Plan: Add safeguards against accidental AllowInsecureHTTP use in production
Problem
AllowInsecureHTTP() is a client option that permits sending credentials over HTTP. It's currently a…
Plan: PostReview — pass CommitID explicitly
Problem
gitea.Client.PostReview() does not include a commit_id field in the review payload. The review is not explicitly anchored to the…
Inline Finding Acknowledgments
All inline review findings have been resolved and threads marked as resolved. Summary of resolutions:
From review 3158 (sonnet):
- 18929 [MINOR]…
Self-Review: PR #106
Self-review against 91fba770d9e07d7fe5b76ba634b59d073645d8e4
Phase 1: Independent Findings
None — diff looks clean.
The refactor correctly replaces direct…
Self-Review: PR #111
Self-review against 7de6fdd9ec7db7441bc1bbd58dafabc6a4ad4aad
Phase 1: Independent Findings
None — diff looks clean. The defaultCheckRedirect implementation is…
Fix Plan against 5252143a33c634301efea27789016366d3548853:
Root Cause
Commit 5252143 changed the --gitea-url backward-compatible alias from:
flag.StringVar(vcsURL, "gitea-url",…
Verified: Go's url.Parse normalizes schemes to lowercase. Tested with Go 1.26.2:
Input: "HTTP://example.com" -> Parsed scheme: "http"
Input: "HTTPS://example.com" -> Parsed scheme:…
Acknowledged — I've added cross-reference comments pointing to the sibling implementation in both files. An internal/ package would add structural overhead for a single function (~25 lines), so…
Fix Plan against 1e0959b077bd0b06807ea984ba17dd137b8023f9:
Findings & Actions
Fix Plan against ac6d34f5bd09cb340db87acee6f34c1c2c504f53:
#19639 [MINOR] cmd/review-bot/main.go:87 — --gitea-url alias ordering dependency
Decision: FIX
The reviewer is correct…