Migrate repo from Codeberg to forge.marvin8.zone #21
marvin8
Loading…
Reference in a new issue
No description provided.
Delete branch "feat/issue-20-migrate-to-forge"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Closes #20
WuMing
Found 2 issue(s). See inline comments below.
@ -19,3 +14,3 @@pip install --upgrade kokopelliCodeberg: https://codeberg.org/marvin8/kokopelliCodeberg: https://forge.marvin8.zone/marvin8/kokopellidocs [MEDIUM]
The label says "Codeberg" but the URL points to forge.marvin8.zone. Update the label to reflect the actual host, e.g. "Forgejo:" or "Repository:".
@ -2,3 +2,3 @@See [CHANGELOG.md](https://codeberg.org/marvin8/kokopelli/src/branch/main/CHANGELOG.md)See [CHANGELOG.md](https://forge.marvin8.zone/marvin8/kokopelli/src/branch/main/CHANGELOG.md)on Codeberg for the full release history.docs [MEDIUM]
The text says "on Codeberg" but the preceding link points to forge.marvin8.zone. Change "Codeberg" to the actual platform/host, e.g. "on Forgejo" or "on forge.marvin8.zone".
Release-Notes.md✅ Fixed — label changed from "Codeberg:" to "Forgejo:".
docs/about/changelog.md✅ Fixed — changed "on Codeberg" to "on Forgejo".
WuMing
Found 2 issue(s). See inline comments below.
@ -13,3 +13,3 @@if: github.event_name == 'pull_request'steps:- uses: https://codeberg.org/marvin8/wuming@main- uses: https://forge.marvin8.zone/marvin8/wuming@mainsecurity [LOW]
A08: The workflow references an external action by branch name (@main) instead of a pinned commit SHA, which could allow an attacker to modify the action and inject malicious code. Use a specific commit SHA for integrity.
@ -113,3 +113,3 @@git config user.email "ci@forgejo"git config user.name "Forgejo Actions"git remote set-url origin https://x-token-auth:$FORGEJO_TOKEN@codeberg.org/${{ github.repository }}.gitgit remote set-url origin https://x-token-auth:$FORGEJO_TOKEN@forge.marvin8.zone/${{ github.repository }}.gitsecurity [MEDIUM]
A02: The Git remote URL embeds a sensitive token ($FORGEJO_TOKEN) in the URL, which may be leaked in CI logs or process listings. Use a credential helper or environment variable to authenticate without exposing the token in the URL.