main

Aaflyingtofix: add pr/review.go ErrSecretDetected check + 401 guidance test (review feedback)

1e90feb8Add on Jul 9History

Files	Last commit	Last update
review.go	fix: add pr/review.go ErrSecretDetected check + 401 guidance test (review feedback) Review findings: - pr/review/review.go --comment-file paths still wrapped ErrSecretDetected as 'failed to read'; now checks errors.Is - Added TestAPIError/401_with_guidance case (mirrors 403 pattern) Refs #428 Refs #432 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	3 months ago
review_test.go	fix(security): scan inline --body/--comment/--description/--notes for secrets 10 inline flag paths bypassed ScanContentForSecrets, allowing AI agents to accidentally submit content containing the current GC_TOKEN value. Fixed paths (issue #424): - issue comment --body (local getBody: add scan to inline branch) - issue comment edit --body (same) - issue edit --body (same) - pr comment --body (same) - pr comment edit --body (same) - pr edit --body (add scan before direct assignment) - pr review --comment (scan after --comment-file block, before API calls) - milestone edit --description (scan before HTTP client creation) - release create --notes (scan before HTTP client creation) - release edit --notes (scan after GetRelease, before PATCH) Preventive: ReadText (text_file.go) now calls ScanContentForSecrets. Tests: - cmdutil: 5 integration tests (ReadBody/ReadText/ReadTextFile/ ReadTextFromFlag reject token content) - 10 command-level unit tests (one per bypass path) - System test (secret-scan.txtar): 9 inline paths verified end-to-end with fake token, plus negative control - docs/REGRESSION.md: documented secret scanning regression Refs #424 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	3 months ago