Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 54 additions & 0 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
name: CI

on:
push:
branches: [main, dev]
pull_request:
branches: [main]
pull_request_review:
types: [submitted]

jobs:
test:
if: github.event_name != 'pull_request_review'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: dAppCore/build/actions/build/core@dev
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify non-SHA action refs across workflows.
rg -nP '^\s*-\s*uses:\s*[^@]+@(?![0-9a-fA-F]{40}$).+$' .github/workflows

Repository: dAppCore/go-html

Length of output: 398


🏁 Script executed:

cat -n .github/workflows/ci.yml

Repository: dAppCore/go-html

Length of output: 1829


Pin action refs to immutable commit SHAs.

Using @dev for reusable actions makes workflow behaviour mutable and increases supply-chain risk. This is particularly critical for line 36 in the auto-fix job, which has explicit write permissions and can modify repository state. Pin both references to full commit SHAs.

Suggested patch
       - uses: dAppCore/build/actions/build/core@dev
+      - uses: dAppCore/build/actions/build/core@<full_commit_sha>

       - uses: dAppCore/build/actions/fix@dev
+      - uses: dAppCore/build/actions/fix@<full_commit_sha>

Also applies to: 36-36

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml at line 17, The workflow is using mutable action
refs (`@dev`) which must be pinned; update both occurrences of the reusable action
reference (the step that uses dAppCore/build/actions/build/core in the normal
build job and the one in the auto-fix job) to use full immutable commit SHAs
instead of `@dev` — locate the two steps referencing
"dAppCore/build/actions/build/core@dev" and replace `@dev` with the corresponding
full commit SHA for each reference so the workflow uses pinned action versions.

with:
go-version: "1.26"
run-vet: "true"

auto-fix:
if: >
github.event_name == 'pull_request_review' &&
github.event.review.user.login == 'coderabbitai' &&
github.event.review.state == 'changes_requested'
Comment on lines +23 to +26
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Scope auto-fix and auto-merge to PRs targeting main.

Current conditions only check event/reviewer/state. Add a base-branch guard to avoid write actions on PRs targeting other branches.

Suggested patch
   auto-fix:
     if: >
       github.event_name == 'pull_request_review' &&
+      github.event.pull_request.base.ref == 'main' &&
       github.event.review.user.login == 'coderabbitai' &&
       github.event.review.state == 'changes_requested'
@@
   auto-merge:
     if: >
       github.event_name == 'pull_request_review' &&
+      github.event.pull_request.base.ref == 'main' &&
       github.event.review.user.login == 'coderabbitai' &&
       github.event.review.state == 'approved'

Also applies to: 41-44

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/ci.yml around lines 23 - 26, The CI workflow's conditional
for auto-fix/auto-merge is missing a base-branch guard; update the 'if'
expressions used (the blocks checking github.event_name,
github.event.review.user.login, github.event.review.state) to also require
github.event.pull_request.base.ref == 'main' so the actions only run for PRs
targeting main; apply this same addition to both occurrences of that 'if'
condition (the first block around the auto-fix/auto-merge steps and the second
similar block later in the file).

runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.ref }}
fetch-depth: 0
- uses: dAppCore/build/actions/fix@dev
with:
go-version: "1.26"

auto-merge:
if: >
github.event_name == 'pull_request_review' &&
github.event.review.user.login == 'coderabbitai' &&
github.event.review.state == 'approved'
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
steps:
- uses: actions/checkout@v4
- name: Merge PR
run: gh pr merge ${{ github.event.pull_request.number }} --merge --delete-branch
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5 changes: 3 additions & 2 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
dist/
.core/
.idea/
.vscode/
*.log
.core/
7 changes: 4 additions & 3 deletions CLAUDE.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Agent instructions for `go-html`. Module path: `forge.lthn.ai/core/go-html`
Agent instructions for `go-html`. Module path: `dappco.re/go/core/html`

## Commands

Expand Down Expand Up @@ -40,8 +40,9 @@ Files guarded with `//go:build !js` are excluded from WASM:

## Dependencies

- `forge.lthn.ai/core/go-i18n` (replace directive → `../go-i18n`)
- `forge.lthn.ai/core/go-inference` (indirect, via go-i18n)
- `dappco.re/go/core/i18n` (replace directive → local go-i18n)
- `forge.lthn.ai/core/go-inference` (indirect, via go-i18n; not yet migrated)
- `forge.lthn.ai/core/go-log` (indirect, via go-i18n; not yet migrated)
- Both `go-i18n` and `go-inference` must be cloned alongside this repo for builds
- Go 1.26+ required (uses `range` over integers, `iter.Seq`, `maps.Keys`, `slices.Collect`)

Expand Down
2 changes: 1 addition & 1 deletion bench_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ import (
"fmt"
"testing"

i18n "forge.lthn.ai/core/go-i18n"
i18n "dappco.re/go/core/i18n"
)

func init() {
Expand Down
4 changes: 2 additions & 2 deletions cmd/codegen/main.go
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,8 @@ import (
goio "io"
"os"

"forge.lthn.ai/core/go-html/codegen"
log "forge.lthn.ai/core/go-log"
"dappco.re/go/core/html/codegen"
log "dappco.re/go/core/log"
)

func run(r goio.Reader, w goio.Writer) error {
Expand Down
2 changes: 1 addition & 1 deletion cmd/wasm/main.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ package main
import (
"syscall/js"

html "forge.lthn.ai/core/go-html"
html "dappco.re/go/core/html"
)

// renderToString builds an HLCRF layout from JS arguments and returns HTML.
Expand Down
4 changes: 2 additions & 2 deletions cmd/wasm/register.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@ package main
import (
"encoding/json"

"forge.lthn.ai/core/go-html/codegen"
log "forge.lthn.ai/core/go-log"
"dappco.re/go/core/html/codegen"
log "dappco.re/go/core/log"
)

// buildComponentJS takes a JSON slot map and returns the WC bundle JS string.
Expand Down
2 changes: 1 addition & 1 deletion cmd/wasm/size_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ import (
"path/filepath"
"testing"

coreio "forge.lthn.ai/core/go-io"
coreio "dappco.re/go/core/io"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
Expand Down
2 changes: 1 addition & 1 deletion codegen/codegen.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ import (
"strings"
"text/template"

log "forge.lthn.ai/core/go-log"
log "dappco.re/go/core/log"
)

// wcTemplate is the Web Component class template.
Expand Down
2 changes: 1 addition & 1 deletion context.go
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
package html

import i18n "forge.lthn.ai/core/go-i18n"
import i18n "dappco.re/go/core/i18n"

// Context carries rendering state through the node tree.
type Context struct {
Expand Down
2 changes: 1 addition & 1 deletion edge_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ import (
"strings"
"testing"

i18n "forge.lthn.ai/core/go-i18n"
i18n "dappco.re/go/core/i18n"
)

// --- Unicode / RTL edge cases ---
Expand Down
20 changes: 14 additions & 6 deletions go.mod
Original file line number Diff line number Diff line change
@@ -1,19 +1,27 @@
module forge.lthn.ai/core/go-html
module dappco.re/go/core/html

go 1.26.0

require (
forge.lthn.ai/core/go-i18n v0.1.6
forge.lthn.ai/core/go-io v0.1.2
forge.lthn.ai/core/go-log v0.0.4
dappco.re/go/core/i18n v0.1.8
dappco.re/go/core/io v0.2.0
dappco.re/go/core/log v0.1.0
github.com/stretchr/testify v1.11.1
)

require (
forge.lthn.ai/core/go v0.3.1 // indirect
forge.lthn.ai/core/go-inference v0.1.5 // indirect
dappco.re/go/core v0.5.0 // indirect
forge.lthn.ai/core/go-inference v0.1.4 // indirect
forge.lthn.ai/core/go-log v0.0.4 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
golang.org/x/text v0.35.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)

replace (
dappco.re/go/core => ../../../../core/go
dappco.re/go/core/i18n => ../../../../core/go-i18n
dappco.re/go/core/io => ../../../../core/go-io
dappco.re/go/core/log => ../../../../core/go-log
)
Comment on lines +22 to +27
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Replace directives break CI builds.

The pipeline failure indicates that the local paths in these replace directives (e.g., ../../../../core/go) do not exist in the CI environment. This causes go mod download to fail.

Consider one of the following approaches:

  1. Remove replace directives before merging to main and ensure the dappco.re/go/core/* modules are published/accessible.
  2. Update the CI workflow to clone the sibling repositories to the expected relative paths before running go mod download.
  3. Use a go.mod.local pattern where replace directives are kept in a separate file for local development only.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@go.mod` around lines 22 - 27, The CI fails because the replace directives
block (replace (...) containing dappco.re/go/core => ../../../../core/go and the
related dappco.re/go/core/i18n, /io, /log entries) points to local relative
paths that don't exist in the runner; either remove these replace directives
before merging so the published dappco.re/go/core modules are used, or update CI
to checkout the sibling repos into the same relative paths before running go mod
download, or move these local replaces into a separate local-only file (e.g.,
go.mod.local) and ensure CI uses the canonical go.mod with no local replaces.

10 changes: 2 additions & 8 deletions go.sum
Original file line number Diff line number Diff line change
@@ -1,11 +1,5 @@
forge.lthn.ai/core/go v0.3.1 h1:5FMTsUhLcxSr07F9q3uG0Goy4zq4eLivoqi8shSY4UM=
forge.lthn.ai/core/go v0.3.1/go.mod h1:gE6c8h+PJ2287qNhVUJ5SOe1kopEwHEquvinstpuyJc=
forge.lthn.ai/core/go-i18n v0.1.6 h1:Z9h6sEZsgJmWlkkq3ZPZyfgWipeeqN5lDCpzltpamHU=
forge.lthn.ai/core/go-i18n v0.1.6/go.mod h1:C6CbwdN7sejTx/lbutBPrxm77b8paMHBO6uHVLHOdqQ=
forge.lthn.ai/core/go-inference v0.1.5 h1:Az/Euv1DusJQJz/Eca0Ey7sVXQkFLPHW0TBrs9g+Qwg=
forge.lthn.ai/core/go-inference v0.1.5/go.mod h1:jfWz+IJX55wAH98+ic6FEqqGB6/P31CHlg7VY7pxREw=
forge.lthn.ai/core/go-io v0.1.2 h1:q8hj2jtOFqAgHlBr5wsUAOXtaFkxy9gqGrQT/il0WYA=
forge.lthn.ai/core/go-io v0.1.2/go.mod h1:PbNKW1Q25ywSOoQXeGdQHbV5aiIrTXvHIQ5uhplA//g=
forge.lthn.ai/core/go-inference v0.1.4 h1:fuAgWbqsEDajHniqAKyvHYbRcBrkGEiGSqR2pfTMRY0=
forge.lthn.ai/core/go-inference v0.1.4/go.mod h1:jfWz+IJX55wAH98+ic6FEqqGB6/P31CHlg7VY7pxREw=
forge.lthn.ai/core/go-log v0.0.4 h1:KTuCEPgFmuM8KJfnyQ8vPOU1Jg654W74h8IJvfQMfv0=
forge.lthn.ai/core/go-log v0.0.4/go.mod h1:r14MXKOD3LF/sI8XUJQhRk/SZHBE7jAFVuCfgkXoZPw=
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
Expand Down
2 changes: 1 addition & 1 deletion integration_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ package html
import (
"testing"

i18n "forge.lthn.ai/core/go-i18n"
i18n "dappco.re/go/core/i18n"
)

func TestIntegration_RenderThenReverse(t *testing.T) {
Expand Down
2 changes: 1 addition & 1 deletion node.go
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ import (
"slices"
"strings"

i18n "forge.lthn.ai/core/go-i18n"
i18n "dappco.re/go/core/i18n"
)

// Node is anything renderable.
Expand Down
2 changes: 1 addition & 1 deletion node_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ import (
"strings"
"testing"

i18n "forge.lthn.ai/core/go-i18n"
i18n "dappco.re/go/core/i18n"
)

func TestRawNode_Render(t *testing.T) {
Expand Down
2 changes: 1 addition & 1 deletion pipeline.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ package html
import (
"strings"

"forge.lthn.ai/core/go-i18n/reversal"
"dappco.re/go/core/i18n/reversal"
)

// StripTags removes HTML tags from rendered output, returning plain text.
Expand Down
2 changes: 1 addition & 1 deletion pipeline_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ package html
import (
"testing"

i18n "forge.lthn.ai/core/go-i18n"
i18n "dappco.re/go/core/i18n"
)

func TestStripTags_Simple(t *testing.T) {
Expand Down
2 changes: 1 addition & 1 deletion render_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ import (
"strings"
"testing"

i18n "forge.lthn.ai/core/go-i18n"
i18n "dappco.re/go/core/i18n"
)

func TestRender_FullPage(t *testing.T) {
Expand Down
Loading