public/claude-code-action
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
568 Commits 1 Branch 1 Tag
6b0302d22680d921ac0a4572fe71dd25bdfd515d
Commit Graph
4 Commits
Author SHA1 Message Date
Vlad MocanuandClaude Opus 4.6 6b0302d226 fix(prd-7): M3 security review — self-trigger guard, actor permissions, trigger bypass, platform validation 
- Add self-mention/bot loop prevention in actor.ts (blocks actor matching bot_name)
- Switch Forgejo permission check to actor-level via getCollaboratorPermissionLevel
  with fallback to token-level repos.get() when collaborator API returns 403
- Close empty-body PR review comment trigger bypass (now returns false instead of true)
- Add platform detection cross-validation (reject PLATFORM=forgejo on github.com)
- Document URL builder defense-in-depth rationale in comment-logic.ts
- Update/add tests across 6 test files (actor, permissions, trigger, platform, mcp, m7)

Progress: 50% complete (3/6 milestones) — next: M4 test coverage review

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-26 12:31:12 +02:00
Vlad MocanuandClaude Opus 4.6 cefc229199 fix(prd-7): M2 error handling review — fix process.exit bypasses, TOCTOU gap, URL consistency 
- F1: Replace process.exit(1) with throw in branch.ts (cleanup was bypassed)
- F2: Replace process.exit(1) with throw in install-mcp-server.ts (same issue)
- F2b: Replace process.exit(1) with throw in create-prompt/index.ts (same issue)
- F3: Use getServerUrl() instead of GITHUB_SERVER_URL constant in branch-cleanup.ts
- F4: Use updated_at for review TOCTOU filtering in Forgejo data fetcher
- Accepted notes: no pagination >100, no retry, unconditional trigger, image no-op

Progress: 33% complete — M2 done, M3 (security review) next

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-26 12:16:22 +02:00
Vlad MocanuandClaude Opus 4.6 ac58fb6c14 fix(prd-7): M1 architecture review — consolidate duplication, fix bugs, memoize detection 
- F1: Consolidated updateForgejoCommentBody into unified updateCommentBody (~150 lines removed)
- F2: Fixed wrong run identifier in update-with-branch.ts (context.runId → getForgejoRunIndex())
- F3: Memoized detectPlatform() with _resetPlatformCache() for tests
- F4: Added getServerUrl() runtime helper to resolve constant-vs-function inconsistency
- F5: Fixed sticky comment bot matching on Forgejo via context.inputs.botName
- F6: Documented GHES heuristic misidentification in docs/forgejo.md
- Updated PRD M1 checkbox to complete

Progress: 17% complete — M1 done, M2 (error handling review) next

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-26 12:09:02 +02:00
Vlad MocanuandClaude Opus 4.6 34c259f189 docs(prd): create PRDs #5, #6, #7 for Forgejo hardening [skip ci] 
- PRD #5: Dedicated Forgejo user for Claude bot (dedicated identity, scoped token)
- PRD #6: E2E test all 5 untested Forgejo trigger scenarios
- PRD #7: Senior developer review of all Forgejo platform support code
- Defined 5, 7, and 6 milestones respectively
- All three can be parallelized (#7 is read-only, runs alongside #5)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-02-25 20:13:57 +02:00