A plain git rebase drops merge commits and git range-diff compares only the
non-merge patches, so a change authored in a PR's merge commit disappeared
while the proof printed = for every patch and Step 5 force-pushed the loss.
Step 4 now counts merges in $MERGE_BASE..$OLD_HEAD and stops when there are
any, switches with -C so a rerun after a refused lease does not fail on the
existing branch, and asks for a cross-repository diff to be read as untrusted
input before the repository's test command runs it. Step 5 pushes a fork head
to the fork's URL with the same pinned lease instead of to origin, where the
lease could never match.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
A rerun after the author force-pushed left refs/modernize/pr-N stale (the
non-forced refspec is rejected with exit 0 through the pipe), and the lease
pinned to the current remote head would then have let the rebased stale head
overwrite the author's newer commits. The fetch is forced, Steps 2 and 4 stop
when the head is not the one observed in Step 1, and the head-is-base guard
applies only to same-repository PRs (a fork's main into main is a valid head).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
- gstack-post: with --attribute, report scan findings at the body file's own
line numbers and a finding inside the callout as PART: attribute (the
coordinates were shifted by the three callout lines)
- /modernize: route commit messages through gstack-issue-guard with the rest
of the PR text, read isCrossRepository and maintainerCanModify, fetch a fork
head from pull/N/head, refuse a PR whose head is the base branch, and list
moved files NUL-safely
- docs/unattended.md: say that /ship never rebases or force-pushes and an
unattended /modernize stops at its verdict
- CHANGELOG: seven skills carry a codex_default_prompt, not six
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
