_name | TEXT | The identifier for the skill (e.g., cue-placement). |
status | TEXT | Tracks execution state: started, success, failed, or undone. |
before_state | TEXT | JSON snapshot of relevant metadata before modification. |
after_state | TEXT | JSON snapshot after the skill completed. |
error | TEXT | Details of failure if the status is failed. |
Sources: apps/desktop/src-tauri/migrations/001_initial_schema.sql:56-66, README.md:124-130
Reversibility Logic
Because skills store before_state and after_state, the system supports a Preview → Apply → Undo workflow.
- Preview: The skill calculates changes without committing.
- Apply: The system updates the
tracksorcue_pointstables and records the run. - Undo: The system restores the
before_statefrom theskill_runsrecord and marks the status asundone.
Sources: README.md:124-130, apps/desktop/src/App.tsx:392-412
Metadata and Fingerprinting Security
The system uses BLAKE3 hashing to create stable, unique fingerprints for audio files. This prevents duplicate processing and ensures that metadata is correctly mapped even if files are moved.
Hashing and Deduplication
- BLAKE3 Fingerprint: The system computes a hash of the file content (first 1MB + duration) to identify tracks.
- Unique Constraints: SQLite enforces a
UNIQUE(workspace_id, file_hash)constraint to prevent redundant entries within the same library. - Privacy: Hashes are computed locally; raw audio never leaves the machine.
Sources: README.md:162-166, apps/desktop/src-tauri/migrations/001_initial_schema.sql:43, crates/core/src/metadata.rs:356-370
Security Citations
The following code snippet demonstrates the secure persistence of AI analysis results, ensuring the analysis_version is stamped to prevent stale data usage.
// apps/desktop/src-tauri/src/analysis.rs:40-76
pub fn persist_analysis_results(
conn: &Connection,
track_id: &str,
results: &AnalysisResults,
) -> rusqlite::Result<()> {
let status = classify_analysis_status(results);
let now = chrono::Utc::now().to_rfc3339();
conn.execute(
"UPDATE tracks SET
bpm = ?,
key_camelot = ?,
key_classical = ?,
analysis_status = ?,
analysis_version = ?,
updated_at = ?
WHERE id = ?",
rusqlite::params![
results.bpm.map(f64::from),
&results.key_camelot,
&results.key_classical,
status,
&results.analysis_version,
now,
track_id,
],
)?;
Ok(())
}
Sources: apps/desktop/src-tauri/src/analysis.rs:40-76
The AI & CI/CD Security Skills system provides a robust framework for automating DJ preparation while maintaining strict local privacy and build-time security. By integrating ONNX-based local inference with SQL-backed state management, the system ensures that all automated actions remain transparent, auditable, and reversible.