mirror of
https://github.com/alibaba/open-code-review.git
synced 2026-09-12 11:01:53 +00:00
a3d6cf8d0e
* chore(claude): drop duplicate local /open-code-review command The repo-local .claude/commands/open-code-review.md duplicated the canonical plugin prompt at plugins/open-code-review/claude-code/commands/review.md verbatim, adding another copy to keep in sync. Docs already point users at the plugin command file, so remove the redundant local copy. * ci: add plugin distribution contract guardrails Two blocking checks over the plugin/skill distribution surface, which had no automated verification at all. links: the docs and READMEs embed 146 in-repo path links across 53 files (raw.githubusercontent /main/ curl commands and blob|tree/main links). Nothing verified the paths still existed, so moving a referenced file turned every link into a 404 that only readers hit. A missing path now fails the build; a blob/tree kind mismatch only warns, since GitHub redirects between the two views. The scan fails closed below a corpus floor so a broken walk cannot masquerade as a pass, and reports any documentation file it had to skip instead of passing over it in silence. manifests: every path declared by a plugin or marketplace manifest must resolve to a real, non-empty target, and every SKILL.md and command prompt must carry the frontmatter its loader requires (a skill's name must equal its directory, since that is how loaders address it). Without this a rename yields a plugin that installs cleanly and exposes nothing. The Cursor manifest resolves `../skills/` from its manifest directory while its two siblings resolve from the plugin root. That asymmetry could not be verified against Cursor's published spec, so the declaration carries an explicit unverified-base warning rather than being silently certified: if Cursor resolves from the plugin root, `../skills/` points at a `plugins/skills` directory that does not exist. Unit tests run against temp fixtures, never the real work tree: pointing them at the repo would mean a stale link anywhere fails the test step with a stack trace before the annotation-producing steps run, and would also fail the unrelated Action Contract workflow, which runs the same npm script. * fix(ci): escape all regex metacharacters in repo slug CodeQL flagged js/incomplete-sanitization (high) on the slug escape in repoLinkPattern: it escaped `/` but not `\`, so an input backslash could pair with a following replacement. The slug is a hardcoded constant with no metacharacters, making it unexploitable today, but the partial escape is wrong as written and blocks the CodeQL gate. Escape the full regex metacharacter set with backslash first in the class. The generated pattern source is byte-identical for the current slug, and the links/manifests checks still resolve all 146 links. |
||
|---|---|---|
| .. | ||
| action-contract.test.js | ||
| check-plugin-contract.js | ||
| check-plugin-contract.test.js | ||
| check-translation-sync.js | ||
| check-translation-sync.test.js | ||
| post-review-comments.js | ||
| post-review-comments.test.js | ||