giovannino/forgejo-mcp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
forgejo-mcp/openspec/changes/forgejo-action-code-review/spikes
History
Exact
Christoph Görn 48809bd3a5
 docs: 📝 battle-test forgejo-action-code-review, resolve C4 spike 
Adversarial review surfaced 9 critiques: 7 patched, 1 resolved by spike,
1 deferred. Most damaging: --comment/--dry-run flag inversion and
fabricated dedup SHA-trailer mechanism — both indicated the change was
written against the dep change's design rather than the shipped skill
artifact.

Artifacts:
- new design.md with 12 decisions (D2 no-PR-head-checkout, D6 dedup,
  D7 ephemeral token, D9 dist split, D10 failure matrix, D11 skill
  invocation prompt, D12 --allowedTools whitelist) and Risks
- new battle-test.md with critique inventory, dispositions, patches
- proposal.md: corrected cost range, flag, --allowedTools detail
- spec.md: 9 patches — split copy-paste vs uses: paths, no PR-head
  checkout, dedup contract, allowed-tools restriction, max_turns soft
  cap, PR# pass requirement

C4 spike (2026-05-13) validated D2+D7 on Codeberg Forgejo v11.x.
Ephemeral GITEA_TOKEN + permissions: pull-requests: write permits
create_pull_review on fork PR; pull_request_target executes BASE
workflow file (display label pull_request is cosmetic). Spike
artifacts retained for reproducibility.

C5 spike (cross-repo workflow_call) scaffolded but deferred; tracked
in forgejo-mcp-33k. Cleanup of Codeberg test repos tracked in
forgejo-mcp-p0y.
2026-05-13 08:34:17 +02:00
..
c4-ephemeral-token-fork-pr docs: 📝 battle-test forgejo-action-code-review, resolve C4 spike 2026-05-13 08:34:17 +02:00
c5-cross-repo-workflow-call docs: 📝 battle-test forgejo-action-code-review, resolve C4 spike 2026-05-13 08:34:17 +02:00
README.md docs: 📝 battle-test forgejo-action-code-review, resolve C4 spike 2026-05-13 08:34:17 +02:00

README.md

Feasibility spikes for forgejo-action-code-review

Battle-test 2026-05-12 surfaced two runtime questions about Forgejo behavior that no amount of documentation can answer. Each spike is short (~30 min), stubbed (no Claude / Anthropic spend), and produces a clear yes/no/partial result that drives a specific design decision.

Spike Question Drives decision
C4 Does ${{ secrets.GITEA_TOKEN }} with permissions: pull-requests: write honor create_pull_review on a fork PR? design.md D7 default token choice
C5 Does Forgejo support cross-repo workflow_call with uses: <owner>/<repo>/...yml@<tag>, including secrets: inherit and event context? design.md D9 distribution path

Execution order

Run C4 and C5 in parallel — they share no state. Each spike has its own README with method, recorded outcomes, and time budget.

Cleanup checklist

After both spikes finish, delete the test repos, forks, and tags so we do not leave junk on Codeberg:

  • C4: goern/c4-spike-target and the fork (under a different owner)
  • C5: goern/c5-spike-lib, goern/c5-spike-consumer, and the v0.0.1 tag