auto subs - Moses Yebei

The Problem

Generating subtitles normally means uploading footage to a cloud service, waiting, and hoping the transcription is accurate. AutoSubs removes that dependency: it runs AI transcription models locally and can push results straight into a DaVinci Resolve timeline, so editors keep full control of their media and their privacy.

What This Does

AutoSubs is a Tauri desktop app (React + TypeScript frontend, Rust backend) that transcribes audio/video files locally using Whisper, Parakeet, or Moonshine models. It handles speaker diarization, translation to English, and exports to SRT or plain text. The DaVinci Resolve integration lives in AutoSubs-App/src-tauri/resources/AutoSubs.lua, which communicates with the app over IPC.

The transcription pipeline is in AutoSubs-App/src-tauri/crates/transcription-engine/src/, with separate modules for audio preprocessing (audio.rs), model selection (engines/), formatting (formatting.rs), and translation (translate.rs).

How It Is Wired

Execution starts in AutoSubs-App/src-tauri/src/main.rs, which calls into lib.rs where the Tauri command handlers live. The transcription_api.rs module is the bridge between the React frontend and the Rust engine. A transcription request flows: React calls a Tauri IPC command → transcription_api.rs → transcription-engine crate → model inference → results stream back to the UI via Tauri events.

The Rust backend talks to three external systems: FFmpeg (audio preprocessing), HuggingFace Hub (model downloads), and optionally DaVinci Resolve via the Lua script. The model_manager.rs file handles model caching and downloads, and is one of the most heavily branched files (142 branch points over 498 lines). The formatting.rs file (1,514 lines) is the largest single source file and handles line breaking, timing, and language-specific rules.

The React frontend is organized around contexts — GlobalProvider and TranscriptContext are the two most-connected modules, with GlobalProvider importing 6 modules and TranscriptContext sitting in the middle of the data flow. The UI components are split between dialogs, settings, subtitles, and processing panels.

How To Use It

git clone https://github.com/moses-y/auto-subs
cd auto-subs/AutoSubs-App
npm install
npm run tauri dev

Configuration is minimal: the app downloads models on first use from HuggingFace Hub. The tauri.conf.json in AutoSubs-App/src-tauri/ handles app-level config. For DaVinci Resolve integration, load AutoSubs.lua from the resources folder into Resolve's script editor.

Real-World Use

A video editor receives raw interview footage and needs captions before the end of the day. They drop the file into AutoSubs, pick Whisper for accuracy, enable diarization to separate speakers, and generate subtitles in minutes — all locally. They then push the subtitles directly into Resolve, where per-speaker styling (color, outline, border) is applied automatically via the Lua bridge.

Code Health & Issues

Static analysis found 46 issues (20 high, 26 medium) across 4 categories. The dominant problem is deep nesting (33 instances), with completion-step-item.tsx reaching indentation depth 9. Eight files exceed 1,000 lines, including formatting.rs (1,514 lines) and autosubs_core.lua. There are 110 duplicated 6-line blocks across 37 files, suggesting shared logic should be extracted.

The audit also flagged: unpinned GitHub Actions (using @v2 tags instead of commit SHAs), no test suite despite 142 source files, no Dependabot configuration, and npm install in CI instead of npm ci. The workflow also lacks persist-credentials: false and job timeouts.

The Bottom Line

A functional, genuinely useful desktop app for local subtitle generation with a solid architecture — Tauri + Rust + React is a sensible stack for this workload. The main risks are maintainability (large files, duplicated logic) and the absence of tests. For a solo editor or small post-production team, this is a practical tool; for a team planning to extend it, the codebase needs refactoring first.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

249 files

TSX96
Rust27
JSON15
TypeScript15
Lua6
Markdown4

ReactTailwind

Module dependencies

The 10 most depended-upon modules of 113, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_c_contexts_TranscriptContext["TranscriptContext"] n1_ubs_App_src_utils_file_utils["file-utils"] n2_AutoSubs_App_src_App["App"] n3_cessing_completion_step_item["completion-step-item"] n4_pp_src_components_ui_archive["archive"] n5_s_App_src_components_ui_plus["plus"] n6_p_src_contexts_ModelsContext["ModelsContext"] n7__src_contexts_PresetsContext["PresetsContext"] n8_src_contexts_ProgressContext["ProgressContext"] n9__src_contexts_ResolveContext["ResolveContext"] n0_c_contexts_TranscriptContext --> n1_ubs_App_src_utils_file_utils

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium4

low2

Pin third-party GitHub Actions to a commit SHAhigh

.github/workflows

softprops/action-gh-release@v2

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Add a test suite; this repository has nonehigh142 occurrences

142 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Enable Dependabot or Renovatemedium

3 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Install from the lockfile in CImedium

.github/workflows

npm install with a committed package-lock.json

A fresh resolution in CI means the tested dependency set is not the locked one, so the failure only appears after merge.

Fix: Use npm ci, yarn install --immutable, or pnpm install --frozen-lockfile.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/package.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow

.github/workflows/package.yml

1 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.