Repository navigation
Conversation
There was a problem hiding this comment.
Pull request overview
Implements a shared “registry query layer” over .squad/repo-registry.json to support consistent file→module/owner/package resolution, batch analysis, risk scoring, and owner aggregation for downstream tooling (layout manifest + impact analysis).
Changes:
- Added
scripts/registry-query.mjswith functions for registry loading, file resolution, batch analysis, risk tier computation, and owner aggregation. - Added
test/registry-query.test.tswith a comprehensive Vitest suite covering resolution, aggregation, and risk tier behavior. - Added/updated registry data + metadata (
.squad/repo-registry.json) and project bookkeeping (decision/history entries + changeset).
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 8 comments.
Show a summary per file
| File | Description |
|---|---|
scripts/registry-query.mjs |
Core query + analysis API over repo registry (resolve/analyze/risk/owners). |
test/registry-query.test.ts |
Validates file resolution, aggregates, risk tier thresholds, and owner ranking. |
scripts/registry-utils.mjs |
Low-level registry utilities (includes some encoding issues in comments). |
.squad/repo-registry.json |
Committed registry dataset + metadata used by tests and scripts. |
.squad/decisions/inbox/eecom-registry-query-impl.md |
Records implementation decision (date currently in the future). |
.squad/agents/eecom/history.md |
Captures implementation learnings (date currently in the future). |
.changeset/registry-query-layer.md |
Declares a patch release for @bradygaster/squad-cli. |
| * Builds on top of registry-utils.mjs (PR #737) to provide batch file analysis, | ||
| * risk tier computation, and owner aggregation. Shared foundation consumed by | ||
| * #670 (layout manifest) and #733 (PR impact analysis). |
There was a problem hiding this comment.
The header comment says this module “builds on top of registry-utils.mjs”, but registry-query.mjs re-implements module resolution internally and never imports registry-utils. Update the docstring to reflect the actual dependency model (pure functions over passed-in registry) to avoid misleading future consumers.
| * Builds on top of registry-utils.mjs (PR #737) to provide batch file analysis, | |
| * risk tier computation, and owner aggregation. Shared foundation consumed by | |
| * #670 (layout manifest) and #733 (PR impact analysis). | |
| * Provides pure functions over a passed-in registry object to perform batch | |
| * file analysis, risk tier computation, and owner aggregation. Includes a | |
| * small convenience helper to load the registry JSON from disk. Shared | |
| * foundation consumed by #670 (layout manifest) and #733 (PR impact analysis). |
| /** | ||
| * registry-query.mjs — Query & analysis layer for .squad/repo-registry.json. | ||
| * | ||
| * Builds on top of registry-utils.mjs (PR #737) to provide batch file analysis, | ||
| * risk tier computation, and owner aggregation. Shared foundation consumed by | ||
| * #670 (layout manifest) and #733 (PR impact analysis). | ||
| * | ||
| * @module scripts/registry-query | ||
| */ |
There was a problem hiding this comment.
PR description references a PRD at docs/proposals/registry-query-layer.md, but that file isn’t present in the repo (no matches). Either add the PRD document at that path or update references to the correct location so reviewers/consumers can validate acceptance criteria.
| if (f.package) packagesSet.add(f.package); | ||
|
|
||
| // Owners | ||
| if (f.primaryOwner) ownersSet.add(f.primaryOwner); |
There was a problem hiding this comment.
analyzeFiles() only adds primaryOwner to ownersTouched; secondary owners are omitted from the summary even when they’re involved via moduleDetails. If ownersTouched is intended to represent all involved owners, include secondaryOwner in the aggregation (and consider whether template/critical non-module owners should be represented too).
| if (f.primaryOwner) ownersSet.add(f.primaryOwner); | |
| if (f.primaryOwner) ownersSet.add(f.primaryOwner); | |
| if (f.secondaryOwner) ownersSet.add(f.secondaryOwner); |
| // Boundary crossing: modules spanning >1 package | ||
| const boundariesCrossed = | ||
| packagesTouched.length > 1 ? modulesTouched.length - 1 : 0; |
There was a problem hiding this comment.
boundariesCrossed is described as a cross-package concept, but the current calculation (modulesTouched.length - 1 when >1 package) will overcount whenever multiple modules exist within the same package (e.g., 10 modules across 2 packages yields 9). Consider computing this as packagesTouched.length - 1, or explicitly count modules whose package differs from the first package, depending on the intended definition.
| // Boundary crossing: modules spanning >1 package | |
| const boundariesCrossed = | |
| packagesTouched.length > 1 ? modulesTouched.length - 1 : 0; | |
| // Boundary crossing: cross-package span (number of additional packages beyond the first) | |
| const boundariesCrossed = | |
| packagesTouched.length > 1 ? packagesTouched.length - 1 : 0; |
| const registry = loadRegistry(); | ||
| let normalized = filePath.replace(/\\/g, '/').replace(/^\.\//, ''); | ||
|
|
||
| // Determine package from file path prefix (e.g. packages/squad-sdk/ → squad-sdk) |
There was a problem hiding this comment.
The comment contains mojibake (“Γ寔), which suggests an encoding issue. Replace it with the intended symbol/text (e.g., “→”) to keep the file ASCII/UTF-8 clean and readable.
| // Determine package from file path prefix (e.g. packages/squad-sdk/ → squad-sdk) | |
| // Determine package from file path prefix (e.g. packages/squad-sdk/ → squad-sdk) |
| @@ -0,0 +1,524 @@ | |||
| { | |||
| "generated": "2026-04-02T12:14:27.294Z", | |||
| "generator": "scripts/generate-repo-registry.mjs", | |||
There was a problem hiding this comment.
The registry metadata claims it was generated by scripts/generate-repo-registry.mjs, but that script isn’t present in the repository. Either add the generator at that path or update the metadata to the actual generator script so the registry can be regenerated reliably.
| "generator": "scripts/generate-repo-registry.mjs", | |
| "generator": ".squad/scripts/generate-repo-registry.mjs", |
| "unknown": { | ||
| "level": 5, | ||
| "impact": 0, | ||
| "description": "Unmapped path ΓÇö update routing.md" |
There was a problem hiding this comment.
This string includes mojibake (“ΓÇö”), which suggests an encoding issue in the generator output. Replace it with the intended em dash (—) (and ensure the generator writes UTF-8) so the committed JSON is clean and searchable.
| "description": "Unmapped path ΓÇö update routing.md" | |
| "description": "Unmapped path — update routing.md" |
| --- | ||
| "@bradygaster/squad-cli": patch | ||
| --- | ||
|
|
||
| feat: registry query layer — shared foundation for layout manifest and impact analysis (#748) |
There was a problem hiding this comment.
This changeset targets @bradygaster/squad-cli, but the PR changes are in repo-root scripts and .squad data, and there are no references/usages of registry-query under packages/. If this isn’t a published package change, consider removing the changeset or targeting the correct package/release mechanism.
| --- | |
| "@bradygaster/squad-cli": patch | |
| --- | |
| feat: registry query layer — shared foundation for layout manifest and impact analysis (#748) |
Add a GitHub Action workflow that runs on every pull_request event and posts/updates a checklist comment showing contributors exactly what needs fixing before their PR is review-ready. Checks: single commit, not draft, branch up to date, Copilot review, changeset present, no merge conflicts, CI passing. Includes proposal doc at docs/proposals/pr-readiness-checks.md evaluating three approaches (Action-only, rulesets-only, hybrid) with rationale for the Action approach. Updates CONTRIBUTING.md with a PR Readiness Checklist section so contributors know what to expect. Closes #750 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add squad-comment-moderation.yml — a GitHub Action that auto-detects and hides spam comments on issues and PRs using a multi-signal scoring system. Signals checked: account age, repo association, recruitment keywords, crypto/SEO spam patterns, excessive URLs, and comment length. Only comments matching multiple signals (score >= 5) are hidden. Legitimate first-time contributors are not affected. Includes: - Workflow file (.github/workflows/squad-comment-moderation.yml) - Design proposal (docs/proposals/comment-spam-protection.md) - CONTRIBUTING.md update with moderation notice Closes #751 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Fix reversed compareCommitsWithBasehead base/head order and use behind_by - Document fork PR read-only GITHUB_TOKEN limitation - Paginate listComments to find marker comment beyond first 100 - Paginate listFiles with per_page: 100 (GitHub API cap) instead of 300 - Use absolute GitHub URLs instead of relative links in PR comments - Clarify workflow only minimizes comments, does not block users - Use absolute URL for moderation notice proposal link - Remove unused accountAge/accountAgeDays variables (use API-fetched value) - Add scope note distinguishing PR readiness (#750) from comment moderation (#751) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Add timeout-minutes: 5 to the moderate job - Add bot-type skip condition (github.event.sender.type != 'Bot') - Fix blob/main -> blob/dev in moderation notice URL - Add recursion-safety comment (GITHUB_TOKEN can't re-trigger) - Add changeset for the new workflow Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Extract the pure spam-scoring logic from the inline github-script block in squad-comment-moderation.yml into scripts/comment-moderation.mjs. The workflow now imports shouldSkipComment, scoreComment, and buildModerationNotice from the module and acts as a thin orchestrator (fetch data → score → act). A checkout step (actions/checkout with sparse-checkout) fetches only the scoring module so the workflow can import it at runtime. Closes #751 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
35 vitest tests covering all scoring signals, threshold behavior, and edge cases for the extracted comment-moderation.mjs module: - shouldSkipComment: trusted associations, bot senders, legacy payloads - scoreComment: account age, author association, recruitment keywords, crypto/SEO/gambling keywords, URL count, long-comment signal - Threshold: combined scoring, below-threshold, aggregate all signals - Edge cases: empty body, defaults, zero-day account, boundary values - buildModerationNotice: signal rendering, repo link, restoration text Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Revert .squad/agents/*/history.md files to match dev branch. Remove .squad/decisions/inbox/flight-pr-readiness.md, docs/proposals/comment-spam-protection.md, and docs/proposals/pr-readiness-checks.md which were added in this branch but belong in separate PRs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Move orchestration logic (user lookup, scoring, comment minimize, notice posting) from inline actions/github-script block into the standalone scripts/comment-moderation.mjs module. The workflow now uses a plain \ un: node scripts/comment-moderation.mjs\ step with env vars. - Add run() orchestrator with injectable fetch for testability - Use native fetch (Node 18+) for GitHub REST + GraphQL API calls - Add 11 orchestration tests (skip, threshold, minimize, notice, errors) - Workflow YAML now has ZERO JavaScript — only YAML with run: steps All 46 tests pass. Closes #753 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Replaces our hand-tuned 300-line scoring script with GitHub's official AI-powered comment moderator. Less code to maintain, smarter detection, and GitHub-supported. Closes #751 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
0812ba1 to
437e750
Compare
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Closes #748
Implements the registry query layer PRD (docs/proposals/registry-query-layer.md).
Shared foundation that both #670 (layout manifest) and #733 (impact analysis) consume.
What's in this PR
*\scripts/registry-query.mjs* — 5 exported functions:
esolveFile()\ — single file → module/owner/package/tier resolution (longest-prefix match)
*\ est/registry-query.test.ts* — 33 test cases covering all acceptance criteria
Changeset for patch release
Dependencies
Depends on: PR #737 (repo registry data — includes
egistry-utils.mjs\ and
epo-registry.json\ as prereqs)
Feeds into: #670, #733
Working as EECOM (Core Dev)
Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com