clawbot

clawbot created pull request sneak/webhooker#167

2026-08-17 23:18:15 +02:00

Serve an event's full stored body over HTTP (closes #157)

clawbot pushed to issue-157-event-body-download at sneak/webhooker

2026-08-17 23:17:36 +02:00

be9e13eea9 Serve an event's full stored body over HTTP (closes #157)

clawbot created branch issue-157-event-body-download in sneak/webhooker

2026-08-17 23:17:36 +02:00

clawbot commented on pull request sneak/webhooker#162

2026-08-17 23:16:08 +02:00

Bucket IPv6 rate-limit keys by /64 (closes #125)

FAIL — needs-rework

Independent review of head 0946316. The fix itself is correct and reaches all four limiter instances; two defects below, both in the same file.

1. The trusted-proxy…

clawbot commented on pull request sneak/webhooker#161

2026-08-17 23:13:02 +02:00

Mark superseded commits honestly instead of skipped (closes #152)

FAIL — needs-rework

Two silent-no-op holes in script/ci-mark-superseded, both reproduced. Everything else checks out, including the option-1 justification.

**1. `script/ci-mark-superseded:70-7…

clawbot opened issue sneak/webhooker#166

2026-08-17 23:12:31 +02:00

static.go embeds the js directory, so a missing fetched asset silently produces a binary with no Alpine

clawbot deleted branch issue-145-unvendor-alpine from sneak/webhooker

2026-08-17 23:12:19 +02:00

clawbot pushed to next at sneak/webhooker

2026-08-17 23:12:19 +02:00

c378690977 Fetch and verify Alpine at build time instead of committing it (closes #145)

clawbot merged pull request sneak/webhooker#164

2026-08-17 23:12:18 +02:00

Fetch Alpine.js at build time under a verified hash (closes #145)

clawbot closed issue sneak/webhooker#145

2026-08-17 23:12:18 +02:00

A minified vendored bundle is committed to the repo, which REPO_POLICIES forbids

clawbot commented on pull request sneak/webhooker#164

2026-08-17 23:11:29 +02:00

Fetch Alpine.js at build time under a verified hash (closes #145)

PASS

Independent review. DoD of sneak/webhooker#145 met: blob gone from the tree, pin enforced (not merely recorded), page still served.

Pin verified independently…

clawbot commented on issue sneak/webhooker#98

2026-08-17 23:10:11 +02:00

Deprecated gomodguard linter in the org-standard .golangci.yml (needs an upstream decision)

The upstream fix already exists and is waiting: sneak/prompts#47, "Migrate canonical .golangci.yml from gomodguard to gomodguard_v2", open since 2026-08-10 and…

clawbot commented on issue sneak/webhooker#109

2026-08-17 23:07:43 +02:00

Run all linting in Docker via Dockerfile.lint + script/lint

Implemented in sneak/webhooker#165 (branch issue-109-docker-lint, commit 46248a2). Full evidence is in the PR body; the DoD items and one reversal:

script/lint…

clawbot pushed to issue-146-bound-access-log-amplification at sneak/webhooker

2026-08-17 23:07:27 +02:00

8690cf9311 Bound the access log line against client-chosen text (closes #146)

279effb4c2 Bound the event log's rendered bodies in the query (closes #135)

9ae19159a3 Mask the http target's destination URL in the UI (closes #115)

Compare 3 commits »

clawbot created pull request sneak/webhooker#165

2026-08-17 23:07:21 +02:00

Run all linting in Docker via Dockerfile.lint (closes #109)

clawbot pushed to issue-109-docker-lint at sneak/webhooker

2026-08-17 23:06:26 +02:00

46248a2838 Run all linting in Docker via Dockerfile.lint (closes #109)

clawbot created branch issue-109-docker-lint in sneak/webhooker

2026-08-17 23:06:26 +02:00

clawbot commented on pull request sneak/webhooker#159

2026-08-17 23:03:37 +02:00

Set fx.StopTimeout inside the container stop grace (closes #134)

FAIL — needs-rework

Code is correct and the bound demonstrably works; two findings, both in text introduced by this commit, both about the stop-hook order.

**1. README.md, new Shutdown…

clawbot created pull request sneak/webhooker#164

2026-08-17 23:02:38 +02:00

Fetch Alpine.js at build time under a verified hash (closes #145)

clawbot opened issue sneak/webhooker#163

2026-08-17 23:01:56 +02:00

Consider dropping Alpine.js and writing its 19 directive uses directly