Conversation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Make the repo a portable shared-actions platform: shrink each .github/actions/<name>/src to a thin GitHub Actions adapter and move all reusable logic into packages/core (portable) and a new packages/github-actions-runtime (the @actions/core-bound runtime). - Replace the factory with singleton statics on OctokitGitHubService: getInstance (cached, throws on token mismatch) / newInstance / resetInstance. - Move input validation, Raw/Validated types, validated->request run seams, and parseRepoRef into packages/core; add shared ActionContext. - New @gforce/github-actions-runtime: ActionsLogger, readRepoFromEnvironment, and the common runGitHubAction loop (read->validate->context->execute->write). - Reduce each action to index/main/inputReader/outputWriter; drop @octokit/rest from action deps; main.ts declares a GitHubActionDefinition and delegates. - Make CI actionlint strict (no continue-on-error). - Fix lint-staged dist re-stage pathspec (:(glob) magic pathspec). - Tests for the singleton, parseRepoRef, validators, run seams, and runGitHubAction; rebuild committed dist bundles. npm run all passes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…rge action entrypoints Decompose the monolithic GitHubService into one service per domain, each its own singleton sharing a single authenticated client, behind a composing facade; and collapse each action's index.ts/main.ts into a single guarded entrypoint. github-service/: - client/GitHubClient: owns the one Octokit (getInstance/newInstance/resetInstance). - branch/BranchService + OctokitBranchService and pull-request/PullRequestService + OctokitPullRequestService: per-domain ports + impls, each with singleton statics that wrap the shared GitHubClient. - github/GitHubService facade = BranchService & PullRequestService; OctokitGitHubService composes the sub-services and delegates, so use cases keep depending on one object (unchanged interface = contained blast radius). - action/ActionsService stub (workflow dispatch) mirrors the git/sfdx stubs. - client/octokitSupport: shared runOctokit/toGitHubApiError error wrapping. - Remove the old flat githubService.ts / octokitGitHubService.ts. actions: - Merge index.ts + main.ts into a single index.ts (GitHubActionDefinition + run), self-invoking only under a require.main === module guard so tests can import it. Split tests into gitHubClient / octokitBranchService / octokitPullRequestService / octokitGitHubService (facade) suites; update fakes; rebuild dist bundles. Docs updated. npm run all passes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Merge each domain's interface + single Octokit implementation into one file, cutting file sprawl and keeping each domain's port and adapter side by side: - branch/branchService.ts (BranchService + OctokitBranchService) - pull-request/pullRequestService.ts (PullRequestService + OctokitPullRequestService) - github/gitHubService.ts (GitHubService facade + OctokitGitHubService) Behavior, class names, singleton semantics, and the shared GitHubClient are unchanged. Update index.ts exports, facade imports, and test import paths; the merged files now carry implementations so jest coverage no longer excludes them (only the interface-only ActionsService stub stays excluded). Docs: architecture.md service table reflects port+impl-per-file; authoring guide gains a copy/paste action index.ts skeleton and an "Extending a GitHub service domain" template for AI-assisted authoring, plus a least-privilege reminder. npm run all passes (129 tests, core >=90% coverage); dist bundles rebuilt. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Add required-permissions comments to sync-branches, create-release-pr,
and get-aws-secret action.yml files
- Clarify in README/CLAUDE.md that get-aws-secret exposes secret fields as
env vars (reference via ${{ env.FIELD }}, not step outputs) and needs
id-token: write + contents: read
- Test renderReleaseBody: repeated tokens replaced, unknown tokens left literal
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… TS review) Install github-actions-docs, requesting/receiving-code-review, and a TypeScript code-review skill under .agents/skills (symlinked into .claude/skills), and document them in CLAUDE.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… and docs The org was renamed; the old gforceinnovation name 404s and only a repo redirect keeps existing callers working. Referencing the canonical name removes the risk of the abandoned name being re-registered and hijacking action resolution. Reference snippets now point at @v1 instead of @main. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Pin every third-party action to a full commit SHA with a # vX.Y.Z
comment (latest release within the currently-used major, so behavior
is unchanged); normalize mixed checkout/setup-node versions to v5
- Pin the actionlint download in CI to v1.7.12 instead of main
- Move ${{ inputs.* }} / step outputs out of run: scripts into env:
(script-injection hardening) in salesforce-code-analyzer, test-simple
and sf-jwt-login
- Fix required:true inputs that carry defaults (now required:false)
- Add dependabot.yml (github-actions + npm, weekly, grouped)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…hardening Audit: make shared actions repo visible and consumption-ready
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.