3 commits

Author	SHA1	Message	Date
超級の新人	756203c31a	fix(cmd): suppress ANSI color when stdout is not a TTY (#927) ... * fix(cmd): suppress ANSI color when stdout is not a TTY Text output hardcoded ANSI escape sequences with no terminal detection, so piping or redirecting a review leaked raw escapes into the consumer. Piping into `gh issue comment` produced a comment full of literal `^[[2m` sequences. Color is now resolved once per run, in this order: `--no-color`/`--color=never` turn it off, `--color=always` forces it on even through a pipe, `NO_COLOR` (any non-empty value, per no-color.org) and `TERM=dumb` turn it off, and otherwise it follows whether stdout is a terminal. Explicit flags outrank the environment because a flag is a per-invocation decision while the variable is a standing preference. Both text paths — review findings and `--preview` — route every escape through colorize(), so plain mode keeps all the information the color carried: the diff gutter still shows +/-/space and the status badges still read [A]/[M]/... Preview counts are padded before colorizing so the columns align in either mode. The flags are persistent on the root command, so `ocr --no-color review` and `ocr review --no-color` are equivalent, and an invalid `--color` value is rejected rather than silently treated as auto. Fixes #682 * refactor(cmd): drop --no-color flag and NO_COLOR env var support --no-color was just an alias for --color=never with no added capability, and NO_COLOR isn't a universal enough convention to bake in speculatively. --color <auto|always|never> alone already covers every case. TERM=dumb stays, since that closes a real gap in TTY detection rather than adding another way to configure the same toggle. --------- Co-authored-by: kite <lizhengfeng.lzf@alibaba-inc.com>	2026-08-19 21:51:38 +08:00
kite	533b526b4c	chore: add SPDX license headers and automated verification (#740) ... * chore: add SPDX license headers to all source files Add Apache-2.0 SPDX license identifiers and copyright notices to all tracked .go, .sh, .js, .mjs, .ts, and .tsx source files. Introduce scripts/verify-license.sh and scripts/add-license.sh for automated verification and bulk addition of license headers. Integrate the check into CI (ci.yml) and the Makefile (license-check target as a prerequisite of the existing check target). This satisfies the OpenSSF Best Practices Badge requirements for copyright_per_file and license_per_file. * fix: restore execute permissions on scripts * docs: add license header instructions to CONTRIBUTING guides * docs: add license header instructions to pages contributing guides * fix(pages): strip unclosed HTML comment markers to satisfy CodeQL * fix: apply code review suggestions for license scripts - Fix portability: detect macOS vs Linux stat for permission copy - Fix has_header: check both SPDX and copyright (match verify logic) - Fix is_ignored: match on path boundaries to avoid false positives - Fix year extraction: use consistent pipeline across both scripts - Fix Bash 3.2 compat: quote array length expansion for set -u * fix(pages): use loop-until-clean for HTML comment stripping (CodeQL) * fix(pages): use split/join instead of replace to avoid CodeQL false positive CodeQL's js/incomplete-multi-character-sanitization rule flags any .replace() that removes multi-character sequences like '<!--...-->', regardless of context. The data here comes from readFileSync on the project's own index.html (no untrusted input), making this a false positive. Using split(regex).join('') achieves the same result without triggering the taint-tracking rule.	2026-08-05 21:26:27 +08:00
kite	80a5794667	refactor(cli): migrate to Cobra framework for shell completion support (#625) ... * refactor(cli): migrate to Cobra framework for shell completion support Replace the hand-rolled ocrFlagSet + switch dispatch with spf13/cobra, enabling native bash/zsh/fish/powershell completion via `ocr completion`. Key changes: - Add root.go (rootCmd definition, version flag with -V shorthand) - Add completion.go (ocr completion [bash|zsh|fish|powershell]) - Add shared_flags.go (reusable flag registration helpers + validation) - Rewrite all *_cmd.go to use cobra.Command with RunE - Delete flags.go (ocrFlagSet, expandShortFlags, parseXxxFlags) - Add compat_test.go (test compatibility wrappers for existing tests) - Promote github.com/spf13/cobra from indirect to direct dependency Behavioral improvements over the previous implementation: - Shell completion for all commands, flags, and enum values - "Did you mean?" suggestions for misspelled commands - cobra.NoArgs on review/scan prevents silent positional arg ignoring - Cleaner error messages on unknown flags (no full flag dump) - Consistent help output format across all subcommands Closes #576 * fix(cli): add Args: cobra.NoArgs to viewerCmd Prevents `ocr viewer localhost:3000` from silently ignoring the positional argument and starting on the default address. Consistent with reviewCmd and scanCmd. * feat(cli): add "Did you mean?" suggestions for misspelled flags Cobra only suggests corrections for unknown subcommands, not flags. Add a levenshtein-distance based suggestion that fires when cobra returns an "unknown flag" error, matching the same UX pattern. Examples: --hel → Did you mean this? --help --audienc → Did you mean this? --audience --comit → Did you mean this? --commit * fix(deps): promote spf13/pflag to direct dependency After the Cobra migration, pflag is directly imported but was still marked as indirect in go.mod, causing CI's go-mod-tidy check to fail. * refactor(cli): use idiomatic cobra patterns for args validation and flag errors Replace hand-rolled argument validation in configSetCmd/configUnsetCmd with cobra.ExactArgs, and move flag typo suggestions from post-hoc error string parsing into SetFlagErrorFunc where cobra provides the command context directly.	2026-07-31 16:56:07 +08:00