Remove 13 hardcoded "Generated with Claude Code" attribution strings from
6 github command/agent/skill files (dogfood + init-template copies):
.claude/agents/github/{release-manager,sync-coordinator,issue-tracker}.md
.claude/skills/github-project-management/SKILL.md
v3/@claude-flow/cli/.claude/commands/github/{release-manager,sync-coordinator,issue-tracker}.md
Add <!-- last-updated: 2026-05-21 — ADR-127 --> stamps to the top-level
code-block boundary of each edited file so readers can trace the change
back to this ADR without opening git log.
Export ATTRIBUTION_FOOTER from helpers-generator.ts (ADR-127 §opt-in):
when options.attribution === true, materialise a .claude/helpers/attribution
file during init so PR templates can append it conditionally, without
hard-wiring the emoji into every user's commit history (#1670).
Add scripts/smoke-attribution-opt-in.mjs + github-attribution-opt-in-smoke
CI job: static scan that fails if the 🤖 emoji pattern reappears in the
three github-scoped template trees — prevents copy-paste regression.
Co-Authored-By: RuFlo <ruv@ruv.net>
Replace all actions/checkout@v3 and actions/setup-node@v3 refs with @v4
across .claude/agents/github/, .claude/skills/github-*/,
and v3/@claude-flow/cli/.claude/commands/github/ (19 files total).
Add scripts/smoke-deprecated-actions.mjs: static scan that fails if any
of the deprecated refs (checkout@v3, setup-node@v3,
create-release@*, upload-release-asset@*, softprops/action-gh-release@v1)
reappear in scope — preventing copy-paste regression from blog posts or
AI-generated YAML snippets.
Wire github-deprecated-actions-smoke job and path filter into v3-ci.yml
so every future PR touching the github surface re-runs this gate.
Co-Authored-By: RuFlo <ruv@ruv.net>
github-safe.js (both copies — dogfood + init-template)
Adds GITHUB_SAFE_VERSION='1.0.0' constant for smoke assertions.
Adds explicit 256KB body cap (MAX_BODY_BYTES): rejects oversized bodies
with exit 1 before any temp-file write, matching the GitHub API body
field limit documented in ADR-127. Adds strict error handling: all
execSync calls wrapped in try/catch, cleanup in finally. Adds
GITHUB_SAFE_DRY_RUN=1 env-var for smoke tests to skip gh exec.
github-setup.sh (both copies)
Prepends set -euo pipefail. Replaces bare `gh auth status &>/dev/null`
with a check that parses "Logged in" and "repo" scope from the output.
Adds security rationale comment explaining why each flag is needed.
Agent frontmatter WebFetch removal (dogfood copies only — init-template
commands don't have frontmatter; the relevant change there is the injection
fix below):
release-manager.md — removes WebFetch (keeps Write for CHANGELOG)
release-swarm.md — removes WebFetch (keeps Write for CHANGELOG)
repo-architect.md — removes WebFetch
All 13 agents already have explicit tools: lines; only the 3 above had
WebFetch. No agent in scope now has WebFetch in its tools: list.
swarm-pr.md + swarm-issue.md (BOTH dogfood .claude/agents/github/ AND
init-template v3/@claude-flow/cli/.claude/commands/github/):
Replaces unquoted ${{ github.event.comment.body }} interpolated into
--comment "..." with mktemp + printf + grep + --comment-file pattern.
Replaces unquoted ${{ github.event.label.name }} == "swarm-ready" with
mktemp + printf + grep -qx pattern. Closes prompt-injection path where
a PR comment with shell metacharacters could execute attacker-controlled
shell in a pull_request-triggered workflow.
smoke-github-safe-injection.mjs updated:
Upgrades the >256KB test case from "note" (Phase 1 red) to "ok" (Phase 2
green) now that the 256KB cap is enforced.
Acceptance checks:
node scripts/smoke-github-safe-injection.mjs → all 5 cases pass
node scripts/smoke-github-actions-pins.mjs → ok (no regressions)
grep -r 'github.event.comment.body.*--comment' .claude/agents/ v3/@claude-flow/cli/.claude/
→ exit 1 (no matches)
Co-Authored-By: RuFlo <ruv@ruv.net>
ruv