feat(forgejo-release): Init plugin #38

The forgejo-release plugin implementation is solid overall. It correctly follows workspace conventions (RPITIT pattern, proper dependency management), has good test coverage, and handles the release workflow correctly (draft vs published releases, conventional commit parsing, breaking changes).

The bot's inline findings are mostly minor or incorrect:

The split_once(':') usage (line 328) already handles optional space per Conventional Commits spec (description is trimmed)
PR URL construction uses a validated forgejo_url (validated at line 166 via validate_forgejo_url)
Tag validation via validate_git_ref mitigates injection concerns in the compare range

Additional findings:

Tag ordering assumption (line 173-174): list_tags assumes Forgejo returns tags sorted newest-first to find the previous tag. The API doesn't guarantee sort order - this could pick the wrong "previous" tag.
Missing CI_COMMIT_SHA fallback: The plugin only works on tag pipelines. Consider documenting this limitation or supporting manual tag specification.
No handling for annotated vs lightweight tags: The compare logic treats all tags the same.

These are low-risk for initial release but worth addressing.

*🤖 Review by opencode (opencode/nemotron-3-ultra-free) — verdict: approve

# Review Summary The `forgejo-release` plugin implementation is solid overall. It correctly follows workspace conventions (RPITIT pattern, proper dependency management), has good test coverage, and handles the release workflow correctly (draft vs published releases, conventional commit parsing, breaking changes). The bot's inline findings are mostly minor or incorrect: - The `split_once(':')` usage (line 328) already handles optional space per Conventional Commits spec (description is trimmed) - PR URL construction uses a validated `forgejo_url` (validated at line 166 via `validate_forgejo_url`) - Tag validation via `validate_git_ref` mitigates injection concerns in the compare range **Additional findings:** 1. **Tag ordering assumption** (line 173-174): `list_tags` assumes Forgejo returns tags sorted newest-first to find the previous tag. The API doesn't guarantee sort order - this could pick the wrong "previous" tag. 2. **Missing `CI_COMMIT_SHA` fallback**: The plugin only works on tag pipelines. Consider documenting this limitation or supporting manual tag specification. 3. **No handling for annotated vs lightweight tags**: The compare logic treats all tags the same. These are low-risk for initial release but worth addressing. --- *🤖 Review by opencode (opencode/nemotron-3-ultra-free) — verdict: **approve**

clank-bot reviewed

2026-08-22 10:40:04 +00:00

clank-bot left a comment

Code review findings from opencode.

Code review findings from opencode.

plugins/forgejo-release/src/main.rs

					
				@ -0,0 +170,4 @@

				        let message = commit

				            .commit

				            .as_ref()

				            .and_then(|commit| commit.message.as_deref())

[bug] The tag comparison format `{previous_tag}...{tag}` assumes tags are valid Git refs. If tags contain special characters, this could produce an invalid range. Consider validating/escaping tag names or using the Forgejo API's compare endpoint more carefully.

[bug] The tag comparison format `{previous_tag}...{tag}` assumes tags are valid Git refs. If tags contain special characters, this could produce an invalid range. Consider validating/escaping tag names or using the Forgejo API's compare endpoint more carefully.

plugins/forgejo-release/src/main.rs

					
				@ -0,0 +185,4 @@

				            let breaking = if change.breaking { " **BREAKING**" } else { "" };

				            let scope = if change.scope.is_empty() {

				                String::new()

				            } else {

[bug] `.ok_or_else(|| ...)` on `release.id` - if the Forgejo API ever returns a release without an ID (unlikely but possible), this will error. Consider logging the release object for debugging before erroring.

[bug] `.ok_or_else(|| ...)` on `release.id` - if the Forgejo API ever returns a release without an ID (unlikely but possible), this will error. Consider logging the release object for debugging before erroring.

plugins/forgejo-release/src/main.rs

					
				@ -0,0 +233,4 @@

				        breaking,

				        pr,

				    })

				}

[performance] `list_tags` fetches all tags paginated but only needs tags up to the current one. Since tags are typically sorted newest-first, we could break early once we pass the current tag. However, the Forgejo API may not guarantee sort order - worth verifying.

[performance] `list_tags` fetches all tags paginated but only needs tags up to the current one. Since tags are typically sorted newest-first, we could break early once we pass the current tag. However, the Forgejo API may not guarantee sort order - worth verifying.

plugins/forgejo-release/src/main.rs

[bug] `message.lines().next()?` will return `None` for empty commit messages, causing `parse_commit` to return `None`. This is fine for filtering, but consider if empty messages should be handled differently (e.g., log a warning).

[bug] `message.lines().next()?` will return `None` for empty commit messages, causing `parse_commit` to return `None`. This is fine for filtering, but consider if empty messages should be handled differently (e.g., log a warning).

plugins/forgejo-release/src/main.rs

[bug] `split_once(": ")` expects a space after colon per Conventional Commits spec. Commits like `feat:no space` will fail to parse. The spec allows optional space - consider using `split_once(':')` and trimming the description.

[bug] `split_once(": ")` expects a space after colon per Conventional Commits spec. Commits like `feat:no space` will fail to parse. The spec allows optional space - consider using `split_once(':')` and trimming the description.

plugins/forgejo-release/src/main.rs

[security] PR URL construction uses user-controlled `forgejo_url` directly in the URL without validation. If `forgejo_url` contains path traversal or unexpected characters, it could generate malformed links. Consider parsing/validating the URL with `url::Url` before embedding.

[security] PR URL construction uses user-controlled `forgejo_url` directly in the URL without validation. If `forgejo_url` contains path traversal or unexpected characters, it could generate malformed links. Consider parsing/validating the URL with `url::Url` before embedding.

martin added 1 commit

2026-08-22 11:24:25 +00:00

fixes based on feedback

ci/woodpecker/push/verify-nix Pipeline was canceled

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/global-rust-verify Pipeline failed

Details

8cd67d57ff

clank-bot reviewed

2026-08-22 21:27:48 +00:00

clank-bot left a comment

Code review findings from opencode.

Code review findings from opencode.

plugins/forgejo-release/src/main.rs

					
				@ -0,0 +170,4 @@

				    owner: &str,

				    repo: &str,

				) -> String {

				    let mut groups: BTreeMap<String, Vec<Change>> = BTreeMap::new();

[bug] Assumes tags are returned newest-first from Forgejo API. The `repo_list_tags` endpoint doesn't guarantee sort order. Should sort tags by commit date or use a different approach to find the previous tag reliably.

[bug] Assumes tags are returned newest-first from Forgejo API. The `repo_list_tags` endpoint doesn't guarantee sort order. Should sort tags by commit date or use a different approach to find the previous tag reliably.

plugins/forgejo-release/src/main.rs

					
				@ -0,0 +177,4 @@

				            .as_ref()

				            .and_then(|commit| commit.message.as_deref())

				            .unwrap_or("");

				        if let Some(change) = parse_commit(message, forgejo_url, owner, repo) {

[style] Consider using `repo_compare_diff` with explicit base/head parameters if the API supports it, rather than constructing a git range string. More robust against special characters in tag names (though `validate_git_ref` helps).

[style] Consider using `repo_compare_diff` with explicit base/head parameters if the API supports it, rather than constructing a git range string. More robust against special characters in tag names (though `validate_git_ref` helps).

ci/woodpecker/push/verify-nix Pipeline was canceled

Details

ci/woodpecker/pr/pr-review Pipeline was successful

Details

ci/woodpecker/pr/global-rust-verify Pipeline failed

Details

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin forgejo-release:forgejo-release

git switch forgejo-release

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff forgejo-release

git switch forgejo-release

git rebase main

git switch main

git merge --ff-only forgejo-release

git switch forgejo-release

git rebase main

git switch main

git merge --no-ff forgejo-release

git switch main

git merge --squash forgejo-release