{ "version": 1, "updatedAt": "2026-08-18T19:46:43.092Z", "items": [ { "key": "pass workflow input through `env.npm_package` and read it from `process.env` inside the script.", "text": "Pass workflow input through `env.NPM_PACKAGE` and read it from `process.env` inside the script.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-06T15:46:17.613Z", "lastSeen": "2026-07-06T15:46:17.613Z" }, { "key": "validate the package name with an npm package-name regex before using it.", "text": "Validate the package name with an npm package-name regex before using it.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-06T15:46:17.613Z", "lastSeen": "2026-07-06T15:46:17.613Z" }, { "key": "use `encodeuricomponent(packagename)` in the npm registry url.", "text": "Use `encodeURIComponent(packageName)` in the npm registry URL.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-06T15:46:17.613Z", "lastSeen": "2026-07-06T15:46:17.613Z" }, { "key": "check `response.ok` and throw explicit errors for failed registry fetches or unsupported repository urls.", "text": "Check `response.ok` and throw explicit errors for failed registry fetches or unsupported repository URLs.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-06T15:46:17.613Z", "lastSeen": "2026-07-06T15:46:17.613Z" }, { "key": "avoid: interpolated `${{ inputs.package }}` directly into `actions/github-script` javascript, allowing malformed input to break or inject code.", "text": "Avoid: Interpolated `${{ inputs.package }}` directly into `actions/github-script` JavaScript, allowing malformed input to break or inject code.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-06T15:46:17.613Z", "lastSeen": "2026-07-06T15:46:17.613Z" }, { "key": "avoid: fetched npm metadata with the raw package name instead of url-encoding it.", "text": "Avoid: Fetched npm metadata with the raw package name instead of URL-encoding it.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-06T15:46:17.613Z", "lastSeen": "2026-07-06T15:46:17.613Z" }, { "key": "avoid: assumed `data.repository.url` always existed and was a github `.git` url.", "text": "Avoid: Assumed `data.repository.url` always existed and was a GitHub `.git` URL.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-06T15:46:17.613Z", "lastSeen": "2026-07-06T15:46:17.613Z" }, { "key": "avoid: used a brittle repository url regex that missed scoped/modern github url formats and failed without a clear error.", "text": "Avoid: Used a brittle repository URL regex that missed scoped/modern GitHub URL formats and failed without a clear error.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-06T15:46:17.613Z", "lastSeen": "2026-07-06T15:46:17.613Z" }, { "key": "renamed pr #6833 to `ci: harden citgm package workflow input handling` using `gh pr edit`, then watched checks until `pull-request-title-check` passed.", "text": "Renamed PR #6833 to `ci: harden CITGM package workflow input handling` using `gh pr edit`, then watched checks until `pull-request-title-check` passed.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-06T16:04:51.833Z", "lastSeen": "2026-07-06T16:04:51.833Z" }, { "key": "avoid: pr title did not satisfy the repository's conventional title check before opening/updating the pr.", "text": "Avoid: PR title did not satisfy the repository's conventional title check before opening/updating the PR.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-06T16:04:51.833Z", "lastSeen": "2026-07-06T16:04:51.833Z" }, { "key": "honor soft tool-budget and interruption signals immediately; stop browsing and provide a bounded reflection.", "text": "Honor soft tool-budget and interruption signals immediately; stop browsing and provide a bounded reflection.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T19:37:37.132Z", "lastSeen": "2026-07-29T19:37:37.132Z" }, { "key": "run only the single highest-value targeted test before the budget limit, then report if execution is blocked.", "text": "Run only the single highest-value targeted test before the budget limit, then report if execution is blocked.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T19:37:37.132Z", "lastSeen": "2026-07-29T19:37:37.132Z" }, { "key": "reproduce root primitive coercion with the repository’s actual validatorcompiler path rather than relying on ajv internals alone.", "text": "Reproduce root primitive coercion with the repository’s actual validatorCompiler path rather than relying on Ajv internals alone.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T19:37:37.132Z", "lastSeen": "2026-07-29T19:37:37.132Z" }, { "key": "add focused tests covering custom validator compilation, schemaenv availability, and root primitive coercion.", "text": "Add focused tests covering custom validator compilation, schemaEnv availability, and root primitive coercion.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T19:37:37.132Z", "lastSeen": "2026-07-29T19:37:37.132Z" }, { "key": "avoid: continued initiating tool work after the tool-budget warning instead of stopping to assess the existing evidence.", "text": "Avoid: Continued initiating tool work after the tool-budget warning instead of stopping to assess the existing evidence.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-29T19:37:37.132Z", "lastSeen": "2026-07-29T19:37:37.132Z" }, { "key": "avoid: started a test command that was aborted, leaving the primitive-coercion fix unverified.", "text": "Avoid: Started a test command that was aborted, leaving the primitive-coercion fix unverified.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-29T19:37:37.132Z", "lastSeen": "2026-07-29T19:37:37.132Z" }, { "key": "avoid: investigated ajv internals and custom compiler compatibility without first isolating the exact failing repository behavior.", "text": "Avoid: Investigated Ajv internals and custom compiler compatibility without first isolating the exact failing repository behavior.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-29T19:37:37.132Z", "lastSeen": "2026-07-29T19:37:37.132Z" }, { "key": "avoid: did not establish regression coverage for missing schemaenv handling and root primitive coercion before changing direction.", "text": "Avoid: Did not establish regression coverage for missing schemaEnv handling and root primitive coercion before changing direction.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-29T19:37:37.132Z", "lastSeen": "2026-07-29T19:37:37.132Z" }, { "key": "pass request and parameter metadata as ajv parentdata/parentdataproperty so root coercions update the original request value.", "text": "Pass request and parameter metadata as Ajv parentData/parentDataProperty so root coercions update the original request value.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:03:27.706Z", "lastSeen": "2026-07-29T20:03:27.706Z" }, { "key": "add a regression test asserting quoted numeric json becomes a number in the handler while out-of-range values remain rejected.", "text": "Add a regression test asserting quoted numeric JSON becomes a number in the handler while out-of-range values remain rejected.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:03:27.706Z", "lastSeen": "2026-07-29T20:03:27.706Z" }, { "key": "verify targeted test execution separately from the full suite to avoid mistaking aggregate counts for focused coverage.", "text": "Verify targeted test execution separately from the full suite to avoid mistaking aggregate counts for focused coverage.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:03:27.706Z", "lastSeen": "2026-07-29T20:03:27.706Z" }, { "key": "avoid: root primitive request values were validated without a parent reference, so ajv coercion changed only its local value and left request.body as a string.", "text": "Avoid: Root primitive request values were validated without a parent reference, so Ajv coercion changed only its local value and left request.body as a string.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:03:27.706Z", "lastSeen": "2026-07-29T20:03:27.706Z" }, { "key": "avoid: test command output was misread: borp ran the broader suite despite a specific file argument, making targeted coverage unclear.", "text": "Avoid: Test command output was misread: Borp ran the broader suite despite a specific file argument, making targeted coverage unclear.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:03:27.706Z", "lastSeen": "2026-07-29T20:03:27.706Z" }, { "key": "pass parentdata and parentdataproperty to ajv validators so root primitive coercions update the request object.", "text": "Pass parentData and parentDataProperty to Ajv validators so root primitive coercions update the request object.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:06:55.452Z", "lastSeen": "2026-07-29T20:06:55.452Z" }, { "key": "retain the direct-call path for validators without schemaenv to avoid changing non-ajv validator behavior.", "text": "Retain the direct-call path for validators without schemaEnv to avoid changing non-Ajv validator behavior.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:06:55.452Z", "lastSeen": "2026-07-29T20:06:55.452Z" }, { "key": "add a regression test asserting quoted numeric json reaches the handler as number 10.", "text": "Add a regression test asserting quoted numeric JSON reaches the handler as number 10.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:06:55.452Z", "lastSeen": "2026-07-29T20:06:55.452Z" }, { "key": "determine pr from the deployed route’s authentication requirements; use pr:n for unauthenticated endpoints.", "text": "Determine PR from the deployed route’s authentication requirements; use PR:N for unauthenticated endpoints.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:06:55.452Z", "lastSeen": "2026-07-29T20:06:55.452Z" }, { "key": "base c/i impact on the specific handler and data affected rather than assigning a universal fastify score.", "text": "Base C/I impact on the specific handler and data affected rather than assigning a universal Fastify score.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:06:55.452Z", "lastSeen": "2026-07-29T20:06:55.452Z" }, { "key": "avoid: ajv was called with a primitive root value without parentdata context, so coerced values were not written back to request.body.", "text": "Avoid: Ajv was called with a primitive root value without parentData context, so coerced values were not written back to request.body.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:06:55.452Z", "lastSeen": "2026-07-29T20:06:55.452Z" }, { "key": "avoid: the regression scenario was initially vulnerable because the handler received string \"10\" after validation accepted it.", "text": "Avoid: The regression scenario was initially vulnerable because the handler received string \"10\" after validation accepted it.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:06:55.452Z", "lastSeen": "2026-07-29T20:06:55.452Z" }, { "key": "avoid: the cvss rating assumed pr:l without repository evidence that authentication is required; many affected routes may be unauthenticated.", "text": "Avoid: The CVSS rating assumed PR:L without repository evidence that authentication is required; many affected routes may be unauthenticated.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:06:55.452Z", "lastSeen": "2026-07-29T20:06:55.452Z" }, { "key": "avoid: the impact rating was stated as application-dependent without defining the affected endpoint’s actual confidentiality and integrity consequences.", "text": "Avoid: The impact rating was stated as application-dependent without defining the affected endpoint’s actual confidentiality and integrity consequences.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:06:55.452Z", "lastSeen": "2026-07-29T20:06:55.452Z" }, { "key": "updated `lib/validation.js` to retain and return coerced root values.", "text": "Updated `lib/validation.js` to retain and return coerced root values.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:09:41.212Z", "lastSeen": "2026-07-29T20:09:41.212Z" }, { "key": "added `test/fix-root-primitive-coercion.test.js` to prevent recurrence.", "text": "Added `test/fix-root-primitive-coercion.test.js` to prevent recurrence.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:09:41.212Z", "lastSeen": "2026-07-29T20:09:41.212Z" }, { "key": "avoid: validation coerced a root primitive but failed to preserve the coerced value for the caller.", "text": "Avoid: Validation coerced a root primitive but failed to preserve the coerced value for the caller.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:09:41.212Z", "lastSeen": "2026-07-29T20:09:41.212Z" }, { "key": "avoid: the regression scenario was not covered by existing tests.", "text": "Avoid: The regression scenario was not covered by existing tests.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-07-29T20:09:41.212Z", "lastSeen": "2026-07-29T20:09:41.212Z" }, { "key": "always log/compare the exact pathname string passed into send(), including after encodeuri", "text": "Always log/compare the exact pathname string passed into send(), including after encodeURI", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-04T10:59:32.673Z", "lastSeen": "2026-08-04T10:59:32.673Z" }, { "key": "when statuses differ for \"same\" path, diff charcodes for % vs %25 double-encoding first", "text": "When statuses differ for \"same\" path, diff charCodes for % vs %25 double-encoding first", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-04T10:59:32.673Z", "lastSeen": "2026-08-04T10:59:32.673Z" }, { "key": "instrument static handler vs router to separate callnotfound from unmatched routes", "text": "Instrument static handler vs router to separate callNotFound from unmatched routes", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-04T10:59:32.673Z", "lastSeen": "2026-08-04T10:59:32.673Z" }, { "key": "trace full pipeline: raw.url → getpathnameforsend → dotdot guards → encodeuri → @fastify/send", "text": "Trace full pipeline: raw.url → getPathnameForSend → dotDot guards → encodeURI → @fastify/send", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-04T10:59:32.673Z", "lastSeen": "2026-08-04T10:59:32.673Z" }, { "key": "reproduce with send(root, p) using both raw and encodeuri(p) before changing triage conclusions", "text": "Reproduce with send(root, p) using both raw and encodeURI(p) before changing triage conclusions", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-04T10:59:32.673Z", "lastSeen": "2026-08-04T10:59:32.673Z" }, { "key": "avoid: assumed /static/..%2f… 404 meant getpathnameforsend/route miss instead of later send pipeline behavior", "text": "Avoid: Assumed /static/..%2f… 404 meant getPathnameForSend/route miss instead of later send pipeline behavior", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-04T10:59:32.673Z", "lastSeen": "2026-08-04T10:59:32.673Z" }, { "key": "avoid: did not check that encodeuri() re-encodes residual % as %25 before blaming path guards", "text": "Avoid: Did not check that encodeURI() re-encodes residual % as %25 before blaming path guards", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-04T10:59:32.673Z", "lastSeen": "2026-08-04T10:59:32.673Z" }, { "key": "avoid: conflated reply.callnotfound() json (\"route get:… not found\") with an actual find-my-way miss", "text": "Avoid: Conflated reply.callNotFound() JSON (\"Route GET:… not found\") with an actual find-my-way miss", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-04T10:59:32.673Z", "lastSeen": "2026-08-04T10:59:32.673Z" }, { "key": "avoid: debugged isolated getpathnameforsend reimplementation before tracing pumpsendtoreply → encodeuri(pathnameforsend) → @fastify/send", "text": "Avoid: Debugged isolated getPathnameForSend reimplementation before tracing pumpSendToReply → encodeURI(pathnameForSend) → @fastify/send", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-04T10:59:32.673Z", "lastSeen": "2026-08-04T10:59:32.673Z" }, { "key": "avoid: compared send() on decoded ../ paths (403) to static outcomes without using the exact post-encodeuri string static passes", "text": "Avoid: Compared send() on decoded ../ paths (403) to static outcomes without using the exact post-encodeURI string static passes", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-04T10:59:32.673Z", "lastSeen": "2026-08-04T10:59:32.673Z" }, { "key": "empirically print encodeuri output/charcodes: '%' → '%25', so static sees '/..%252ftop-secret.txt' (safe 404) not a '..' segment.", "text": "Empirically print encodeURI output/charCodes: '%' → '%25', so static sees '/..%252ftop-secret.txt' (safe 404) not a '..' segment.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-04T11:12:27.539Z", "lastSeen": "2026-08-04T11:12:27.539Z" }, { "key": "reproduce with @fastify/send directly for raw percent, encodeuri(percent), and decoded '../' to map 403 vs 404 to normalize/root logic.", "text": "Reproduce with @fastify/send directly for raw percent, encodeURI(percent), and decoded '../' to map 403 vs 404 to normalize/root logic.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-04T11:12:27.539Z", "lastSeen": "2026-08-04T11:12:27.539Z" }, { "key": "keep reporter response framed as app-level path.join(param) misuse; cite static/sendfile containment and express parity, not a core cve.", "text": "Keep reporter response framed as app-level path.join(param) misuse; cite static/sendFile containment and Express parity, not a core CVE.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-04T11:12:27.539Z", "lastSeen": "2026-08-04T11:12:27.539Z" }, { "key": "avoid: assumed encodeuri leaves '%' intact on paths like '/..%2ftop-secret.txt', so static 404 vs raw '..' 403 looked inconsistent.", "text": "Avoid: Assumed encodeURI leaves '%' intact on paths like '/..%2ftop-secret.txt', so static 404 vs raw '..' 403 looked inconsistent.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-04T11:12:27.539Z", "lastSeen": "2026-08-04T11:12:27.539Z" }, { "key": "avoid: treated encoded traversal and decoded param sinks as the same layer before separating find-my-way dual-decode from @fastify/send root checks.", "text": "Avoid: Treated encoded traversal and decoded param sinks as the same layer before separating find-my-way dual-decode from @fastify/send root checks.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-04T11:12:27.539Z", "lastSeen": "2026-08-04T11:12:27.539Z" }, { "key": "avoid: relied on log/message shape alone (callnotfound 'route ... not found') to infer static failure mode without probing @fastify/send inputs.", "text": "Avoid: Relied on log/message shape alone (callNotFound 'Route ... not found') to infer static failure mode without probing @fastify/send inputs.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-04T11:12:27.539Z", "lastSeen": "2026-08-04T11:12:27.539Z" }, { "key": "re-run markdownlint scoped strictly to docs/reference/request.md and docs/reference/routes.md.", "text": "Re-run markdownlint scoped strictly to docs/Reference/Request.md and docs/Reference/Routes.md.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-04T12:31:54.341Z", "lastSeen": "2026-08-04T12:31:54.341Z" }, { "key": "stage only those two paths (git add docs/reference/request.md docs/reference/routes.md); never git add .", "text": "Stage only those two paths (git add docs/Reference/Request.md docs/Reference/Routes.md); never git add .", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-04T12:31:54.341Z", "lastSeen": "2026-08-04T12:31:54.341Z" }, { "key": "manually awk length>80 on changed files to confirm new lines stay ≤80 before commit.", "text": "Manually awk length>80 on changed files to confirm new lines stay ≤80 before commit.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-04T12:31:54.341Z", "lastSeen": "2026-08-04T12:31:54.341Z" }, { "key": "leave response.md untracked and verify git status/diff --stat before commit and pr.", "text": "Leave response.md untracked and verify git status/diff --stat before commit and PR.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-04T12:31:54.341Z", "lastSeen": "2026-08-04T12:31:54.341Z" }, { "key": "avoid: markdown lint invoked in a way that flooded output with unrelated files (agents.md, .pi memory, response.md) instead of only the two edited docs.", "text": "Avoid: Markdown lint invoked in a way that flooded output with unrelated files (AGENTS.md, .pi memory, response.md) instead of only the two edited docs.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-04T12:31:54.341Z", "lastSeen": "2026-08-04T12:31:54.341Z" }, { "key": "avoid: untracked response.md sat in the working tree and could have been staged if git add was too broad.", "text": "Avoid: Untracked response.md sat in the working tree and could have been staged if git add was too broad.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-04T12:31:54.341Z", "lastSeen": "2026-08-04T12:31:54.341Z" }, { "key": "avoid: relied on noisy repo-wide lint signal before confirming md013 on the actual changed regions.", "text": "Avoid: Relied on noisy repo-wide lint signal before confirming MD013 on the actual changed regions.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-04T12:31:54.341Z", "lastSeen": "2026-08-04T12:31:54.341Z" }, { "key": "before any security-fix push, explicitly ask whether targets are the private advisory fork, public `origin`, or both; treat a draft advisory as a warning, not implicit authorization policy.", "text": "Before any security-fix push, explicitly ask whether targets are the private advisory fork, public `origin`, or both; treat a draft advisory as a warning, not implicit authorization policy.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:37:20.498Z", "lastSeen": "2026-08-18T19:37:20.498Z" }, { "key": "always state push destinations and exact resulting refs, e.g. `advisory-ghsa-3m5p/main` changed while `origin/main` remained at `6e95cb9f`.", "text": "Always state push destinations and exact resulting refs, e.g. `advisory-ghsa-3m5p/main` changed while `origin/main` remained at `6e95cb9f`.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:37:20.498Z", "lastSeen": "2026-08-18T19:37:20.498Z" }, { "key": "run workspace-sensitive pr operations separately: attempt the comment, record an expected permission denial, then independently close only if authorized.", "text": "Run workspace-sensitive PR operations separately: attempt the comment, record an expected permission denial, then independently close only if authorized.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:37:20.498Z", "lastSeen": "2026-08-18T19:37:20.498Z" }, { "key": "describe pr state from verified fields (`closed`, `mergedat: null`, head/base oids) rather than inferring that it is empty.", "text": "Describe PR state from verified fields (`CLOSED`, `mergedAt: null`, head/base OIDs) rather than inferring that it is empty.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:37:20.498Z", "lastSeen": "2026-08-18T19:37:20.498Z" }, { "key": "keep local security branches until the user confirms the intended public/private publication state; delete them only after final authorization and ref verification.", "text": "Keep local security branches until the user confirms the intended public/private publication state; delete them only after final authorization and ref verification.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:37:20.498Z", "lastSeen": "2026-08-18T19:37:20.498Z" }, { "key": "avoid: assumed the draft advisory meant `origin/main` and `origin/5.x` must remain untouched without first confirming whether the user expected public pushes.", "text": "Avoid: Assumed the draft advisory meant `origin/main` and `origin/5.x` must remain untouched without first confirming whether the user expected public pushes.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:37:20.498Z", "lastSeen": "2026-08-18T19:37:20.498Z" }, { "key": "avoid: reported that the private branches were complete without clearly distinguishing advisory-fork refs from public `origin` refs, prompting the user to stop and verify deployment status.", "text": "Avoid: Reported that the private branches were complete without clearly distinguishing advisory-fork refs from public `origin` refs, prompting the user to stop and verify deployment status.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:37:20.498Z", "lastSeen": "2026-08-18T19:37:20.498Z" }, { "key": "avoid: combined pr closing with an unsupported workspace-repository comment under `set -e`, causing the entire command to fail before the close could occur.", "text": "Avoid: Combined PR closing with an unsupported workspace-repository comment under `set -e`, causing the entire command to fail before the close could occur.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:37:20.498Z", "lastSeen": "2026-08-18T19:37:20.498Z" }, { "key": "avoid: called the pr “now-empty” even though github still reported it as mergeable with different head and base oids.", "text": "Avoid: Called the PR “now-empty” even though GitHub still reported it as mergeable with different head and base OIDs.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:37:20.498Z", "lastSeen": "2026-08-18T19:37:20.498Z" }, { "key": "avoid: deleted local security branches before resolving whether the user wanted the commits pushed to public branches, reducing convenient recovery points.", "text": "Avoid: Deleted local security branches before resolving whether the user wanted the commits pushed to public branches, reducing convenient recovery points.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:37:20.498Z", "lastSeen": "2026-08-18T19:37:20.498Z" }, { "key": "obtained explicit approval before public disclosure, then atomically fast-forwarded `origin/main` to `af079bd4` and `origin/5.x` to `8acfea7e`, verifying both refs with `git ls-remote`.", "text": "Obtained explicit approval before public disclosure, then atomically fast-forwarded `origin/main` to `af079bd4` and `origin/5.x` to `8acfea7e`, verifying both refs with `git ls-remote`.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:38:15.045Z", "lastSeen": "2026-08-18T19:38:15.045Z" }, { "key": "fast-forwarded local `main` to `origin/main` and confirmed a clean synchronized status.", "text": "Fast-forwarded local `main` to `origin/main` and confirmed a clean synchronized status.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:38:15.045Z", "lastSeen": "2026-08-18T19:38:15.045Z" }, { "key": "do not retry forbidden workspace graphql actions; use permitted repository operations or ask the user for an authorized alternative before attempting comments or metadata changes.", "text": "Do not retry forbidden workspace GraphQL actions; use permitted repository operations or ask the user for an authorized alternative before attempting comments or metadata changes.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:38:15.045Z", "lastSeen": "2026-08-18T19:38:15.045Z" }, { "key": "avoid: initially pushed the security fix only to the private advisory fork, leaving `origin/main` and `origin/5.x` unchanged without first confirming the intended publication target.", "text": "Avoid: Initially pushed the security fix only to the private advisory fork, leaving `origin/main` and `origin/5.x` unchanged without first confirming the intended publication target.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:38:15.045Z", "lastSeen": "2026-08-18T19:38:15.045Z" }, { "key": "avoid: after pushing remote refs, local `main` remained one commit behind, creating temporary local/remote inconsistency.", "text": "Avoid: After pushing remote refs, local `main` remained one commit behind, creating temporary local/remote inconsistency.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:38:15.045Z", "lastSeen": "2026-08-18T19:38:15.045Z" }, { "key": "avoid: a graphql `addcomment` action was attempted despite workspace-repository restrictions; the denial indicates an intentional permission boundary that should not be bypassed.", "text": "Avoid: A GraphQL `addComment` action was attempted despite workspace-repository restrictions; the denial indicates an intentional permission boundary that should not be bypassed.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:38:15.045Z", "lastSeen": "2026-08-18T19:38:15.045Z" }, { "key": "closed pr #1 without merging after confirming its head sha was already the intended private `main` commit.", "text": "Closed PR #1 without merging after confirming its head SHA was already the intended private `main` commit.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:46:43.092Z", "lastSeen": "2026-08-18T19:46:43.092Z" }, { "key": "fetched current `origin/main` and `origin/5.x`, verified each security commit’s parent exactly matched the corresponding remote tip, then used an atomic push.", "text": "Fetched current `origin/main` and `origin/5.x`, verified each security commit’s parent exactly matched the corresponding remote tip, then used an atomic push.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:46:43.092Z", "lastSeen": "2026-08-18T19:46:43.092Z" }, { "key": "verified public and private `main`/`5.x` refs matched, fast-forwarded local `main`, deleted temporary security branches, and confirmed a clean synchronized checkout.", "text": "Verified public and private `main`/`5.x` refs matched, fast-forwarded local `main`, deleted temporary security branches, and confirmed a clean synchronized checkout.", "kind": "learning", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:46:43.092Z", "lastSeen": "2026-08-18T19:46:43.092Z" }, { "key": "avoid: private pr #1 remained open after its head commit had already been placed on private `main`; its mergeability was `unknown` and it was no longer the correct landing path.", "text": "Avoid: Private PR #1 remained open after its head commit had already been placed on private `main`; its mergeability was `UNKNOWN` and it was no longer the correct landing path.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:46:43.092Z", "lastSeen": "2026-08-18T19:46:43.092Z" }, { "key": "avoid: local `main` and temporary security branches were left out of sync after updating the remote branches.", "text": "Avoid: Local `main` and temporary security branches were left out of sync after updating the remote branches.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:46:43.092Z", "lastSeen": "2026-08-18T19:46:43.092Z" }, { "key": "avoid: direct public branch updates bypassed the repository’s pull-request-only rules, so ancestry and target refs required explicit validation to avoid unsafe rewrites.", "text": "Avoid: Direct public branch updates bypassed the repository’s pull-request-only rules, so ancestry and target refs required explicit validation to avoid unsafe rewrites.", "kind": "antiPattern", "hits": 1, "score": 1, "firstSeen": "2026-08-18T19:46:43.092Z", "lastSeen": "2026-08-18T19:46:43.092Z" } ] }