4 Commits

Include renames

Author	SHA1	Message	Date
sneak	a8b24a843b	Format Go with gofmt, then golines -m 77 (closes #215) ... script/fmt now runs golines -m 77 after gofmt, repeating golines until it changes nothing, since one pass can leave a line the next splits. script/fmt-check fails when either would change a file. script/bootstrap installs golines v0.13.0 with go install, pinned to its commit, and checks the installed version with go version -m. The tree is reformatted. The longer lines this makes are fixed by hand: nolint directives moved onto their own line above the statement, one string split, and 20 functions over funlen's 80 lines shortened or split, RunWAF and limitPercentages among them. Model: opus-5-5	2026-11-11 14:50:46 +00:00
clawbot	b6aa2cbc4b	Core Rule Set: Forgejo's ordinary requests pass by default (closes #342) ... Forgejo 17.0.1's ordinary traffic, recorded in `testdata/forgejo-requests.txt` (pages signed in and out, admin pages, the API with a token, git clone and push, the generic and container registries, uploads), passes at the default settings. What Forgejo sends and gitea does not: its flash cookie `flash` joins the cookies left out, and in the new `forgejo.conf` `q` on its wiki search skips five rules. In `gitea.conf`, the API's package search joins the name searches, and `q` there also skips 932250, except on user and organisation pages. `README.md` lists Forgejo; `SPEC.md` lists the changes. - Still refused, each tracked: `ls -la` on user and organisation pages; file and branch names in bodies while bodies are read; Forgejo's searches at a branch or tag, of releases and of job logs; other search fields not yet recorded. Model: opus-5-5	2026-11-11 12:12:50 +01:00
clawbot	fb25f5ebd2	Core Rule Set tests: check WordPress's recorded requests as the other apps' (closes #284) ... TestOrdinaryWordPressRequestsPass skipped the inspection that reads bodies for a request with no body, including one with a Content-Type. It now calls wantRecordedRequestsPass. Model: opus-5-5	2026-11-10 15:57:53 +01:00
clawbot	f8d769fc17	Core Rule Set tests: check the recorded requests without the race detector (closes #290) ... The tests that check the apps' recorded requests move to internal/coreruleset/recorded_test.go, behind the recorded build tag. The test phase runs only those tests in a second go test, without -race. The lint phase reads the same file, with the same tag. The Gitea and WordPress tests are split in two. Their recorded-request loops become TestOrdinaryGiteaRequestsPass and TestOrdinaryWordPressRequestsPass; their attack checks stay in the race pass as TestGiteaAttacksAreRefused and TestWordPressAttacksAreRefused. Model: opus-5-5	2026-11-10 15:26:11 +01:00