48809bd3a5Adversarial review surfaced 9 critiques: 7 patched, 1 resolved by spike, 1 deferred. Most damaging: --comment/--dry-run flag inversion and fabricated dedup SHA-trailer mechanism — both indicated the change was written against the dep change's design rather than the shipped skill artifact. Artifacts: - new design.md with 12 decisions (D2 no-PR-head-checkout, D6 dedup, D7 ephemeral token, D9 dist split, D10 failure matrix, D11 skill invocation prompt, D12 --allowedTools whitelist) and Risks - new battle-test.md with critique inventory, dispositions, patches - proposal.md: corrected cost range, flag, --allowedTools detail - spec.md: 9 patches — split copy-paste vs uses: paths, no PR-head checkout, dedup contract, allowed-tools restriction, max_turns soft cap, PR# pass requirement C4 spike (2026-05-13) validated D2+D7 on Codeberg Forgejo v11.x. Ephemeral GITEA_TOKEN + permissions: pull-requests: write permits create_pull_review on fork PR; pull_request_target executes BASE workflow file (display label pull_request is cosmetic). Spike artifacts retained for reproducibility. C5 spike (cross-repo workflow_call) scaffolded but deferred; tracked in forgejo-mcp-33k. Cleanup of Codeberg test repos tracked in forgejo-mcp-p0y.
24 lines
1.2 KiB
Markdown
24 lines
1.2 KiB
Markdown
# Feasibility spikes for forgejo-action-code-review
|
|
|
|
Battle-test 2026-05-12 surfaced two runtime questions about Forgejo
|
|
behavior that no amount of documentation can answer. Each spike is short
|
|
(~30 min), stubbed (no Claude / Anthropic spend), and produces a clear
|
|
yes/no/partial result that drives a specific design decision.
|
|
|
|
| Spike | Question | Drives decision |
|
|
|-------|----------|-----------------|
|
|
| [C4](./c4-ephemeral-token-fork-pr/) | Does `${{ secrets.GITEA_TOKEN }}` with `permissions: pull-requests: write` honor `create_pull_review` on a **fork PR**? | design.md D7 default token choice |
|
|
| [C5](./c5-cross-repo-workflow-call/) | Does Forgejo support cross-repo `workflow_call` with `uses: <owner>/<repo>/...yml@<tag>`, including `secrets: inherit` and event context? | design.md D9 distribution path |
|
|
|
|
## Execution order
|
|
|
|
Run C4 and C5 in parallel — they share no state. Each spike has its own
|
|
README with method, recorded outcomes, and time budget.
|
|
|
|
## Cleanup checklist
|
|
|
|
After both spikes finish, delete the test repos, forks, and tags so we
|
|
do not leave junk on Codeberg:
|
|
|
|
- C4: `goern/c4-spike-target` and the fork (under a different owner)
|
|
- C5: `goern/c5-spike-lib`, `goern/c5-spike-consumer`, and the `v0.0.1` tag
|