| chore: remove inline skills, add .claude/skills/ to gitignore Skills now installed from external source at ~/claude-code/skills. Commit only tracks .gitignore exclusion, not the skill files themselves. Co-Authored-By: Claude <noreply@anthropic.com> | 4 个月前 |
| fix(review): address multi-role review findings for the 609 batch Four independent reviewers (code/security/test/docs) over the 6-commit batch: one P1, five P2s, and a set of P3s — all fixed here. P1 (code review, reproduced end-to-end): the shadow-skip broke the PRIMARY install path. npx/npm exec prepends the package's own npx-cache node_modules/.bin to PATH, so firstProviderOnPath resolved the package's own shims and every completion was skipped with a misleading warning — on a clean machine too. A provider now counts as self when it resolves into the same package tree that is running the installer (providerIsRunningPackage, realpath against the running package root); a different persistent install of our coordinate still shadows. The npx shape is reproduced in a sandbox fixture: 6/6 completions install, zero skips or warnings. Docs P2s: the PowerShell completion example wrote to $PROFILE.Completions, a nonexistent property — the redirect drops the script silently; now appends to $PROFILE. The zsh notice pointed at a README section that does not exist (both pointers now name the Uninstall section). spec and .devcontainer still taught the deleted make release-snapshot; AGENTS.md still called 'make release' the official publish after it became --skip=publish. AI-GUIDE and INTRODUCTION carried half-migrated repository slugs (clone commands and -R demo targets that hit the retired coordinate); dev-facing test rules and links unified too. Code P3s: BASH_COMPLETION_USER_DIR now requires absolute entries like the XDG vars (a relative value produced a CWD-relative write target); the upload precheck also refuses batch-internal duplicate basenames; --clobber against a directory says so instead of a raw is-a-directory error; the main npm job's post-publish verification loop normalizes failed lookups into retries like every other dist-tag check. Test P3s: the Go PATHEXT helper gains the table test mirroring its JS twin (the parity this batch is about had no Go-side pin); the mutually-exclusive-flags test asserts the cobra flag-group error text (a bare err != nil stayed green if the check were dropped); the workflow contract requires BOTH dist-tag-guard invocations (strings.Count == 2); the doctor human-output test pins the header order; upload gains the wrapped not-found (exit 3) and directory/batch-duplicate tests; providerIsRunningPackage and the relative BCUD entries get unit tests. Recorded without changes: api-doc/ is a separate repository (its slug stays), sparse-checkout for the npm job and the pre-existing dual download-artifact pin are noted for later, shadow run-level positive coverage rides the sandbox fixture above. Co-Authored-By: Claude Code <noreply@anthropic.com> | 1 个月前 |
| ci: run the Python unit tests on the GitCode test job The three Python test modules ran only on the GitHub mirror (wired in !603); the GitCode test job had zero Python steps (its seven python references all live in the package job's wheel pipeline), so record- mode, wrapper, and remote-facts regressions had no signal on the primary platform. Add the same explicit three-module unittest step the GitHub ubuntu job runs. This is deliberately added without setup-python: the PR's own GitCode CI run doubles as the codearts runner python3 availability probe (issue 630) - a green run proves availability and lands the wiring in one step; a command-not-found failure means setup-python needs adding instead. Step content is the contract suite's declared uncovered dimension, so the 21 mutation negatives pass unchanged; the 5.4 job table syncs the test row wording. Refs #630 Co-Authored-By: Claude Code <noreply@anthropic.com> | 12 天前 |
| fix(release): diagnose the skip-path dist-tag check and pin both sleeps The idempotent skip path inside the publish loop also read the dist-tag once and failed without distinguishing a stale value from a failed lookup; give it the same diagnosis text. Count both sleep 30 occurrences in the contract so one loop regressing alone is caught, and pin the main-path lookup-failure message. Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |
| fix(review): pin CI triggers and preflight tests in contracts, sync residual docs Review fixes (three reviewers converged on the contract gap): - ci workflow contract: workflowDocument now parses the on block and validateTriggers pins pull_request and push both covering main for BOTH workflow files (new mirror parity test - the GitHub side had zero contract coverage); containment semantics so future release/* branches do not break the pin; three mutation negatives prove the validator catches a removed or retargeted trigger, the exact regression that would recreate the d1714f0 blind spot - release workflow contract: preflight must run go test before the tag is created, pinning the release-time unit test gate - docs: LOOP-GOAL-GUIDE mirror-trigger sentence was stale, ci-workflows toolchain table now lists the push trigger, .loop lesson 9 updated, and the run-list examples gain --branch main --event Push queries for the issue acceptance verification Refs #618 Co-Authored-By: Claude Code <noreply@anthropic.com> | 18 天前 |
| spec(workflow): make delivery-notify optional opt-in (§5.9.A) 反馈修正:§5.9.A 此前写成「标准动作(非可选装饰)」,把可选项说成强制。 飞书里程碑通报应为可选 opt-in: - §5.9.A 改为「可选」,默认不启用,须用户 opt-in - 新增「交付前 opt-in(交互式)」:进入交付前若 CanPrompt,先问用户是否启用, 启用则继续问里程碑范围/本人或群/是否逐条确认,写入持久化 consent 文件 - consent 来源优先级:文件 > 当次交互 > 无→静默跳过不阻断 - §5.9 intro 区分:A 可选 opt-in;B 涉及 API 调用时标准查证 - 同步 Example 案例「主流程」表注:delivery-notify 可选 opt-in(与规范一致) | 2 个月前 |
| fix(api): drop UpdateRelease orphaned by the wrapper removal UpdateReleaseByTag was UpdateRelease's only production caller, so the third-batch deletion left UpdateRelease and its options struct with zero references (the id-form PATCH endpoint is not in openapi either — same class as the numeric-ID family from issue 633). Delete both; GitCodeUpdateReleaseOptions and the by-tag update path stay. Co-Authored-By: Claude Code <noreply@anthropic.com> | 7 天前 |
| fix(build): converge the tracked postinstall copy and gate drift in CI The third-round commit that dropped the update-shell-completions dead branch edited scripts/postinstall.sh but never regenerated the tracked copy under build/scripts/, re-introducing the exact drift the release preflight (prepare-package-assets.sh && git diff --exit-code) was built to catch: the next release would fail deterministically, and a direct nfpm package would ship the dead branch. Regenerate the copy and add the same drift check to the CI test job so the divergence is caught at PR time instead of blocking a release. Fifth review batch 1, issue 606 item 2. Co-Authored-By: Claude Code <noreply@anthropic.com> | 1 个月前 |
| fix(version): show git commit/date when built without ldflags Use debug.ReadBuildInfo() to get VCS info (commit, time, modified) when version info is not injected via -ldflags. This fixes the issue where go build users see "dev/none/unknown" instead of actual git info. Also update README to clarify both build methods. Refs #169 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> | 6 个月前 |
| feat: add comprehensive packaging configuration - Add GoReleaser configuration for multi-platform builds - Add Docker multi-stage build with non-root user - Add docker-compose for development environment - Add Homebrew formula template - Add Scoop manifest template - Add shell completions (bash, zsh, fish) - Add postinstall and preremove scripts - Update Makefile with build, docker, and release targets - Enhance CI workflow with lint, test, build, docker jobs - Add release workflow for automated releases - Add CONTRIBUTING.md with development guide Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> | 7 个月前 |
| docs: add RTK integration guide and reference configuration Add Layer 1 RTK integration (zero-intrusion): - contrib/rtk/config.toml: reference filter config for gc commands - docs/AI-GUIDE.md: section 6 - RTK usage guide with install/setup/examples RTK filters pre-configured for: pr list/view/comments/diff, issue list/view/comments, repo list/view/log/stats, release list/view, label list, milestone list, auth status, version. Closes #176 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> | 4 个月前 |
| docs(actions): note --wait has no effect on JSON output The JSON path returns before the polling branch, so --wait is silently ignored with --json; say so in the watch section. Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |
| chore(release): prepare v0.16.0 Release notes for v0.16.0 (auth host resolution alignment, PR settings nested-response fix plus --close-issue-on-merge, TTY detection, issue templates, dev-setup PATH warnings, three dead-code batches, CI contract test suite, dual-platform Python unit tests) and the version roll: VERSION, nfpm, pyproject, npm package, README, PACKAGING, and AI-GUIDE via the sync scripts. Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |
| fix(git): set GIT_TERMINAL_PROMPT=0 to prevent non-TTY block | 2 个月前 |
| fix(install): bound installer subprocesses and correct stale references The installer's external processes ran without timeouts: a blocked child (AV scanning the fresh binary, a hung PowerShell) hung the whole install indefinitely. Bound runGc at 30s and the PATH-persisting PowerShell at 90s (the script itself waits up to 30s on the global PATH mutex). Completion skips now say why (command failed vs target not writable vs symlink) instead of a blanket "none writable". The postinstall pnpm branch still printed the npm-channel PATH-shadowing report, whose paths (a nonexistent <pnpm prefix>/bin) and attribution ("was installed by npm") were wrong and whose suggested commands could not work; the pnpm channel now records its metadata and stays silent. The homebrew reference formula pointed at the dead gitcode-cli organization for its tap, homepage and download URLs (404s); align it with the atomgit-cli pipeline the release workflow actually uses. --help now works in any argument position instead of only alone. Fourth review P3 backlog, issue 605 items 1, 2, 3, 4. Co-Authored-By: Claude Code <noreply@anthropic.com> | 1 个月前 |
| refactor: remove deprecated in-repo skills Refs #487 | 3 个月前 |
| chore(release): prepare v0.16.0 Release notes for v0.16.0 (auth host resolution alignment, PR settings nested-response fix plus --close-issue-on-merge, TTY detection, issue templates, dev-setup PATH warnings, three dead-code batches, CI contract test suite, dual-platform Python unit tests) and the version roll: VERSION, nfpm, pyproject, npm package, README, PACKAGING, and AI-GUIDE via the sync scripts. Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |
| test(actions): pin the --wait flag registration and loop pacing The flag-existence list did not include wait, so removing the flag registration passed every test (the new cases build WatchOptions directly); add it. The polling test now asserts a wall-time floor of two interval sleeps, so dropping the interval sleep from the loop (nothing but API hammering remains) fails instead of passing fast. Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |
| chore: unify repository URLs to atomgit-cli/cli The same binary advertised two homes: gc version printed gitcode.com/gitcode-cli/cli while the goreleaser brew homepage and release footer use gitcode.com/atomgit-cli/cli — and the latter is the actual origin remote. Unify every repository URL to atomgit-cli/cli: version.go (text and --json url field) with its three test assertions, the RELEASE.md download URLs, the scoop manifest, the CONTRIBUTING clone command, and AGENTS.md (repo references in CI description, actions examples, and the self-testing rule; the GitHub mirror org was stale too). The Go module path (gitcode.com/gitcode-cli/cli) and the npm package coordinate (@gitcode-cli/cli) are identifiers, not URLs, and stay untouched. Co-Authored-By: Claude Code <noreply@anthropic.com> | 1 个月前 |
| test(dev-setup): reach the download branch in the PowerShell case dev-setup.ps1 lists modules first and only runs go mod download when the list fails, so the download failure guidance case needs the list stub to fail too; without it the run never reached the branch and the Windows lane failed expecting a gap. Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |
| docs(release): sync the dist-tag retry window in the spec The workflow now retries 20x30s; update the parameter-level wording in release-process.md §6.5 and note the observed v0.16.0 propagation time. Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |
| test(release): pin the skip-path propagation hint The skip-path diagnosis added with the retry-window fix had no assertion of its own; count both "may still be propagating" occurrences so removing either copy fails the contract. Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |
| chore: sync api-doc submodule — actions run stop/rerun/retry 标记为 native 覆盖 gc-api-doc f95b61e → 79b4610 - 新增 3 条 native 映射规则:POST /runs/{run_id}/stop → gc actions run stop、/rerun → gc actions run rerun、/retry → gc actions run retry - support-matrix 重新生成:native 80 → 83,api-only 222 → 219 - CLI 基线 commit 刷新至 a0b0de2(含 v0.13.0 三命令 schema) - 官方资产不变(指纹 79cda0fd,309 操作) - gc-api-doc 验证:validate_catalog passed、22 tests OK Closes #575 | 1 个月前 |
| chore: fix end-of-file-fixer and gofmt issues exposed by LF normalization Apply end-of-file-fixer (newline at EOF) and gofmt formatting fixes to files that were previously masked by CRLF/LF line-ending noise. Closes #300 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> | 4 个月前 |
| chore: add .gitattributes to enforce LF line endings Prevents CRLF/LF noise in pre-commit hooks on Windows where core.autocrlf=true converts LF blobs to CRLF in the working tree. Closes #292 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> | 4 个月前 |
| docs: introduce SIG governance and RFC process 引入 SIG 治理模型(仓库承载方案)与 RFC 流程: - spec/governance/sig-governance.md:SIG 生命周期(propose/incubating/ active/degraded/archived)、角色模型(lead/maintainer/agent/contributor)、 单人维护豁免条款、决策机制、Agent 在 SIG 中的位置与边界、 sig/* 与 scope/* label 正交关系 - spec/governance/sigs/{api,cli-ux,governance}.yaml:三个试点 SIG 元数据, 均 incubating 起步,当前处于单人维护豁免期(已在 YAML 顶部标注) - docs/SIGS.md:面向贡献者的 SIG 导航文档 - docs/rfcs/:RFC 流程 README 与模板(参考 PyTorch RFC,仓内目录而非独立仓) - scripts/validate-sig-yamls.sh + make validate-sigs:SIG 元数据机器校验 - spec/README.md:结构与核心规范表同步 - spec/governance/ai-collaboration.md:职责边界反向链接 - .gitignore:忽略 .codex-tmp/(AI 草稿工作区,本地评审存档不入库) - .gitleaks.toml:allowlist 排除 dist/(gitignored 构建产物含第三方包文件, setuptools 源码触发 generic-api-key 误报;与既有 tmp/gh-cli/ 排除同构) 草稿经独立执行主体评审(6 个阻断问题已修复);label sig/api、 sig/cli-ux、sig/governance 已创建。 Co-Authored-By: Kimi <noreply@moonshot.cn> | 1 个月前 |
| fix(security): anchor gitleaks allowlist paths and exclude dist/ build artifacts - 新增 ^dist/.* 排除:pre-commit gitleaks hook 为 --no-git workspace 模式, 会扫描 gitignored 的 dist/ 构建产物(npm tarball / wheel 内含第三方 setuptools 源码),触发 generic-api-key 误报 - 锚定 ^ 前缀:gitleaks paths 为非锚定正则,未锚定的 dist/.* 会误排除 任意嵌套层级(如 pkg/dist/)的同名目录;实测锚定后 pkg/dist/ 恢复报警 - 同步锚定既有 tmp/gh-cli/.* 为 ^tmp/gh-cli/.*(同构收紧) - 残余风险:git add -f dist/x 强制入库后两道 gitleaks 防线均跳过该路径, 由 review 纪律兜底;CI 为 git 模式且 dist/ 不入库,不受影响 验证:gitleaks detect --no-git --config .gitleaks.toml 实测—— 根 dist/root.txt 不报警(预期排除)、pkg/dist/nested.txt 报警(锚定生效)、 src/normal.txt 报警(正常路径不受影响)。 | 1 个月前 |
| refactor: add gc-api-doc as api-doc/ submodule + sync governance docs | 2 个月前 |
| ci(build): pipeline hardening (pin actions, dist-tag guard, darwin ldflags, cleanup) Ten round-6 findings in the release pipeline: - Makefile: drop the release-snapshot target (identical to release-local except for the goreleaser-v2-removed --rm-dist flag; unreferenced); make release now passes --skip=publish like every workflow call — goreleaser's own push only reaches the GitHub mirror, never the real release. - dist-tag retries: lookups now normalize failures into retries (|| true) instead of dying silently through errexit — the bare assignment in the recovery skip path killed the step with no message, and the main path's verification loop had the same hole. The recovery retry window aligns with the main path (12x15s; propagation >35s observed in v0.14.1). - Dist-tag guard: the recovery path's inline node comparison moves to scripts/npm-dist-tag-guard.mjs (unit-tested: forward/equal moves, backwards refusal, prerelease ranking, malformed input) and the main npm job now runs the same guard before publishing — it previously had no backslide protection at all and, notably, no checkout step. - darwin ldflags: Makefile, build-release.sh and package.sh all stripped with -s on every platform; -s drops LC_UUID which dyld requires (per the ci.yml comment and goreleaser overrides). All three now build darwin with -w only. - CI drift: the package-assets check only regenerated build/ from the committed completions/, so a stale completions/ commit passed CI and failed at release preflight. The step now regenerates completions/ from a fresh build and diffs both trees. - Upgrade e2e: pin the install source to @gitcode-cli/cli explicitly — 0.10.3 is that coordinate's first release and atomgit-cli@0.10.3 never existed, so a package.json name switch would have 404'd the matrix. - ci.yml: all 16 uses pinned to day-verified SHAs (two tags had moved since the review snapshot) and pip install build pinned to 1.4.1, matching release.yml. - Dockerfile: alpine 3.19 reached EOL 2025-11-01; bump to 3.22 (digest pin deferred — registry access unavailable from the dev environment, documented in the Dockerfile). The source label points at the retired github.com/gitcode-com org; now the real mirror. - goreleaser: goarm (no 32-bit targets), release, announce and changelog blocks were dead under --skip=publish and invited misreading (release notes come from gh --notes-file); brews keeps only its live role (formula generation) — the tap push is the workflow's brew job — dropping the push-only fields. - Misc: PyPI precheck urlopen gets a 30s timeout (a hang holds the release concurrency slot); verify-remote-facts.py now rejects an explicitly-passed --issue that the PR does not reference; package.sh converges its three doc-sync sed blocks onto the hardened sync-docs-version.sh (boundary-aware, per-file detection, residual check) instead of an unbounded rewriter with none. Co-Authored-By: Claude Code <noreply@anthropic.com> | 1 个月前 |
| fix(precommit): enforce pre-push hooks | 3 个月前 |
| ci: run CI on main pushes and gate releases with go test PR events were the only automated evidence point: a broken test could merge with red PR CI (d1714f0 landed via !592 with run 419 FAILED) and nothing would re-examine the tip of main until the next PRs started failing (all PR CI blocked until the fix landed). - both ci.yml gain on.push.branches: [main] alongside the pull_request trigger, so every merge or direct push to main leaves its own CI record and go-test evidence no longer exists only at PR time - release.yml preflight gains a go test ./... step after the version sync checks, so a release cut while main CI is missing or red still hits a unit-test gate - sync the trigger documentation in spec/delivery/ci-workflows.md (must-list, hierarchy diagram, trigger section, release section), spec/workflows/ai-local-development-workflow.md, spec/foundations/code-quality-gates.md, spec/delivery/release-process.md, and AGENTS.md Acceptance evidence for the push trigger lands post-merge as the first main-branch CI run, per the issue's acceptance criteria. Refs #618 Co-Authored-By: Claude Code <noreply@anthropic.com> | 18 天前 |
| docs(sig): address strict review findings for SIG governance 修复三角色严格评审的 1 blocker + 15 major: - B1: discussion 依赖降级——Phase 1 以带 sig/* label 的 issue 为讨论通道; §6.2 明确平台 repo 级分类能力未验证、启用条件与迁移路径;YAML discussion_category 标注为规划值 - M1: 新增 scope_labels 可选字段(YAML + §5.2 + §6.1)显式映射 scope/* label, 未映射不计入活跃度;评估主体与节奏(sig/governance lead 月度)写入 §3 - M2: 豁免条款闭环——豁免有效期=整改窗口、终态=全部 SIG 脱离、逾期后果 (连续 2 个评估周期未整改触发 degraded 评估)、maintainer 人数判定来源 - M3: §9 补失败判定标准与回退动作清单(收缩 / 撤销单个 SIG / 整体回退) - M4: lazy consensus 补最短公示 ≥ 72 小时 - M5: §3 增加 incubating→archived 试点撤销路径、degraded 量化(lead 缺位 ≥ 2 周对齐 §4.4) - M6: 标注义务封闭集合移除不入库的 .codex-tmp 草稿路径 - M7: source-of-truth-matrix 登记 SIG 元数据与 RFC 流程真相源行;docs-governance §2.2/§3 同步 - M8: RFC 流程规则移入 spec/workflows/rfc-workflow.md,docs/rfcs/README.md 退化为导航; shelved 登记矛盾修正(登记表仅 accepted) - M9: AGENTS.md §2.4 与常用任务入口、CLAUDE.md、docs/README.md、CONTRIBUTING.md、spec/README.md 同步 SIG/RFC 入口 - M10: §4.3 补 Signed-off-by-Agent / Co-Authored-By 与既有审计 trailer 的正交关系 - M11: 校验脚本提取管道容错,坏文件不再静默中断整个校验 - M12: labels 校验改行级精确匹配,防 sig/<name>-xx 词边界绕过 - M13: 豁免一致性判定收紧为"同一单人列表",与 §4.2 语义对齐(修误报与漏报) - M14: .gitleaks.toml 变更撤出本 PR(与 SIG 主题无关,另行单独 PR) - M15: 脚本加可执行位;另补 nullglob、ERROR 消息文件前缀、kebab 正则统一、 scope_labels 格式与跨文件查重校验、Makefile SIGS_DIR 透传 - 附带:RFC 模板补回滚策略节;§6.3 状态机改引 issue/pr-workflow.md; 试点周期对齐 4 周(第 2 周中期检查点);label deprecated 操作方式明确; propose 不入 status 枚举的说明 验证:validate-sig-yamls.sh 正向 3 文件通过;负面测试矩阵 8 组全过 (多文件不中断、sig/api-v2 绕过、2 人重叠误报/漏报、scope_labels 非法条目、 跨文件重复映射、空目录等);无 Go 代码变更,CI lint/test/build 不受影响。 | 1 个月前 |
| fix(dev-setup): warn and check when managed bin is off PATH Contributors whose managed tools directory is not on PATH saw "dev environment ready" and then lost their first commit to "gitleaks: command not found" — the hooks resolve gitleaks through PATH. The ready ending now carries a warning with the hook consequence and a pasteable profile example (the script still never touches profiles), --check counts the missing directory as a gap with a non-zero exit, and a failed go mod download prints GOPROXY guidance with public mirror examples. Contract tests gain the off-PATH check gap, the warning assertions, and the download failure case on both bash and PowerShell. Closes #611 Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |
| ci(build): pipeline hardening (pin actions, dist-tag guard, darwin ldflags, cleanup) Ten round-6 findings in the release pipeline: - Makefile: drop the release-snapshot target (identical to release-local except for the goreleaser-v2-removed --rm-dist flag; unreferenced); make release now passes --skip=publish like every workflow call — goreleaser's own push only reaches the GitHub mirror, never the real release. - dist-tag retries: lookups now normalize failures into retries (|| true) instead of dying silently through errexit — the bare assignment in the recovery skip path killed the step with no message, and the main path's verification loop had the same hole. The recovery retry window aligns with the main path (12x15s; propagation >35s observed in v0.14.1). - Dist-tag guard: the recovery path's inline node comparison moves to scripts/npm-dist-tag-guard.mjs (unit-tested: forward/equal moves, backwards refusal, prerelease ranking, malformed input) and the main npm job now runs the same guard before publishing — it previously had no backslide protection at all and, notably, no checkout step. - darwin ldflags: Makefile, build-release.sh and package.sh all stripped with -s on every platform; -s drops LC_UUID which dyld requires (per the ci.yml comment and goreleaser overrides). All three now build darwin with -w only. - CI drift: the package-assets check only regenerated build/ from the committed completions/, so a stale completions/ commit passed CI and failed at release preflight. The step now regenerates completions/ from a fresh build and diffs both trees. - Upgrade e2e: pin the install source to @gitcode-cli/cli explicitly — 0.10.3 is that coordinate's first release and atomgit-cli@0.10.3 never existed, so a package.json name switch would have 404'd the matrix. - ci.yml: all 16 uses pinned to day-verified SHAs (two tags had moved since the review snapshot) and pip install build pinned to 1.4.1, matching release.yml. - Dockerfile: alpine 3.19 reached EOL 2025-11-01; bump to 3.22 (digest pin deferred — registry access unavailable from the dev environment, documented in the Dockerfile). The source label points at the retired github.com/gitcode-com org; now the real mirror. - goreleaser: goarm (no 32-bit targets), release, announce and changelog blocks were dead under --skip=publish and invited misreading (release notes come from gh --notes-file); brews keeps only its live role (formula generation) — the tap push is the workflow's brew job — dropping the push-only fields. - Misc: PyPI precheck urlopen gets a 30s timeout (a hang holds the release concurrency slot); verify-remote-facts.py now rejects an explicitly-passed --issue that the PR does not reference; package.sh converges its three doc-sync sed blocks onto the hardened sync-docs-version.sh (boundary-aware, per-file detection, residual check) instead of an unbounded rewriter with none. Co-Authored-By: Claude Code <noreply@anthropic.com> | 1 个月前 |
| chore: fix end-of-file-fixer and gofmt issues exposed by LF normalization Apply end-of-file-fixer (newline at EOF) and gofmt formatting fixes to files that were previously masked by CRLF/LF line-ending noise. Closes #300 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> | 4 个月前 |
| chore: fix end-of-file-fixer and gofmt issues exposed by LF normalization Apply end-of-file-fixer (newline at EOF) and gofmt formatting fixes to files that were previously masked by CRLF/LF line-ending noise. Closes #300 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> | 4 个月前 |
| ci(build): pipeline hardening (pin actions, dist-tag guard, darwin ldflags, cleanup) Ten round-6 findings in the release pipeline: - Makefile: drop the release-snapshot target (identical to release-local except for the goreleaser-v2-removed --rm-dist flag; unreferenced); make release now passes --skip=publish like every workflow call — goreleaser's own push only reaches the GitHub mirror, never the real release. - dist-tag retries: lookups now normalize failures into retries (|| true) instead of dying silently through errexit — the bare assignment in the recovery skip path killed the step with no message, and the main path's verification loop had the same hole. The recovery retry window aligns with the main path (12x15s; propagation >35s observed in v0.14.1). - Dist-tag guard: the recovery path's inline node comparison moves to scripts/npm-dist-tag-guard.mjs (unit-tested: forward/equal moves, backwards refusal, prerelease ranking, malformed input) and the main npm job now runs the same guard before publishing — it previously had no backslide protection at all and, notably, no checkout step. - darwin ldflags: Makefile, build-release.sh and package.sh all stripped with -s on every platform; -s drops LC_UUID which dyld requires (per the ci.yml comment and goreleaser overrides). All three now build darwin with -w only. - CI drift: the package-assets check only regenerated build/ from the committed completions/, so a stale completions/ commit passed CI and failed at release preflight. The step now regenerates completions/ from a fresh build and diffs both trees. - Upgrade e2e: pin the install source to @gitcode-cli/cli explicitly — 0.10.3 is that coordinate's first release and atomgit-cli@0.10.3 never existed, so a package.json name switch would have 404'd the matrix. - ci.yml: all 16 uses pinned to day-verified SHAs (two tags had moved since the review snapshot) and pip install build pinned to 1.4.1, matching release.yml. - Dockerfile: alpine 3.19 reached EOL 2025-11-01; bump to 3.22 (digest pin deferred — registry access unavailable from the dev environment, documented in the Dockerfile). The source label points at the retired github.com/gitcode-com org; now the real mirror. - goreleaser: goarm (no 32-bit targets), release, announce and changelog blocks were dead under --skip=publish and invited misreading (release notes come from gh --notes-file); brews keeps only its live role (formula generation) — the tap push is the workflow's brew job — dropping the push-only fields. - Misc: PyPI precheck urlopen gets a 30s timeout (a hang holds the release concurrency slot); verify-remote-facts.py now rejects an explicitly-passed --issue that the PR does not reference; package.sh converges its three doc-sync sed blocks onto the hardened sync-docs-version.sh (boundary-aware, per-file detection, residual check) instead of an unbounded rewriter with none. Co-Authored-By: Claude Code <noreply@anthropic.com> | 1 个月前 |
| chore(release): prepare v0.16.0 Release notes for v0.16.0 (auth host resolution alignment, PR settings nested-response fix plus --close-issue-on-merge, TTY detection, issue templates, dev-setup PATH warnings, three dead-code batches, CI contract test suite, dual-platform Python unit tests) and the version roll: VERSION, nfpm, pyproject, npm package, README, PACKAGING, and AI-GUIDE via the sync scripts. Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |
| chore: unify repository URLs to atomgit-cli/cli The same binary advertised two homes: gc version printed gitcode.com/gitcode-cli/cli while the goreleaser brew homepage and release footer use gitcode.com/atomgit-cli/cli — and the latter is the actual origin remote. Unify every repository URL to atomgit-cli/cli: version.go (text and --json url field) with its three test assertions, the RELEASE.md download URLs, the scoop manifest, the CONTRIBUTING clone command, and AGENTS.md (repo references in CI description, actions examples, and the self-testing rule; the GitHub mirror org was stale too). The Go module path (gitcode.com/gitcode-cli/cli) and the npm package coordinate (@gitcode-cli/cli) are identifiers, not URLs, and stay untouched. Co-Authored-By: Claude Code <noreply@anthropic.com> | 1 个月前 |
| fix(auth): require interactive token disclosure | 4 个月前 |
| chore(release): prepare v0.16.0 Release notes for v0.16.0 (auth host resolution alignment, PR settings nested-response fix plus --close-issue-on-merge, TTY detection, issue templates, dev-setup PATH warnings, three dead-code batches, CI contract test suite, dual-platform Python unit tests) and the version roll: VERSION, nfpm, pyproject, npm package, README, PACKAGING, and AI-GUIDE via the sync scripts. Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |
| refactor: remove deprecated in-repo skills Refs #487 | 3 个月前 |
| fix(docker): correct interactive command examples (#374 P1) | 2 个月前 |
| feat(actions): add permission setting API | 1 个月前 |
| feat(actions): add permission setting API | 1 个月前 |
| chore(release): prepare v0.16.0 Release notes for v0.16.0 (auth host resolution alignment, PR settings nested-response fix plus --close-issue-on-merge, TTY detection, issue templates, dev-setup PATH warnings, three dead-code batches, CI contract test suite, dual-platform Python unit tests) and the version roll: VERSION, nfpm, pyproject, npm package, README, PACKAGING, and AI-GUIDE via the sync scripts. Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |
| chore(release): prepare v0.16.0 Release notes for v0.16.0 (auth host resolution alignment, PR settings nested-response fix plus --close-issue-on-merge, TTY detection, issue templates, dev-setup PATH warnings, three dead-code batches, CI contract test suite, dual-platform Python unit tests) and the version roll: VERSION, nfpm, pyproject, npm package, README, PACKAGING, and AI-GUIDE via the sync scripts. Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |
| chore(release): prepare v0.16.0 Release notes for v0.16.0 (auth host resolution alignment, PR settings nested-response fix plus --close-issue-on-merge, TTY detection, issue templates, dev-setup PATH warnings, three dead-code batches, CI contract test suite, dual-platform Python unit tests) and the version roll: VERSION, nfpm, pyproject, npm package, README, PACKAGING, and AI-GUIDE via the sync scripts. Co-Authored-By: Claude Code <noreply@anthropic.com> | 2 天前 |