0 Fork 0

Files

T

Vlad MocanuandClaude Opus 4.6 cefc229199 fix(prd-7): M2 error handling review — fix process.exit bypasses, TOCTOU gap, URL consistency

- F1: Replace process.exit(1) with throw in branch.ts (cleanup was bypassed)
- F2: Replace process.exit(1) with throw in install-mcp-server.ts (same issue)
- F2b: Replace process.exit(1) with throw in create-prompt/index.ts (same issue)
- F3: Use getServerUrl() instead of GITHUB_SERVER_URL constant in branch-cleanup.ts
- F4: Use updated_at for review TOCTOU filtering in Forgejo data fetcher
- Accepted notes: no pagination >100, no retry, unconditional trigger, image no-op

Progress: 33% complete — M2 done, M3 (security review) next

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-26 12:16:22 +02:00

5.1 KiB

Raw Blame History

PRD #7: Senior Developer Review of Forgejo Platform Support

Issue: #7 Priority: Medium Created: 2026-02-25

Problem

The Forgejo platform support was implemented across multiple sessions (PRD #1). While it works for the validated scenarios, a comprehensive senior-level review is needed to:

Catch architectural issues that may cause problems at scale or during upstream merges
Identify edge cases and error handling gaps
Assess test coverage adequacy
Verify security posture (token handling, input sanitization, permission checks)
Ensure maintainability and code quality standards

This review should treat the codebase as if it were being submitted for a production readiness review.

Solution

Perform a thorough, documented code review of all Forgejo-related changes. The review should cover every new file, every modified file, and the overall architecture. Findings should be categorized by severity and each issue should be either fixed or documented as an accepted risk.

Review Scope

New Files (Forgejo-Specific)

src/platform/detector.ts — Platform detection logic
src/forgejo/token.ts — Token handling
src/forgejo/data/fetcher.ts — REST data fetching (replaces GraphQL)
src/forgejo/comment-logic.ts — URL patterns for tracking comments

Modified Files (Platform Branches)

src/entrypoints/run.ts — Token setup platform branch
src/modes/tag/index.ts — Data fetcher swap
src/github/operations/comments/create-initial.ts — Platform-aware spinner/URL
src/github/operations/comments/update-with-branch.ts — PR compare URL
src/github/operations/branch.ts — repos.getBranch() on Forgejo
src/github/validation/actor.ts — Skipped on Forgejo
src/mcp/install-mcp-server.ts — Skip GitHub MCP on Forgejo
action.yml — New inputs, env vars, platform support

Test Files

All __tests__/ files related to Forgejo functionality
Test coverage gaps

CI/CD

.forgejo/workflows/ — All workflow files

Documentation

docs/forgejo.md — Accuracy and completeness
CLAUDE.md — Forgejo section accuracy

Milestones

M1: Architecture & design review
- Review the lean adapter pattern: is it the right abstraction level?
- Assess merge-conflict surface with upstream: are platform branches minimal?
- Check for code duplication that could be consolidated
- Review the platform detection logic (3-tier: explicit > env > heuristic)
- Evaluate whether the src/forgejo/ directory structure scales
- Deliverable: Architecture findings document with severity ratings
M2: Error handling & edge case review
- Review every try/catch block in Forgejo code paths
- Check for unhandled promise rejections
- Verify graceful degradation when Forgejo APIs behave differently
- Check error messages — are they actionable for users?
- Review fallback behavior (e.g., repos.get() fallback for permissions)
- Deliverable: List of error handling gaps with fixes
M3: Security review
- Token handling: is the token properly scoped and never logged?
- Input sanitization: can webhook payloads inject content?
- Permission checks: are they sufficient on Forgejo?
- Secrets in logs: review all core.info() / core.debug() calls
- Deliverable: Security findings with severity ratings
M4: Test coverage review & improvements
- Assess existing unit test coverage for Forgejo code paths
- Identify critical paths without test coverage
- Write or improve tests for the most critical gaps
- Verify mocks accurately represent Forgejo API responses
- Deliverable: Test coverage improved, gaps documented
M5: Code quality & maintainability review
- TypeScript strictness: are types accurate or using any / type assertions?
- Naming conventions: consistent with the rest of the codebase?
- Dead code: any unused imports, unreachable branches, commented-out code?
- Magic strings/numbers: should any be extracted to constants?
- Code comments: are complex decisions documented?
- Deliverable: Code quality fixes applied
M6: Documentation accuracy review
- Cross-check docs/forgejo.md against actual code behavior
- Verify all "Known Limitations" are still accurate
- Check that code examples and configuration snippets work
- Ensure CLAUDE.md Forgejo section matches current state
- Deliverable: Documentation corrections applied

Deliverables

Each milestone produces a findings document (can be inline in a PR or as comments on issue #7) with:

Critical: Must fix before production use
Major: Should fix, risk of user-facing issues
Minor: Nice to have, code quality improvements
Note: Observations, not necessarily actionable

Dependencies

None — this is a review of existing code

Success Criteria

All Forgejo-related code has been reviewed by the criteria above
All Critical and Major findings are resolved
Minor findings are either fixed or documented as accepted
Test coverage is adequate for critical paths
Documentation accurately reflects the implementation

5.1 KiB Raw Blame History