Vlad Mocanu and Claude Opus 4.6
bbfd630fc5
fix(prd-7): M4 test coverage review — 28 new tests for comment operations and branch setup
...
- test/create-initial-comment.test.ts: 15 tests covering GitHub/Forgejo
platform branches, sticky comment matching, review comment fallback,
error handling with GITHUB_OUTPUT verification
- test/update-tracking-comment.test.ts: 11 tests covering body construction,
branch link logic (issue vs PR), comment type routing, Forgejo URLs
- test/setup-branch-forgejo.test.ts: 2 tests verifying Forgejo uses
repos.getBranch() while GitHub uses git.getRef() for source branch SHA
- test/COVERAGE-NOTES.md: documents all coverage status and accepted gaps
(tag mode orchestrator, entrypoint) with rationale
- Notable finding: CLAUDE_APP_BOT_ID discrepancy flagged for M5
Progress: 67% complete (4/6 milestones) — M5 code quality next
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-26 12:51:08 +02:00
Vlad Mocanu and Claude Opus 4.6
6b0302d226
fix(prd-7): M3 security review — self-trigger guard, actor permissions, trigger bypass, platform validation
...
- Add self-mention/bot loop prevention in actor.ts (blocks actor matching bot_name)
- Switch Forgejo permission check to actor-level via getCollaboratorPermissionLevel
with fallback to token-level repos.get() when collaborator API returns 403
- Close empty-body PR review comment trigger bypass (now returns false instead of true)
- Add platform detection cross-validation (reject PLATFORM=forgejo on github.com)
- Document URL builder defense-in-depth rationale in comment-logic.ts
- Update/add tests across 6 test files (actor, permissions, trigger, platform, mcp, m7)
Progress: 50% complete (3/6 milestones) — next: M4 test coverage review
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-26 12:31:12 +02:00
Vlad Mocanu and Claude Opus 4.6
cefc229199
fix(prd-7): M2 error handling review — fix process.exit bypasses, TOCTOU gap, URL consistency
...
- F1: Replace process.exit(1) with throw in branch.ts (cleanup was bypassed)
- F2: Replace process.exit(1) with throw in install-mcp-server.ts (same issue)
- F2b: Replace process.exit(1) with throw in create-prompt/index.ts (same issue)
- F3: Use getServerUrl() instead of GITHUB_SERVER_URL constant in branch-cleanup.ts
- F4: Use updated_at for review TOCTOU filtering in Forgejo data fetcher
- Accepted notes: no pagination >100, no retry, unconditional trigger, image no-op
Progress: 33% complete — M2 done, M3 (security review) next
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-26 12:16:22 +02:00
Vlad Mocanu and Claude Opus 4.6
ac58fb6c14
fix(prd-7): M1 architecture review — consolidate duplication, fix bugs, memoize detection
...
- F1: Consolidated updateForgejoCommentBody into unified updateCommentBody (~150 lines removed)
- F2: Fixed wrong run identifier in update-with-branch.ts (context.runId → getForgejoRunIndex())
- F3: Memoized detectPlatform() with _resetPlatformCache() for tests
- F4: Added getServerUrl() runtime helper to resolve constant-vs-function inconsistency
- F5: Fixed sticky comment bot matching on Forgejo via context.inputs.botName
- F6: Documented GHES heuristic misidentification in docs/forgejo.md
- Updated PRD M1 checkbox to complete
Progress: 17% complete — M1 done, M2 (error handling review) next
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-26 12:09:02 +02:00
Vlad Mocanu and Claude Opus 4.6
34c259f189
docs(prd): create PRDs #5 , #6 , #7 for Forgejo hardening [skip ci]
...
- PRD #5 : Dedicated Forgejo user for Claude bot (dedicated identity, scoped token)
- PRD #6 : E2E test all 5 untested Forgejo trigger scenarios
- PRD #7 : Senior developer review of all Forgejo platform support code
- Defined 5, 7, and 6 milestones respectively
- All three can be parallelized (#7 is read-only, runs alongside #5 )
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-25 20:13:57 +02:00
