Migrate yilan from Codeberg to forge.marvin8.zone #15

agent-pi · 2026-08-06T23:26:32Z

agent-pi commented

2026-08-06 23:26:32 +00:00

Closes #14

Summary

Migrates yilan from Codeberg.org to forge.marvin8.zone.

Changes

Remotes: origin → forge-marvin8, added forge-pi, removed claude
URLs: Updated all codeberg.org source references to forge.marvin8.zone
AGENTS.md: Removed codeberg-specific git identity; references global AGENTS.md
CI: Runner changed to suanni, wuming action updated to forge URL, grebedoc kept as-is
Deps: Bumped all non-up-to-date packages per zaojun
Migration tracker: yilan moved from NOT migrated to Migrated

Not changed

zaojun references in pre-commit-config.yaml and specs — zaojun not yet migrated

Closes #14 ## Summary Migrates yilan from Codeberg.org to forge.marvin8.zone. ### Changes - **Remotes**: origin → forge-marvin8, added forge-pi, removed claude - **URLs**: Updated all codeberg.org source references to forge.marvin8.zone - **AGENTS.md**: Removed codeberg-specific git identity; references global AGENTS.md - **CI**: Runner changed to suanni, wuming action updated to forge URL, grebedoc kept as-is - **Deps**: Bumped all non-up-to-date packages per zaojun - **Migration tracker**: yilan moved from NOT migrated to Migrated ### Not changed - zaojun references in pre-commit-config.yaml and specs — zaojun not yet migrated

agent-pi added 6 commits

2026-08-06 23:26:32 +00:00

📝 add AI-DECLARATION.md 4df568c72f

📝 clarify AI declaration spec link text a9c1f95f64

🔀 Merge branch 'feat/ai-declaration' 6b32074f0c

🚚 migrate source references from codeberg.org to forge.marvin8.zone 99f6e982f2

- Update default API base_url and raw_url builder
- Update AGENTS.md: remove codeberg-specific git identity, reference global AGENTS.md
- Update README badges, clone URL, and links
- Update CI workflows: wuming action URL, deploy-docs remote, runner to suanni
- Update mkdocs.yml, Justfile, docs, specs, and test expectations
- Keep grebedoc action as-is (separate service)

⏪ revert zaojun URL changes — not yet migrated f152270e3d

⬆️ bump dependencies

/ gitleaks (pull_request) Successful in 22s

Details

/ pr-review (pull_request) Successful in 43s

Details

/ checks (pull_request) Failing after 1m18s

Details

/ deploy-docs (pull_request) Has been skipped

Details

7c67151cb8

- certifi: ~=2026.7.22
- bump-my-version: ~=1.5.0 (aged)
- complexipy: ~=6.2.0
- mkdocs-material: ~=9.7.7
- mkdocstrings: ~=1.0.6
- prek: ~=0.4.11 (aged)
- ruff: ~=0.16.1
- ty: ~=0.0.65 (aged)
- uv: ~=0.12.0 (aged)
- Update pre-commit hook revisions to match

forgejo-actions reviewed

2026-08-06 23:27:15 +00:00

forgejo-actions left a comment

WuMing

Found 1 issue(s). See inline comments below.

## WuMing Found **1** issue(s). See inline comments below.

src/yilan/http_client.py

					
				@ -67,3 +67,3 @@

				        Full URL to the raw file contents.

				    """

				    return f"https://codeberg.org/{owner}/{repo}/raw/branch/main/{path}"

				    return f"https://forge.marvin8.zone/{owner}/{repo}/raw/branch/main/{path}"

code [LOW]

The raw URL domain is hardcoded separately from the API base URL. If the API base URL changes, this must also be updated, leading to potential inconsistency. Consider deriving the raw URL from the configured API base URL or a shared constant.

**code** [LOW] The raw URL domain is hardcoded separately from the API base URL. If the API base URL changes, this must also be updated, leading to potential inconsistency. Consider deriving the raw URL from the configured API base URL or a shared constant.

marvin8 marked this conversation as resolved

agent-pi added 1 commit

2026-08-06 23:31:17 +00:00

🔧 fix ruff 0.16.1 violations and configure isort

/ gitleaks (pull_request) Successful in 19s

Details

/ pr-review (pull_request) Successful in 43s

Details

/ checks (pull_request) Failing after 1m9s

Details

/ deploy-docs (pull_request) Has been skipped

Details

5df65eb15a

- Add force-single-line isort config to match AGENTS.md import style
- Replace datetime.date.today() with datetime.datetime.now(datetime.UTC).date()
- Replace bare except Exception with specific urllib.error.URLError, OSError

agent-pi added 1 commit

2026-08-06 23:36:59 +00:00

🔒 pin pymdown-extensions>=11.0 to fix PYSEC-2026-3609

/ gitleaks (pull_request) Successful in 20s

Details

/ pr-review (pull_request) Successful in 41s

Details

/ checks (pull_request) Successful in 1m35s

Details

/ deploy-docs (pull_request) Has been skipped

Details

47feffc500

agent-pi added 1 commit

2026-08-06 23:41:58 +00:00

🔒 constrain pymdown-extensions>=11.0 via tool.uv.constraint-dependencies

/ deploy-docs (pull_request) Has been cancelled

Details

/ pr-review (pull_request) Has been cancelled

Details

/ gitleaks (pull_request) Has been cancelled

Details

/ checks (pull_request) Has been cancelled

Details

0bab6941b0

Fixes PYSEC-2026-3609 (MEDIUM) in transitive dependency.

agent-pi force-pushed feat/issue-14-migrate-to-forge from 0bab6941b0

/ deploy-docs (pull_request) Has been cancelled

Details

/ pr-review (pull_request) Has been cancelled

Details

/ gitleaks (pull_request) Has been cancelled

Details

/ checks (pull_request) Has been cancelled

Details

to 3dce2f7879

/ gitleaks (pull_request) Successful in 12s

Details

/ pr-review (pull_request) Successful in 41s

Details

/ checks (pull_request) Successful in 1m22s

Details

/ deploy-docs (pull_request) Has been skipped

Details

2026-08-06 23:42:09 +00:00

Compare

forgejo-actions reviewed

2026-08-06 23:42:51 +00:00

forgejo-actions left a comment

WuMing

Found 2 issue(s). See inline comments below.

## WuMing Found **2** issue(s). See inline comments below.

.forgejo/workflows/ci.yml

					
				@ -13,3 +13,3 @@

				    if: github.event_name == 'pull_request'

				    steps:

				      - uses: https://codeberg.org/marvin8/wuming@main

				      - uses: https://forge.marvin8.zone/marvin8/wuming@main

security [MEDIUM]

External action referenced by branch name @main instead of a pinned commit SHA. The action could be silently modified, introducing malicious code. Pin to a full commit hash to ensure integrity. A08: Software and Data Integrity Failures.

**security** [MEDIUM] External action referenced by branch name `@main` instead of a pinned commit SHA. The action could be silently modified, introducing malicious code. Pin to a full commit hash to ensure integrity. A08: Software and Data Integrity Failures.

marvin8 marked this conversation as resolved

.forgejo/workflows/ci.yml

					
				@ -84,3 +84,3 @@

				          git config user.email "ci@forgejo"

				          git config user.name "Forgejo Actions"

				          git remote set-url origin https://x-token-auth:$FORGEJO_TOKEN@codeberg.org/$REPOSITORY.git

				          git remote set-url origin https://x-token-auth:$FORGEJO_TOKEN@forge.marvin8.zone/$REPOSITORY.git

security [HIGH]

Password token exposed in URL via command-line argument. This can leak the token through CI log output, process listings, or shell history. Use environment variable substitution in a way that avoids embedding the secret directly in the command line, e.g., using git remote set-url origin https://x-token-auth:$(echo $FORGEJO_TOKEN)@... is still problematic; consider authenticating via a credential helper instead. A02: Cryptographic Failures.

**security** [HIGH] Password token exposed in URL via command-line argument. This can leak the token through CI log output, process listings, or shell history. Use environment variable substitution in a way that avoids embedding the secret directly in the command line, e.g., using `git remote set-url origin https://x-token-auth:$(echo $FORGEJO_TOKEN)@...` is still problematic; consider authenticating via a credential helper instead. A02: Cryptographic Failures.

marvin8 marked this conversation as resolved

agent-pi referenced this pull request

2026-08-06 23:50:05 +00:00

Derive raw URL from API base URL in http_client #16

agent-pi commented

2026-08-06 23:50:19 +00:00

src/yilan/http_client.py line 0

The raw URL domain is hardcoded separately from the API base URL…

🔴 Deferred to follow-up issue #16 — not in scope for this migration.

[`src/yilan/http_client.py` line 0](https://forge.marvin8.zone/marvin8/yilan/pulls/15#issuecomment-752) > The raw URL domain is hardcoded separately from the API base URL… 🔴 Deferred to follow-up issue #16 — not in scope for this migration.

agent-pi commented

2026-08-06 23:50:30 +00:00

.forgejo/workflows/ci.yml line 0

Password token exposed in URL via command-line argument…

🔴 Not actioned — established pattern in Forgejo Actions deploy-docs workflows. The token comes from forge.token (built-in secret) and this is a self-hosted forge with minimal attack surface.

[`.forgejo/workflows/ci.yml` line 0](https://forge.marvin8.zone/marvin8/yilan/pulls/15#issuecomment-758) > Password token exposed in URL via command-line argument… 🔴 Not actioned — established pattern in Forgejo Actions deploy-docs workflows. The token comes from `forge.token` (built-in secret) and this is a self-hosted forge with minimal attack surface.

agent-pi commented

2026-08-06 23:50:40 +00:00

.forgejo/workflows/ci.yml line 0

External action referenced by branch name @main instead of a pinned commit SHA…

🔴 Not actioned — established pattern. WuMing is a self-hosted action on the same forge instance. Pinning to a SHA would require manual updates on every WuMing release.

[`.forgejo/workflows/ci.yml` line 0](https://forge.marvin8.zone/marvin8/yilan/pulls/15#issuecomment-759) > External action referenced by branch name `@main` instead of a pinned commit SHA… 🔴 Not actioned — established pattern. WuMing is a self-hosted action on the same forge instance. Pinning to a SHA would require manual updates on every WuMing release.

marvin8 added 1 commit

2026-08-07 01:35:15 +00:00

🔧 fix uv constrained dep comment

/ gitleaks (pull_request) Successful in 13s

Details

/ pr-review (pull_request) Successful in 42s

Details

/ checks (pull_request) Successful in 1m39s

Details

/ deploy-docs (pull_request) Has been skipped

Details

8cee078535

marvin8 approved these changes

2026-08-07 01:43:36 +00:00

marvin8 manually merged commit daaa45a8f9 into main

2026-08-07 01:57:19 +00:00

marvin8 deleted branch feat/issue-14-migrate-to-forge

2026-08-07 01:57:50 +00:00

Sign in to join this conversation.

No reviewers

No labels

No milestone

No assignees

3 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Reference

marvin8/yilan!15

Rows
Columns