pointless - Moses Yebei

The Problem

Users need a lightweight, offline white‑board that can persist drawings locally without a server. Existing solutions are either web‑only, require cloud sync, or are heavyweight desktop apps that add unnecessary dependencies.

What This Does

pointless delivers a native desktop canvas built with Tauri (Rust) and React. The UI lives in src/ (e.g., src/components/Paper/index.js, src/helpers.js) while the native bridge lives in src‑tauri/ (src-tauri/src/main.rs). State is stored locally using Brotli‑Unicode compression (src/utils/paper-export.js). The app ships as a single binary per platform, avoiding runtime Node or Python installations.

How It Is Wired

Entry point – The UI bootstraps from public/index.html → src/index.js → React component src/components/App/index.js.
Core UI flow – src/components/Paper/index.js creates the SVG canvas, holds the main Redux store (src/store.js), and mounts lifecycle methods (componentDidMount, componentWillUnmount). It calls helpers in src/components/Paper/helpers.js (e.g., getSmoothPath, simplifyPoints).
State management – Redux slices in src/reducers/ (librarySlice.js, paperSlice.js, etc.) expose actions like loadFolderContents and exportPaper. These are invoked from UI components such as src/components/Library/components/FolderListItem/index.js and src/components/Paper/components/ExportButton/index.js.
Native bridge – Tauri commands defined in src-tauri/src/commands.rs are reachable via the JavaScript API (not shown in the static graph). The Rust side reads/writes the compressed files and provides the file module (src-tauri/src/file.rs).
High‑impact modules –
src/components/Paper/index.js (7 functions, 1 class, 1117 lines) is the most blast‑radius hub; any change ripples through the UI.
src/helpers.js (6 exported utilities, 23 branches) is heavily imported (6 callers).
src/components/Library/index.js and the Redux slice src/reducers/library/librarySlice.js also have multiple inbound/outbound edges.
Call graph highlights – Functions like formatDate, shiftShapePoints, and onClick are each called from exactly two places, indicating limited but critical coupling. The most frequent internal edge is render → formatDate (4×). No circular module dependencies were detected.

How To Use It

# Clone the fork you will work on
git clone https://github.com/moses-y/pointless && cd pointless

# Install dependencies (Yarn is declared in package.json)
yarn install

# Run the development server (starts Tauri + React)
yarn run tauri dev

# Build a production binary for the host platform
yarn run tauri build

No additional configuration files or environment variables are required; the app stores its data in the user's local app data directory.

Real‑World Use

A design team can drop the binary onto each workstation, open Pointless, and sketch UI mock‑ups that are saved locally as compressed .ptls files. Export buttons (src/components/Paper/components/ExportButton/index.js) allow PNG/JPEG/SVG output for inclusion in documentation without any network transfer.

Code Health & Issues

HIGH – Pin GitHub Action versions to commit SHAs (.github/workflows/*.yml).
HIGH – No test suite present despite 36 source files.
MEDIUM – Declare least‑privilege GITHUB_TOKEN permissions (.github/workflows/tests.yml).
MEDIUM – Enable Dependabot or Renovate for dependency updates.
MEDIUM – Install dependencies from lockfile (yarn install --immutable).
MEDIUM – Add a dependency‑vulnerability scan step in CI.
MEDIUM – Set persist-credentials: false on checkout (.github/workflows/release.yml).
LOW – Add explicit timeout-minutes to workflow jobs (.github/workflows/release.yml).
MEDIUM – High branching density in src/helpers.js (23 branches / 57 lines).
MEDIUM – Oversized file src/components/Paper/index.js (1117 lines) makes maintenance difficult.

All findings are derived from deterministic static analysis; no additional issues were inferred.

The Bottom Line

pointless provides a functional, offline drawing canvas with a clean Rust‑React stack, but the codebase suffers from a few maintainability hot spots (large files, high cognitive load) and lacks automated testing. It is suitable for teams that need a simple, self‑contained whiteboard and are comfortable adding tests and refactoring the core UI module.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

120 files

JavaScript30
CSS17
Rust6
JSON4
YAML3
Markdown1

React

Module dependencies

The 10 most depended-upon modules of 30, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_educers_library_librarySlice["librarySlice"] n1_src_helpers["helpers"] n2_src_constants["constants"] n3_src_store["store"] n4_ucers_settings_settingsSlice["settingsSlice"] n5_c_components_Paper_constants["constants"] n6__components_InlineEdit_index["index"] n7_src_components_Modal_index["index"] n8__reducers_router_routerSlice["routerSlice"] n9_src_components_Paper_index["index"] n6__components_InlineEdit_index --> n2_src_constants n9_src_components_Paper_index --> n8__reducers_router_routerSlice n9_src_components_Paper_index --> n2_src_constants n9_src_components_Paper_index --> n0_educers_library_librarySlice n9_src_components_Paper_index --> n5_c_components_Paper_constants n9_src_components_Paper_index --> n1_src_helpers n9_src_components_Paper_index --> n4_ucers_settings_settingsSlice n0_educers_library_librarySlice --> n2_src_constants n4_ucers_settings_settingsSlice --> n5_c_components_Paper_constants n4_ucers_settings_settingsSlice --> n2_src_constants n3_src_store --> n0_educers_library_librarySlice n3_src_store --> n8__reducers_router_routerSlice n3_src_store --> n4_ucers_settings_settingsSlice

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium5

low1

Pin third-party GitHub Actions to a commit SHAhigh3 occurrences

.github/workflows

dtolnay/rust-toolchain@stable, tauri-apps/tauri-action@dev, swatinem/rust-cache@v2

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Add a test suite; this repository has nonehigh36 occurrences

36 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/tests.yml

1 workflow(s) declare no permissions, 1 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

2 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Install from the lockfile in CImedium

.github/workflows

yarn install without --immutable

A fresh resolution in CI means the tested dependency set is not the locked one, so the failure only appears after merge.

Fix: Use npm ci, yarn install --immutable, or pnpm install --frozen-lockfile.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/release.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/release.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.