Commit Graph
7 Commits
Author SHA1 Message Date
Vlad MocanuandClaude Opus 4.6 58677b91f4 fix(prd-7): M6 documentation accuracy review — 10 corrections across docs/forgejo.md and CLAUDE.md
- Fix actor validation: "skipped entirely" → "bot-type check skipped; self-trigger guard active"
- Fix permission check: document getCollaboratorPermissionLevel() primary with repos.get() fallback
- Add platform detection cross-validation security note (rejects Forgejo override on github.com)
- Fix update-with-branch.ts description: "PR compare URL" → "branch link" (URL is in update-comment-link.ts)
- Add missing update-comment-link.ts to key integration points in CLAUDE.md
- Fix test-action.yml description to match actual validation checks
- Nuance troubleshooting guidance for # in workflow if: expressions
- Verify all Known Limitations still accurate

Progress: 100% complete — all 6 milestones done

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 13:18:34 +02:00
Vlad MocanuandClaude Opus 4.6 741f12afaf fix(prd-7): M5 code quality review — remove dead re-exports, verify type safety
- Removed unused re-exports (CommentUpdateInput, ExecutionDetails,
  ensureProperlyEncodedUrl) from forgejo/comment-logic.ts
- Verified no `any` type escapes in Forgejo-specific code
- Confirmed naming conventions consistent with upstream
- No dead code, unused imports, or unreachable branches
- All complex decisions documented with comments
- Typecheck, format, and 834 tests pass clean

Progress: 83% complete — M6 (documentation accuracy) remaining

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 12:57:25 +02:00
Vlad MocanuandClaude Opus 4.6 bbfd630fc5 fix(prd-7): M4 test coverage review — 28 new tests for comment operations and branch setup
- test/create-initial-comment.test.ts: 15 tests covering GitHub/Forgejo
  platform branches, sticky comment matching, review comment fallback,
  error handling with GITHUB_OUTPUT verification
- test/update-tracking-comment.test.ts: 11 tests covering body construction,
  branch link logic (issue vs PR), comment type routing, Forgejo URLs
- test/setup-branch-forgejo.test.ts: 2 tests verifying Forgejo uses
  repos.getBranch() while GitHub uses git.getRef() for source branch SHA
- test/COVERAGE-NOTES.md: documents all coverage status and accepted gaps
  (tag mode orchestrator, entrypoint) with rationale
- Notable finding: CLAUDE_APP_BOT_ID discrepancy flagged for M5

Progress: 67% complete (4/6 milestones) — M5 code quality next

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 12:51:08 +02:00
Vlad MocanuandClaude Opus 4.6 6b0302d226 fix(prd-7): M3 security review — self-trigger guard, actor permissions, trigger bypass, platform validation
- Add self-mention/bot loop prevention in actor.ts (blocks actor matching bot_name)
- Switch Forgejo permission check to actor-level via getCollaboratorPermissionLevel
  with fallback to token-level repos.get() when collaborator API returns 403
- Close empty-body PR review comment trigger bypass (now returns false instead of true)
- Add platform detection cross-validation (reject PLATFORM=forgejo on github.com)
- Document URL builder defense-in-depth rationale in comment-logic.ts
- Update/add tests across 6 test files (actor, permissions, trigger, platform, mcp, m7)

Progress: 50% complete (3/6 milestones) — next: M4 test coverage review

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 12:31:12 +02:00
Vlad MocanuandClaude Opus 4.6 cefc229199 fix(prd-7): M2 error handling review — fix process.exit bypasses, TOCTOU gap, URL consistency
- F1: Replace process.exit(1) with throw in branch.ts (cleanup was bypassed)
- F2: Replace process.exit(1) with throw in install-mcp-server.ts (same issue)
- F2b: Replace process.exit(1) with throw in create-prompt/index.ts (same issue)
- F3: Use getServerUrl() instead of GITHUB_SERVER_URL constant in branch-cleanup.ts
- F4: Use updated_at for review TOCTOU filtering in Forgejo data fetcher
- Accepted notes: no pagination >100, no retry, unconditional trigger, image no-op

Progress: 33% complete — M2 done, M3 (security review) next

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 12:16:22 +02:00
Vlad MocanuandClaude Opus 4.6 ac58fb6c14 fix(prd-7): M1 architecture review — consolidate duplication, fix bugs, memoize detection
- F1: Consolidated updateForgejoCommentBody into unified updateCommentBody (~150 lines removed)
- F2: Fixed wrong run identifier in update-with-branch.ts (context.runId → getForgejoRunIndex())
- F3: Memoized detectPlatform() with _resetPlatformCache() for tests
- F4: Added getServerUrl() runtime helper to resolve constant-vs-function inconsistency
- F5: Fixed sticky comment bot matching on Forgejo via context.inputs.botName
- F6: Documented GHES heuristic misidentification in docs/forgejo.md
- Updated PRD M1 checkbox to complete

Progress: 17% complete — M1 done, M2 (error handling review) next

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-26 12:09:02 +02:00
Vlad MocanuandClaude Opus 4.6 34c259f189 docs(prd): create PRDs #5, #6, #7 for Forgejo hardening [skip ci]
- PRD #5: Dedicated Forgejo user for Claude bot (dedicated identity, scoped token)
- PRD #6: E2E test all 5 untested Forgejo trigger scenarios
- PRD #7: Senior developer review of all Forgejo platform support code
- Defined 5, 7, and 6 milestones respectively
- All three can be parallelized (#7 is read-only, runs alongside #5)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-25 20:13:57 +02:00