tti/tti-ux
Watch
31
1
Fork
You've already forked tti-ux
 0
Code Issues 1 Pull requests 14 Projects Releases Packages 1 Wiki Activity Actions

chore(ai-review): no AI review on the org-wide seeders' own pull requests #64

Open
A-Guevara wants to merge 1 commit from chore/ai-review-20261004 into main
pull from: chore/ai-review-20261004
merge into: tti:main
Conversation 1 Commits 1 Files changed 1 +7
A-Guevara commented 2026-10-04 16:14:36 +00:00
Owner
Copy link

This re-seeds the canonical ai/ai-review.yml from nis/forgejo-stack. The AI review no longer runs on pull requests from the org-wide seeders, whose head branches start with chore/h2-baseline-security or chore/ai-review-: a re-seed opens the same vendored bytes in about 29 repos at once, and each one queued a review of an identical diff on the one shared Linux runner. Every other pull request is reviewed as before. Pull requests run the workflow on their own head, so this PR already uses the new file; it reaches every other pull request once it merges. Advisory only, never a merge gate.

This re-seeds the canonical ai/ai-review.yml from nis/forgejo-stack. The AI review no longer runs on pull requests from the org-wide seeders, whose head branches start with chore/h2-baseline-security or chore/ai-review-: a re-seed opens the same vendored bytes in about 29 repos at once, and each one queued a review of an identical diff on the one shared Linux runner. Every other pull request is reviewed as before. Pull requests run the workflow on their own head, so this PR already uses the new file; it reaches every other pull request once it merges. Advisory only, never a merge gate.
chore(ai-review): no AI review on the org-wide seeders' own pull requests
Some checks failed
ai-review / review (pull_request) Has been skipped
Details
scan / trivy-fs (pull_request) Failing after 1m40s
Details
baseline-security / baseline (pull_request) Failing after 2m36s
Details
scan / trivy-fs (push) Failing after 1m25s
Details
baseline-security / baseline (push) Failing after 1m49s
Details
17ac66ba4c
forgejo-actions commented 2026-10-04 16:16:40 +00:00
Copy link

🔧 Security-gate fix map

The gate failed on these dependency findings — fastest path to green for each:

finding package installed → fixed do this
CVE-2026-63671 (HIGH) @nuxtjs/mdc 0.21.1 → 0.22.1 merge #59 — fix(security): @nuxtjs/mdc ^0.22.2 (CVE-2026-63671) — hold f
GHSA-j95f-988m-3j2f (HIGH) @tiptap/core 3.28.0 → 3.30.5 no fix PR yet — npm update core --package-lock-only
CVE-2026-102276 (HIGH) brace-expansion 5.0.9 → 5.0.10, 3.0.7, 2.1.5, 1.1.19 merge #62 — chore(deps): update dependency brace-expansion to v5.0.12 [s
CVE-2026-102278 (HIGH) brace-expansion 5.0.9 → 5.0.11, 3.0.8, 2.1.6, 1.1.20 merge #62 — chore(deps): update dependency brace-expansion to v5.0.12 [s
CVE-2026-93687 (HIGH) braces 3.0.3 → ? no fix PR yet — npm update braces --package-lock-only
CVE-2026-92708 (HIGH) devalue 5.8.2 → 5.9.3 no fix PR yet — npm update devalue --package-lock-only
GHSA-mcm9-63f2-9j32 (HIGH) devalue 5.8.2 → 5.9.3 no fix PR yet — npm update devalue --package-lock-only
GHSA-r9w8-h9r3-54w4 (HIGH) devalue 5.8.2 → 5.9.3 no fix PR yet — npm update devalue --package-lock-only
GHSA-x5rw-q4pp-hg5g (HIGH) devalue 5.8.2 → 5.9.3 no fix PR yet — npm update devalue --package-lock-only
CVE-2026-84375 (HIGH) js-yaml 4.3.1 → 4.3.2, 3.15.2 no fix PR yet — npm update js-yaml --package-lock-only
CVE-2026-85393 (HIGH) node-forge 1.4.0 → ? no fix PR yet — npm update node-forge --package-lock-only
GHSA-rgj7-g3m4-5g8c (HIGH) sharp 0.35.3 → 0.35.4 no fix PR yet — npm update sharp --package-lock-only
CVE-2026-84370 (HIGH) svgo 4.0.2 → 2.8.4, 3.3.5, 4.1.0 no fix PR yet — npm update svgo --package-lock-only
CVE-2026-19534 (HIGH) undici 8.10.0 → 6.28.1, 7.29.1, 8.10.2 no fix PR yet — npm update undici --package-lock-only
CVE-2026-84961 (HIGH) undici 8.10.0 → 7.29.1, 8.10.2 no fix PR yet — npm update undici --package-lock-only
CVE-2026-85152 (HIGH) undici 8.10.0 → 8.10.2 no fix PR yet — npm update undici --package-lock-only

⚠ main is itself red right now — this PR likely inherits the backlog rather than adding it. Fixing main (rows above) unblocks every open PR at once.

Posted once per head commit by the baseline gate (M2). A Renovate PR that only touches a manifest with no lockfile change is a broken pre-2026-08-06 artifact — check its diff before merging.

### 🔧 Security-gate fix map <!-- tti-fixmap:17ac66ba4c55535c05c51bf011d9282211850314 --> The gate failed on these dependency findings — fastest path to green for each: | finding | package | installed → fixed | do this | |---|---|---|---| | CVE-2026-63671 (HIGH) | `@nuxtjs/mdc` | 0.21.1 → 0.22.1 | merge #59 — fix(security): @nuxtjs/mdc ^0.22.2 (CVE-2026-63671) — hold f | | GHSA-j95f-988m-3j2f (HIGH) | `@tiptap/core` | 3.28.0 → 3.30.5 | no fix PR yet — `npm update core --package-lock-only` | | CVE-2026-102276 (HIGH) | `brace-expansion` | 5.0.9 → 5.0.10, 3.0.7, 2.1.5, 1.1.19 | merge #62 — chore(deps): update dependency brace-expansion to v5.0.12 [s | | CVE-2026-102278 (HIGH) | `brace-expansion` | 5.0.9 → 5.0.11, 3.0.8, 2.1.6, 1.1.20 | merge #62 — chore(deps): update dependency brace-expansion to v5.0.12 [s | | CVE-2026-93687 (HIGH) | `braces` | 3.0.3 → ? | no fix PR yet — `npm update braces --package-lock-only` | | CVE-2026-92708 (HIGH) | `devalue` | 5.8.2 → 5.9.3 | no fix PR yet — `npm update devalue --package-lock-only` | | GHSA-mcm9-63f2-9j32 (HIGH) | `devalue` | 5.8.2 → 5.9.3 | no fix PR yet — `npm update devalue --package-lock-only` | | GHSA-r9w8-h9r3-54w4 (HIGH) | `devalue` | 5.8.2 → 5.9.3 | no fix PR yet — `npm update devalue --package-lock-only` | | GHSA-x5rw-q4pp-hg5g (HIGH) | `devalue` | 5.8.2 → 5.9.3 | no fix PR yet — `npm update devalue --package-lock-only` | | CVE-2026-84375 (HIGH) | `js-yaml` | 4.3.1 → 4.3.2, 3.15.2 | no fix PR yet — `npm update js-yaml --package-lock-only` | | CVE-2026-85393 (HIGH) | `node-forge` | 1.4.0 → ? | no fix PR yet — `npm update node-forge --package-lock-only` | | GHSA-rgj7-g3m4-5g8c (HIGH) | `sharp` | 0.35.3 → 0.35.4 | no fix PR yet — `npm update sharp --package-lock-only` | | CVE-2026-84370 (HIGH) | `svgo` | 4.0.2 → 2.8.4, 3.3.5, 4.1.0 | no fix PR yet — `npm update svgo --package-lock-only` | | CVE-2026-19534 (HIGH) | `undici` | 8.10.0 → 6.28.1, 7.29.1, 8.10.2 | no fix PR yet — `npm update undici --package-lock-only` | | CVE-2026-84961 (HIGH) | `undici` | 8.10.0 → 7.29.1, 8.10.2 | no fix PR yet — `npm update undici --package-lock-only` | | CVE-2026-85152 (HIGH) | `undici` | 8.10.0 → 8.10.2 | no fix PR yet — `npm update undici --package-lock-only` | > ⚠ `main` is itself red right now — this PR likely **inherits** the backlog rather than adding it. Fixing `main` (rows above) unblocks every open PR at once. <sub>Posted once per head commit by the baseline gate (M2). A Renovate PR that only touches a manifest with no lockfile change is a broken pre-2026-08-06 artifact — check its diff before merging.</sub>
Some checks failed
ai-review / review (pull_request) Has been skipped
Details
scan / trivy-fs (pull_request) Failing after 1m40s
Details
baseline-security / baseline (pull_request) Failing after 2m36s
Required
Details
scan / trivy-fs (push) Failing after 1m25s
Details
baseline-security / baseline (push) Failing after 1m49s
Details
This pull request doesn't have enough approvals yet. 0 of 1 approvals granted.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin chore/ai-review-20261004:chore/ai-review-20261004
git switch chore/ai-review-20261004
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
idea
Feature suggestion — shows on the repo's Ideas tab

  
points
1
 Estimate: 1 point

  
points
13
 Estimate: 13 points

  
points
2
 Estimate: 2 points

  
points
3
 Estimate: 3 points

  
points
5
 Estimate: 5 points

  
points
8
 Estimate: 8 points

  
priority
p0
 Drop everything

  
priority
p1
 High

  
priority
p2
 Medium

  
priority
p3
 Low

  
state
blocked
 Blocked — see dependencies

  
state
done
 Complete

  
state
in-progress
 Being worked

  
state
ready
 Ready to start

  
state
review
 In review

  
state
triage
 Needs triage

  
status
declined
 Not planned — see the closing comment

  
status
in-progress
 Actively being built

  
status
planned
 Accepted — on the roadmap

  
status
proposed
 New suggestion, not yet reviewed

  
status
shipped
 Delivered

  
status
under-review
 Being evaluated by maintainers

  
type
bug
 Defect in existing behaviour

  
type
epic
 Large body of work spanning multiple stories

  
type
feature
 Shippable capability under an epic

  
type
spike
 Time-boxed investigation / research

  
type
story
 User-facing increment, points-estimated

  
type
task
 Implementation unit under a story

No labels
idea
points
1
points
13
points
2
points
3
points
5
points
8
priority
p0
priority
p1
priority
p2
priority
p3
state
blocked
state
done
state
in-progress
state
ready
state
review
state
triage
status
declined
status
in-progress
status
planned
status
proposed
status
shipped
status
under-review
type
bug
type
epic
type
feature
type
spike
type
story
type
task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
tti/tti-ux!64
No description provided.