Vlad Mocanu and Claude Opus 4.6
fba53fc8a0
chore: anonymize internal URLs for public release
...
Replace git.wxs.ro with forgejo.example.com in tests and docs.
Add public repo guidelines to CLAUDE.md.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-27 16:36:34 +02:00
Vlad Mocanu and Claude Opus 4.6
6b0302d226
fix(prd-7): M3 security review — self-trigger guard, actor permissions, trigger bypass, platform validation
...
- Add self-mention/bot loop prevention in actor.ts (blocks actor matching bot_name)
- Switch Forgejo permission check to actor-level via getCollaboratorPermissionLevel
with fallback to token-level repos.get() when collaborator API returns 403
- Close empty-body PR review comment trigger bypass (now returns false instead of true)
- Add platform detection cross-validation (reject PLATFORM=forgejo on github.com)
- Document URL builder defense-in-depth rationale in comment-logic.ts
- Update/add tests across 6 test files (actor, permissions, trigger, platform, mcp, m7)
Progress: 50% complete (3/6 milestones) — next: M4 test coverage review
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-26 12:31:12 +02:00
Vlad Mocanu and Claude Opus 4.6
ac58fb6c14
fix(prd-7): M1 architecture review — consolidate duplication, fix bugs, memoize detection
...
- F1: Consolidated updateForgejoCommentBody into unified updateCommentBody (~150 lines removed)
- F2: Fixed wrong run identifier in update-with-branch.ts (context.runId → getForgejoRunIndex())
- F3: Memoized detectPlatform() with _resetPlatformCache() for tests
- F4: Added getServerUrl() runtime helper to resolve constant-vs-function inconsistency
- F5: Fixed sticky comment bot matching on Forgejo via context.inputs.botName
- F6: Documented GHES heuristic misidentification in docs/forgejo.md
- Updated PRD M1 checkbox to complete
Progress: 17% complete — M1 done, M2 (error handling review) next
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-26 12:09:02 +02:00
Vlad Mocanu and Claude Opus 4.6
88401255be
feat(prd-1): implement M7 - entry point + mode handler integration
...
- Tag mode routes to fetchForgejoData vs fetchGitHubData based on platform
- createInitialComment auto-detects platform for Forgejo spinner/URL format
- update-comment-link uses updateForgejoCommentBody + Forgejo PR compare URL
- update-with-branch uses platform-aware branch/job-run link formatting
- Agent mode needed NO changes (token in run.ts, rest uses Octokit REST)
- 11 new integration tests in test/m7-integration.test.ts
- 785 tests pass, typecheck clean, format clean
Progress: 78% complete (7/9 milestones) - M3, M8, M9 remaining
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-25 18:22:27 +02:00
