core: extend fork-audit rule 2 to accept fix: prefix for bug/security hotfixes by Copilot · Pull Request #50 · get-flashbacks/feedBack

Copilot · 2026-08-07T01:48:22Z

PR #44's fix(security): commit touches static/app.js but the fork-audit / core-commit-labeling check only accepted core: / hook: / sync: — not the conventional-commit fix: convention natural for bug and security hotfixes. This widens Rule 2 to cover that gap.

What

.github/workflows/fork-audit.yml: Extends the subject-prefix regex from ^(core|hook|sync)(\([^)]*\))?: to also accept fix:, so fix(security): and other fix: scopes pass the check.
docs/fork-maintenance.md: Documents fix: as a valid Rule 2 prefix with a note on fix(security): conventional-commit scope notation.

After this merges to main, rebasing PR #44 picks up the updated workflow and its CI check passes.

feedpak surface

This PR does not change how the app reads/writes feedpaks (manifest keys, pack files, folder layout)

Checklist

CHANGELOG.md [Unreleased] updated (user-visible changes) — N/A, CI/policy change only
Tests added/updated for new behaviour
Commits are DCO signed off (git commit -s)

retuneSong() built the retune-progress modal via innerHTML template literals that interpolated the song title, target tuning, and the websocket's echoed filename/error text without HTML-escaping. A song title is attacker-influenced (e.g. crafted metadata in an imported Guitar Pro / MusicXML / sloppak file), and the "Convert to E Standard" library-card action (card-actions-core.js) passes song.title straight into this function — so a malicious title like `<img src=x onerror=...>` executes as stored XSS the moment the modal renders, before any network round-trip. Since the app has no auth model (single-user, all endpoints trusted-local per the constitution), script execution here means full read/write access to the library via the same-origin API. Fix: route all four interpolated values through the existing esc() helper (already imported from ./js/dom.js in this file and used elsewhere), matching the escaping discipline used by every other innerHTML template in the codebase.

VERSION isn't hand-bumped here — per this repo's CLAUDE.md it's auto-synced from feedBack-desktop's release job via repository_dispatch, not touched by feature/fix PRs. CHANGELOG.md's Unreleased section is the part PRs are expected to keep current. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018J1NvPtPQZd3cEt6aAbGzG

… hotfixes Co-authored-by: carochacs <79524656+carochacs@users.noreply.github.com>

coderabbitai · 2026-08-07T01:48:31Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 036bf266-5d60-4de9-bc67-2c86692451d1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

pullfrog

ℹ️ The regex change is correct and unblocks the fix(security): case it targets. One rough edge: the edited policy page still enumerates the old prefix set in a few sibling sections.

Reviewed changes

Fork-audit Rule 2 regex widened — .github/workflows/fork-audit.yml:43 now accepts fix:/fix(scope): prefixes for core-touching commits alongside core:/hook:/sync:.
Policy doc updated — docs/fork-maintenance.md documents fix: as a valid Rule 2 prefix with a fix(security): example.

Verified the new regex in a shell: fix: and fix(security): pass; feat:/chore:/docs: still fail. The PR's own core:-prefixed commit touches a core path (the workflow file itself), so it passes the check it modifies, and the motivating commit (2afd464 fix(security): … on the base branch) is real. Change is correct and minimal.

^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Big Pickle (free) ｜ 𝕏}

pullfrog · 2026-08-07T01:54:30Z

Addressed the single review thread on PR #50. The review noted the edited policy page still enumerated the old prefix set in sibling sections, so I aligned all four: the Enforcement section prefix list (core:/hook:/sync:/fix:), the decision tree (bug fixes labeled fix: instead of core:), Rule 3 (core:/hook:/fix:), and the git log --grep guidance (now -E '^(core|fix)(\([^)]*\))?:' so fix(security): matches). Committed as docs: (docs-only, no core prefix required), pushed to copilot/fix-core-commit-labeling as 87f263f, replied to and resolved the thread.

Task list (5/5 completed)

Checkout PR branch core: extend fork-audit rule 2 to accept fix: prefix for bug/security hotfixes #50
Fetch review comments for review 4879298442
Verify and address each comment
Quality check, test, commit
Push, reply + resolve threads, report progress

^{｜ View workflow run ｜ via Pullfrog ｜ Using Big Pickle (free) ｜ 𝕏}

Rule 2 now accepts fix:/fix(scope): for bug and security hotfixes, but the Enforcement section, decision tree, Rule 3, and the git log --grep guidance still enumerated only core:/hook:/sync: and told bug fixers to label commits core:. Update each so the page no longer contradicts Rule 2.

pullfrog · 2026-08-07T02:08:33Z

The single review thread for review #4879298442 was already fully addressed by a prior fix run and is marked resolved. Commit 87f263f (HEAD of PR #50, live on the remote) aligned all four stale enumerations the review flagged in docs/fork-maintenance.md: the Enforcement prefix list (now core:/hook:/sync:/fix:), the decision tree (bug fixes labeled fix: instead of core:), Rule 3 (core:/hook:/fix:), and the git log --grep guidance (now -E '^(core|fix)(\([^)]*\))?:' so fix(security): matches). Working tree is clean and origin/copilot/fix-core-commit-labeling matches local HEAD — no further action was required.

Task list (1/5 completed)

^{｜ View workflow run ｜ via Pullfrog ｜ Using Big Pickle (free) ｜ 𝕏}

…it-labeling # Conflicts: # CHANGELOG.md

pullfrog

✅ No new issues found.

Reviewed changes since the prior pullfrog review (87f263f):

Merged origin/main into the branch (018c8c0) — brought in PR #44 (81837ec) and the rest of main. The only conflict was CHANGELOG.md, resolved by keeping main's version; the branch's own XSS entry (33962cd) is textually identical to #44's already-on-main entry, so no content was lost.
Verified the merged branch still passes its own check — the core-commit-labeling range main..head evaluates five commits: 2afd464 matches the widened regex, 33962cd/87f263f touch only non-core paths, 2b26c47 is core:-prefixed, and the merge commit's combined diff lists no files (the resolved CHANGELOG.md equals one parent), so it is skipped.
The PR's two files (.github/workflows/fork-audit.yml, docs/fork-maintenance.md) are unchanged by the merge, so the previously-reviewed fix: widening stands as-is.

The merge is mechanical and the conflict resolution is sound. Prior feedback (the stale doc-prefix enumerations) was addressed by 87f263f.

^{｜ View workflow run ｜ Using Big Pickle (free) ｜ 𝕏}

claude and others added 3 commits August 6, 2026 04:33

core: extend fork-audit rule 2 to accept fix: prefix for bug/security…

2b26c47

… hotfixes Co-authored-by: carochacs <79524656+carochacs@users.noreply.github.com>

Copilot AI assigned Copilot and carochacs Aug 7, 2026

carochacs marked this pull request as ready for review August 7, 2026 01:49

Copilot created this pull request from a session on behalf of carochacs August 7, 2026 01:50 View session

Copilot AI requested a review from carochacs August 7, 2026 01:50

Copilot finished work on behalf of carochacs August 7, 2026 01:50

carochacs approved these changes Aug 7, 2026

View reviewed changes

pullfrog Bot reviewed Aug 7, 2026

View reviewed changes

Comment thread docs/fork-maintenance.md

coderabbitai Bot approved these changes Aug 7, 2026

View reviewed changes

Base automatically changed from claude/security-issues-jdpj26 to main August 7, 2026 03:04

Merge remote-tracking branch 'origin/main' into copilot/fix-core-comm…

018c8c0

…it-labeling # Conflicts: # CHANGELOG.md

pullfrog Bot reviewed Aug 7, 2026

View reviewed changes

carochacs merged commit 371d7a4 into main Aug 7, 2026
9 checks passed

carochacs deleted the copilot/fix-core-commit-labeling branch August 7, 2026 03:23

pullfrog Bot mentioned this pull request Aug 7, 2026

build(deps-dev): bump the npm_and_yarn group across 1 directory with 3 updates #49

Open

Navigation Menu

Uh oh!

core: extend fork-audit rule 2 to accept fix: prefix for bug/security hotfixes - #50

core: extend fork-audit rule 2 to accept fix: prefix for bug/security hotfixes#50
carochacs merged 5 commits into
mainfrom
copilot/fix-core-commit-labeling

Copilot AI commented Aug 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

Review skipped

Uh oh!

pullfrog Bot left a comment

Uh oh!

Uh oh!

pullfrog Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

pullfrog Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

pullfrog Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

feedpak surface

Checklist

Uh oh!

coderabbitai Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

pullfrog Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pullfrog Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pullfrog Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pullfrog Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Aug 7, 2026 •

edited

Loading

coderabbitai Bot commented Aug 7, 2026 •

edited

Loading

pullfrog Bot commented Aug 7, 2026 •

edited

Loading

pullfrog Bot commented Aug 7, 2026 •

edited

Loading