fix: address PR governance and review feedback GIT-869c63k1e

Add Sonar auth/org support, GH token for gh api, pagination safeguards, doc naming alignment, and Sonar issue fixes.

AI-Agent: Codex/0.92.0
AI-Model: gpt-5.3-codex
AI-Gotcha: address PR governance and review feedback GIT-869c63k1e. Add Sonar auth/org support, GH token for gh api, pagination safeguards, doc naming alignment, and Sonar issue fixes.
AI-Confidence: medium
AI-Tags: infrastructure, services, tests, unit
AI-Lifecycle: project
AI-Memory-Id: bf652dba
AI-Source: heuristic

Author: TonyCasey

.github/workflows/pr-governance.yml

@@ -16,20 +16,36 @@ jobs:
       - name: Enforce Sonar quality gate and new issues policy
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
-          SONAR_PROJECT_KEY: ${{ github.repository_owner }}_${{ github.event.repository.name }}
+          SONAR_ORGANIZATION: ${{ vars.SONAR_ORGANIZATION || github.repository_owner }}
+          SONAR_PROJECT_KEY: ${{ vars.SONAR_PROJECT_KEY || replace(github.repository, '/', '_') }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_MAX_POLL_ITERATIONS: "30"
+          SONAR_POLL_INTERVAL_SECONDS: "10"
         run: |
           set -euo pipefail
 
+          MAX_POLL_ITERATIONS="${SONAR_MAX_POLL_ITERATIONS:-30}"
+          POLL_INTERVAL_SECONDS="${SONAR_POLL_INTERVAL_SECONDS:-10}"
+          SONAR_AUTH_ARGS=()
+          if [[ -n "${SONAR_TOKEN:-}" ]]; then
+            SONAR_AUTH_ARGS=(-u "${SONAR_TOKEN}:")
+          fi
+
           quality_status=""
-          for _ in {1..30}; do
-            response="$(curl -sS "https://sonarcloud.io/api/project_pull_requests/list?project=${SONAR_PROJECT_KEY}")"
+          attempt=1
+          while (( attempt <= MAX_POLL_ITERATIONS )); do
+            response="$(
+              curl -sS "${SONAR_AUTH_ARGS[@]}" \
+                "https://sonarcloud.io/api/project_pull_requests/list?organization=${SONAR_ORGANIZATION}&project=${SONAR_PROJECT_KEY}"
+            )"
             quality_status="$(jq -r --arg pr "${PR_NUMBER}" '.pullRequests[]? | select(.key == $pr) | .status.qualityGateStatus' <<<"$response")"
 
             if [[ -n "$quality_status" && "$quality_status" != "NONE" ]]; then
               break
             fi
 
-            sleep 10
+            sleep "${POLL_INTERVAL_SECONDS}"
+            attempt=$((attempt + 1))
           done
 
           if [[ -z "$quality_status" || "$quality_status" == "NONE" ]]; then
@@ -42,7 +58,10 @@ jobs:
             exit 1
           fi
 
-          issues_response="$(curl -sS "https://sonarcloud.io/api/issues/search?componentKeys=${SONAR_PROJECT_KEY}&pullRequest=${PR_NUMBER}&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true&ps=1")"
+          issues_response="$(
+            curl -sS "${SONAR_AUTH_ARGS[@]}" \
+              "https://sonarcloud.io/api/issues/search?organization=${SONAR_ORGANIZATION}&componentKeys=${SONAR_PROJECT_KEY}&pullRequest=${PR_NUMBER}&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true&ps=1"
+          )"
           new_issues="$(jq -r '.total // 0' <<<"$issues_response")"
 
           if [[ "$new_issues" != "0" ]]; then
@@ -57,6 +76,7 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REPO_OWNER: ${{ github.repository_owner }}
           REPO_NAME: ${{ github.event.repository.name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
 
@@ -66,11 +86,17 @@ jobs:
               pullRequest(number:$number) {
                 author { login }
                 reviewThreads(first:100) {
+                  pageInfo {
+                    hasNextPage
+                  }
                   nodes {
                     id
                     isResolved
                     isOutdated
                     comments(first:100) {
+                      pageInfo {
+                        hasNextPage
+                      }
                       nodes {
                         author { login }
                       }
@@ -84,6 +110,17 @@ jobs:
           response="$(gh api graphql -f query="$query" -F owner="$REPO_OWNER" -F repo="$REPO_NAME" -F number="$PR_NUMBER")"
           pr_author="$(jq -r '.data.repository.pullRequest.author.login' <<<"$response")"
 
+          has_more_threads="$(jq -r '.data.repository.pullRequest.reviewThreads.pageInfo.hasNextPage' <<<"$response")"
+          has_more_comments="$(jq -r '
+            .data.repository.pullRequest.reviewThreads.nodes
+            | any(.comments.pageInfo.hasNextPage == true)
+          ' <<<"$response")"
+
+          if [[ "$has_more_threads" == "true" || "$has_more_comments" == "true" ]]; then
+            echo "Review thread pagination limit reached; increase pagination handling before enforcing this check." >&2
+            exit 1
+          fi
+
           unresolved_count="$(jq -r '
             .data.repository.pullRequest.reviewThreads.nodes
             | map(select(.isOutdated | not))

CLAUDE.md

@@ -118,7 +118,7 @@ Rules are automatically loaded as context. See `.claude/rules/`:
 
 ## Git Workflow
 
-- Branch per ClickUp task, named with task ID (e.g. `GIT-123abc`)
+- Branch per ClickUp task, named using `codex/GIT-<taskId>_<taskName>` (e.g. `codex/GIT-123abc_fix-mcp-auth`)
 - Use the SKILL .claude/skills/github/SKILL.md for interacting with GitHub
 - PR workflow use the skill .claude/skills/pr/SKILL.md
   - Create the PR

src/infrastructure/services/AgentResolver.ts

@@ -17,7 +17,9 @@ import { resolveAgent, resolveModel } from '../detect-agent';
  */
 export class AgentResolver implements IAgentResolver {
   /** Cached runtime data to avoid repeated file reads. */
-  private cachedRuntimeData: IRuntimeData | undefined | null = null;
+  private cachedRuntimeData: IRuntimeData | undefined;
+  /** Tracks whether runtime data was read from disk. */
+  private runtimeDataLoaded = false;
 
   constructor(
     private readonly runtimeService?: IRuntimeService,
@@ -50,9 +52,9 @@ export class AgentResolver implements IAgentResolver {
    * Get cached runtime data, reading from file only once per instance.
    */
   private getRuntimeData(): IRuntimeData | undefined {
-    // null = not yet read, undefined = read but no data
-    if (this.cachedRuntimeData === null) {
-      this.cachedRuntimeData = this.runtimeService?.read(this.cwd);
+    if (!this.runtimeDataLoaded) {
+      this.cachedRuntimeData ??= this.runtimeService?.read(this.cwd);
+      this.runtimeDataLoaded = true;
     }
     return this.cachedRuntimeData;
   }

tests/unit/infrastructure/services/RuntimeService.test.ts

@@ -6,35 +6,35 @@ import { tmpdir } from 'node:os';
 import { RuntimeService } from '../../../../src/infrastructure/services/RuntimeService';
 import type { IRuntimeData } from '../../../../src/domain/interfaces/IRuntimeService';
 
+function createRuntimeData(overrides?: Partial<IRuntimeData>): IRuntimeData {
+  return {
+    sessionId: 'test-session-123',
+    agent: 'Claude-Code/2.1.0',
+    model: 'claude-opus-4-5-20251101',
+    timestamp: new Date().toISOString(),
+    source: 'env:CLAUDECODE',
+    ...overrides,
+  };
+}
+
+function withTestDir(run: (testDir: string) => void): void {
+  const testDir = mkdtempSync(join(tmpdir(), 'git-mem-runtime-test-'));
+  try {
+    run(testDir);
+  } finally {
+    if (existsSync(testDir)) {
+      rmSync(testDir, { recursive: true, force: true });
+    }
+  }
+}
+
 describe('RuntimeService', () => {
   let service: RuntimeService;
 
   before(() => {
     service = new RuntimeService();
   });
 
-  function createRuntimeData(overrides?: Partial<IRuntimeData>): IRuntimeData {
-    return {
-      sessionId: 'test-session-123',
-      agent: 'Claude-Code/2.1.0',
-      model: 'claude-opus-4-5-20251101',
-      timestamp: new Date().toISOString(),
-      source: 'env:CLAUDECODE',
-      ...overrides,
-    };
-  }
-
-  function withTestDir(run: (testDir: string) => void): void {
-    const testDir = mkdtempSync(join(tmpdir(), 'git-mem-runtime-test-'));
-    try {
-      run(testDir);
-    } finally {
-      if (existsSync(testDir)) {
-        rmSync(testDir, { recursive: true, force: true });
-      }
-    }
-  }
-
   describe('activate', () => {
     it('should create runtime.json with correct content', () => {
       withTestDir((testDir) => {