2026-05-05 - 2026-11-05
Overview
2 Releases published by 1 user
Published
v0.4.0
v0.4.0
Published
v0.3.2
v0.3.2
51 Pull requests merged by 2 users
Merged
#160 Removing intermediate files
Merged
#152 fix(#150): add EvalSymlinks to validateDocmapPath — close dir-symlink bypass
Merged
#158 fix(#157): add never-close constraint to spec, S9 invariant, and regression test
Merged
#155 refactor(#154): extract baseSubprocessArgs helper in main_test.go subprocess tests
Merged
#156 feat(#141): validate-docmap subcommand
Merged
#153 feat(#143): fetch doc-map config from trusted VCS ref
Merged
#151 test(#146): add TestMainSubprocess_InvalidDocMapPath and TestMainSubprocess_InvalidDocMapFile
Merged
#149 docs(#148): add SKILL.md and dev-loop-spec.md for dispatch redesign
Merged
#142 feat(#141): validate-docmap subcommand — CI hard-fail on missing docmap coverage
Merged
#140 test(#139): improve cmd/review-bot coverage from 44.6% to 49.3%
Merged
#138 feat(#137): add doc-map input for path-scoped doc injection
Merged
#131 feat: implement GitHub API methods and VCS routing (issue #130)
Merged
#129 feat(#123): add IP-level SSRF defense to Gitea client and action
Merged
#128 docs(#125): update CLI example to use --vcs-url
Merged
#126 feat(#125): rename GITEA_URL to VCS_URL with deprecated fallback
Merged
#127 feat(action): derive binary name from uname for multi-arch support (#124)
Merged
#119 fix(github): consolidate review.go and identity.go into reviews.go (#116)
Merged
#118 feat(vcs): add CommitID to ReviewRequest (#115)
Merged
#117 fix(vcs): thread CommitID through abstraction layer (#114)
Merged
#113 feat(github): add safeguards against accidental AllowInsecureHTTP use (#96)
Merged
#112 feat(gitea): pass commit_id explicitly in PostReview (#107)
Merged
#106 feat(cmd): wire --provider and --base-url flags into CLI (Phase 5)
Merged
#111 feat: reject cross-host redirects and HTTPS→HTTP downgrades (#95)
Merged
#110 feat(github): support HTTP-date format in Retry-After header
Merged
#109 feat(gitea): harden GetPullRequestDiff against unbounded diff size
Merged
#105 feat(github): implement Reviewer and Identity interfaces (#81)
Merged
#108 docs(deps): update CONVENTIONS.md allowlist for go-yaml
Merged
#104 fix(gitea): map hunk-header positions in BuildPositionToLineMap
Merged
#103 feat(github): implement FileReader interface
Merged
#102 feat(github): implement PRReader interface
Merged
#101 feat(github): implement GitHub API client foundation
Merged
#89 fix(deps): replace gopkg.in/yaml.v3 with github.com/goccy/go-yaml
Merged
#90 feat(vcs): Gitea adapter with diff-position translation (Phase 2)
Merged
#88 feat(vcs): complete Phase 1 — util.go, type cleanup, interface additions (fixes #84, #85, #86)
Merged
#83 feat(vcs): extract interfaces and types from gitea/ (Phase 1)
Merged
#77 fix(patterns): default patterns-files to empty (fetch all)
Merged
#74 fix(gitea): handle single-object response in ListContents
Merged
#72 fix(gitea): normalize "." path to empty string in ListContents
Merged
#69 feat(gitea): add retry logic for 5xx errors
Merged
#65 feat: log loaded pattern files for debugging
Merged
#67 docs: add read:user to required token scopes
Merged
#61 feat: load personas from target repo .review-bot/personas/
Merged
#58 feat: add YAML support for persona files
Merged
#59 docs: allow approved third-party packages
Merged
#54 feat: native SAP AI Core support
Merged
#55 feat(persona): add role-based review personas
Merged
#56 ci: add PR ready gate to clear self-reviewed label on push
Merged
#53 fix: skip posting review when HEAD moves during evaluation
Merged
#48 fix: retry on transient LLM response body truncation
Merged
#45 fix: repair unescaped quotes in LLM JSON responses
Merged
#44 ci: fix reviewer models — sonnet uses Anthropic, gpt uses GPT-5
56 Issues closed from 1 user
Closed
#157 Bug: dev-loop worker closed PR #156 autonomously
Closed
#143 bug: doc-map config loaded from PR branch (untrusted) — potential data exfiltration
Closed
#150 fix: validateDocmapPath — add EvalSymlinks to close directory-symlink bypass
Closed
#154 refactor: extract shared base-args helper in main_test.go subprocess tests
Closed
#145 bug: dev-loop merged PR #138 despite active REQUEST_CHANGES from security-review-bot
Closed
#144 bug: dev-loop merged PR #140 autonomously — no human review or assignment
Closed
#147 PR #140: cmd/review-bot coverage at 49.3% — does not meet ≥50% acceptance criterion
Closed
#146 PR #140: missing TestMainSubprocess_InvalidDocMapPath and TestMainSubprocess_InvalidDocMapFile tests
Closed
#148 feat: redesign dev-loop dispatch as pure shell script — no model reasoning in dispatch
Closed
#141 feat: validate-docmap subcommand — CI hard-fail if source directories lack docmap coverage
Closed
#139 test: improve cmd/review-bot coverage — doc-map validation, validateurl success path, isValidateError nil
Closed
#137 feat: add doc-map input for path-scoped doc injection
Closed
#134 PR #131: githubAPIURL() function has no unit tests
Closed
#135 PR #131: cleanEnv() does not strip VCS_TYPE or VCS_URL env vars
Closed
#133 PR #131: integration test not extended for GitHub (issue #130 acceptance criterion)
Closed
#130 feat: implement GitHub API methods for PR review
Closed
#123 security: add IP-level SSRF defense for action.yml Gitea path
Closed
#120 action: version resolution and binary download fail when running on GitHub
Closed
#125 Rename GITEA_URL env var to generic VCS_URL for multi-host support
Closed
#124 Support multi-arch binary downloads in composite action
Closed
#116 Build broken: github/reviews.go duplicates github/review.go — redeclared types and methods
Closed
#115 PR #112: vcs.ReviewRequest.CommitID field missing — issue #107's interface-level fix not implemented
Closed
#114 PR #112: gitea.Adapter.PostReview bypasses commitID — abstraction layer drops commit anchor
Closed
#96 Add safeguards against accidental AllowInsecureHTTP use in production
Closed
#107 PostReview: pass CommitID explicitly via ReviewRequest
Closed
#82 feat(cmd): wire --provider and --base-url flags into CLI (Phase 5)
Closed
#95 Reject cross-host redirects and HTTPS→HTTP downgrades entirely
Closed
#94 feat(github): support HTTP-date format in Retry-After header
Closed
#92 Harden PostReview against unbounded diff size
Closed
#81 feat(github): Reviewer + Identity client (Phase 4)
Closed
#91 Update CONVENTIONS.md allowlist: replace gopkg.in/yaml.v3 with github.com/goccy/go-yaml
Closed
#97 PR #90: @@ hunk-header positions not mapped — PostReview fails for hunk-level comments
Closed
#100 feat(github): implement FileReader interface
Closed
#99 feat(github): implement PRReader interface
Closed
#98 feat(github): implement GitHub API client foundation
Closed
#80 feat(github): PRReader + FileReader client (Phase 3)
Closed
#87 PR #58: uses gopkg.in/yaml.v3 instead of goccy/go-yaml as required by #57
Closed
#79 feat(vcs): Gitea adapter with diff-position translation (Phase 2)
Closed
#85 PR #83: review.ContentEntry and review.GiteaClient not deleted as required by #78
Closed
#86 PR #83: vcs interfaces and PullRequest type missing fields required by issue #78
Closed
#84 PR #83: vcs/util.go not delivered — GetAllFilesInPath and BuildLineToPositionMap missing
Closed
#78 feat(vcs): extract interfaces and types from gitea/ (Phase 1)
Closed
#76 Add VCS abstraction layer for GitHub support
Closed
#71 bug: patterns-files defaults to README.md instead of fetching all files
Closed
#73 bug: ListContents fails when path is a file (object vs array response)
Closed
#70 bug: patterns-files="." causes 500 error from Gitea API
Closed
#68 Add retry logic for pattern fetch API calls
Closed
#64 Log loaded pattern files for debugging
Closed
#66 Document required token scopes in README
Closed
#60 Load personas from target repo .review-bot/personas/
Closed
#57 Add YAML support for persona files
Closed
#49 feat: native SAP AI Core support (eliminate proxy dependency)
Closed
#51 Proposal: Role-based review personas
Closed
#52 Investigate stale commit reviews on PR #687
Closed
#47 LLM response body truncated: intermittent JSON parse failure
Closed
#46 JSON parser fails on unescaped quotes in LLM output
55 Issues created by 0 users
Opened
#47 LLM response body truncated: intermittent JSON parse failure
Opened
#49 feat: native SAP AI Core support (eliminate proxy dependency)
Opened
#51 Proposal: Role-based review personas
Opened
#52 Investigate stale commit reviews on PR #687
Opened
#57 Add YAML support for persona files
Opened
#60 Load personas from target repo .review-bot/personas/
Opened
#64 Log loaded pattern files for debugging
Opened
#66 Document required token scopes in README
Opened
#68 Add retry logic for pattern fetch API calls
Opened
#70 bug: patterns-files="." causes 500 error from Gitea API
Opened
#71 bug: patterns-files defaults to README.md instead of fetching all files
Opened
#73 bug: ListContents fails when path is a file (object vs array response)
Opened
#76 Add VCS abstraction layer for GitHub support
Opened
#78 feat(vcs): extract interfaces and types from gitea/ (Phase 1)
Opened
#79 feat(vcs): Gitea adapter with diff-position translation (Phase 2)
Opened
#80 feat(github): PRReader + FileReader client (Phase 3)
Opened
#81 feat(github): Reviewer + Identity client (Phase 4)
Opened
#82 feat(cmd): wire --provider and --base-url flags into CLI (Phase 5)
Opened
#84 PR #83: vcs/util.go not delivered — GetAllFilesInPath and BuildLineToPositionMap missing
Opened
#85 PR #83: review.ContentEntry and review.GiteaClient not deleted as required by #78
Opened
#86 PR #83: vcs interfaces and PullRequest type missing fields required by issue #78
Opened
#87 PR #58: uses gopkg.in/yaml.v3 instead of goccy/go-yaml as required by #57
Opened
#91 Update CONVENTIONS.md allowlist: replace gopkg.in/yaml.v3 with github.com/goccy/go-yaml
Opened
#92 Harden PostReview against unbounded diff size
Opened
#94 feat(github): support HTTP-date format in Retry-After header
Opened
#95 Reject cross-host redirects and HTTPS→HTTP downgrades entirely
Opened
#96 Add safeguards against accidental AllowInsecureHTTP use in production
Opened
#97 PR #90: @@ hunk-header positions not mapped — PostReview fails for hunk-level comments
Opened
#98 feat(github): implement GitHub API client foundation
Opened
#99 feat(github): implement PRReader interface
Opened
#100 feat(github): implement FileReader interface
Opened
#107 PostReview: pass CommitID explicitly via ReviewRequest
Opened
#114 PR #112: gitea.Adapter.PostReview bypasses commitID — abstraction layer drops commit anchor
Opened
#115 PR #112: vcs.ReviewRequest.CommitID field missing — issue #107's interface-level fix not implemented
Opened
#116 Build broken: github/reviews.go duplicates github/review.go — redeclared types and methods
Opened
#120 action: version resolution and binary download fail when running on GitHub
Opened
#123 security: add IP-level SSRF defense for action.yml Gitea path
Opened
#124 Support multi-arch binary downloads in composite action
Opened
#125 Rename GITEA_URL env var to generic VCS_URL for multi-host support
Opened
#130 feat: implement GitHub API methods for PR review
Opened
#133 PR #131: integration test not extended for GitHub (issue #130 acceptance criterion)
Opened
#134 PR #131: githubAPIURL() function has no unit tests
Opened
#135 PR #131: cleanEnv() does not strip VCS_TYPE or VCS_URL env vars
Opened
#137 feat: add doc-map input for path-scoped doc injection
Opened
#139 test: improve cmd/review-bot coverage — doc-map validation, validateurl success path, isValidateError nil
Opened
#141 feat: validate-docmap subcommand — CI hard-fail if source directories lack docmap coverage
Opened
#144 bug: dev-loop merged PR #140 autonomously — no human review or assignment
Opened
#143 bug: doc-map config loaded from PR branch (untrusted) — potential data exfiltration
Opened
#145 bug: dev-loop merged PR #138 despite active REQUEST_CHANGES from security-review-bot
Opened
#146 PR #140: missing TestMainSubprocess_InvalidDocMapPath and TestMainSubprocess_InvalidDocMapFile tests
Opened
#147 PR #140: cmd/review-bot coverage at 49.3% — does not meet ≥50% acceptance criterion
Opened
#148 feat: redesign dev-loop dispatch as pure shell script — no model reasoning in dispatch
Opened
#150 fix: validateDocmapPath — add EvalSymlinks to close directory-symlink bypass
Opened
#154 refactor: extract shared base-args helper in main_test.go subprocess tests
Opened
#157 Bug: dev-loop worker closed PR #156 autonomously