claw
f84cc3bbcf
PR Ready Gate / clear-labels (pull_request) Successful in 2s
CI / test (pull_request) Successful in 17s
CI / review (anthropic--claude-4.6-sonnet, sonnet, SONNET_REVIEW_TOKEN) (pull_request) Successful in 34s
CI / review (gpt-5, gpt, GPT_REVIEW_TOKEN) (pull_request) Successful in 1m25s
CI / review (gpt-5, security, ., rodin/security-patterns, SECURITY_REVIEW.md, SECURITY_REVIEW_TOKEN) (pull_request) Successful in 2m30s
MAJOR fixes: - gitea/ipcheck.go: replace startup panic with init()+error list pattern Hard-coded CIDRs that fail to parse now recorded in blockedCIDRParseErrors instead of panicking. TestBlockedCIDRsValid catches programming errors in CI without violating CONVENTIONS.md 'never panic' rule. - .gitea/actions/review/action.yml: re-validate SERVER_URL at start of 'Install review-bot' step to close DNS rebinding window between 'Determine version' and install-step curl calls. MINOR fixes: - gitea/client.go: add Timeout: 10*time.Second to net.Dialer per PLAN.md spec - cmd/review-bot/validateurl.go: switch isValidateError to errors.As so wrapped *validateError values are also detected - gitea/ipcheck_test.go: clarify 198.51.100.1 (RFC5737 TEST-NET-2) comment; add TestBlockedCIDRsValid to surface CIDR parse errors as test failures NIT fixes: - .gitea/actions/review/action.yml: refactor Python list comprehension in SSRF check to for-loop (avoids side-effect-only comprehension, runner compat) - gitea/export_test.go: expand comment explaining white-box test pattern (why package gitea not gitea_test, Go stdlib precedent) Remove PLAN.md (implementation complete)
19 lines
1014 B
Go
19 lines
1014 B
Go
// Package gitea — export_test.go exposes test helpers to test files in this
|
|
// package. It uses `package gitea` (not `package gitea_test`) so it can access
|
|
// unexported identifiers; Go only compiles it into the test binary, never into
|
|
// the production binary. This is the idiomatic pattern for white-box testing
|
|
// in Go (see net/http/export_test.go in the stdlib for the same approach).
|
|
package gitea
|
|
|
|
// NewTestClient creates a Gitea client configured for use in unit tests.
|
|
// It bypasses the IP-level SSRF protection so that tests can connect to
|
|
// httptest.Server instances (which listen on 127.0.0.1).
|
|
//
|
|
// Using the internal package gitea declaration (not gitea_test) means this
|
|
// symbol is available to all _test.go files in this package. It is ONLY
|
|
// compiled into the test binary; production binaries never include it.
|
|
// Production code must use NewClient, which enables the safe dialer.
|
|
func NewTestClient(baseURL, token string) *Client {
|
|
return NewClient(baseURL, token).WithUnsafeDialer()
|
|
}
|