feat: add rate limiting, README validation, and externalize init-worktree#72
feat: add rate limiting, README validation, and externalize init-worktree#72JacobPEvans merged 10 commits intomainfrom
Conversation
…tree - Add 24h rate limits (15/24h) for issues and PRs in enforce-issue-limits.py, expanding command matching to catch gh pr create/edit - Add README validation PostToolUse hook (validate-readme.py) checking required sections, badge health, and install code blocks - Replace /init-worktree skill with superpowers:using-git-worktrees plus .claude/rules/worktree-conventions.md for path/branch/cleanup conventions - Add /delegate-to-ai reference in CLAUDE.md for multi-model delegation - Bump content-guards to v1.1.0 with readme-validator skill and keywords (claude)
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the repository's automation and guardrail capabilities by introducing new validation and rate-limiting features. It centralizes README file quality checks, prevents excessive GitHub issue and PR creation, and refines the approach to Git worktree management by externalizing conventions. These changes aim to improve code quality, maintain a cleaner issue tracker, and streamline development workflows. Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Greptile SummaryThis PR expands the Key findings:
Confidence Score: 2/5
Sequence DiagramsequenceDiagram
participant Claude
participant PreToolUse Hook
participant PostToolUse Hook
participant enforce-issue-limits.py
participant validate-readme.py
participant GitHub CLI (gh)
Claude->>PreToolUse Hook: Bash: gh issue create / gh pr create / gh pr edit
PreToolUse Hook->>enforce-issue-limits.py: stdin JSON (tool_input.command)
enforce-issue-limits.py->>GitHub CLI (gh): gh issue list (24h count)
enforce-issue-limits.py->>GitHub CLI (gh): gh pr list --state all (all repo PRs, 24h window)
GitHub CLI (gh)-->>enforce-issue-limits.py: JSON response
alt limit exceeded
enforce-issue-limits.py-->>PreToolUse Hook: exit 2 (BLOCK)
PreToolUse Hook-->>Claude: Blocked with reason
else within limit
enforce-issue-limits.py-->>PreToolUse Hook: exit 0 (ALLOW)
PreToolUse Hook-->>Claude: Command proceeds
end
Claude->>PostToolUse Hook: Write/Edit: README*.md
PostToolUse Hook->>validate-readme.py: stdin JSON (tool_input.file_path)
validate-readme.py->>validate-readme.py: find_config_file() → .readme-validator.yaml
validate-readme.py->>validate-readme.py: check_required_sections()
validate-readme.py->>validate-readme.py: check_install_code_blocks()
validate-readme.py->>validate-readme.py: check_badges() [HEAD requests]
alt missing required sections
validate-readme.py-->>PostToolUse Hook: exit 2 (BLOCK)
PostToolUse Hook-->>Claude: Blocked with missing sections
else warnings only / pass
validate-readme.py-->>PostToolUse Hook: exit 0 (ALLOW, warnings on stderr)
PostToolUse Hook-->>Claude: Write/Edit accepted
end
Last reviewed commit: 9482c05 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces several new features and refactorings, including rate limiting for issues/PRs, a new README validation hook, and externalizing the git worktree initialization logic. A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in the README validation script's badge checking feature, which could allow a malicious repository to probe a developer's local network. Additionally, a bug in the custom YAML parser in validate-readme.py could lead to silently ignored configurations, and there are suggestions to improve the clarity of the rate-limiting logic, command robustness, and error handling.
…only check_recent_prs() was counting ALL repo PR activity (created or updated) in the 24h window, causing false-positive blocks when other contributors, CI, or GitHub automations touched PRs. Now filters with --author @me and only counts createdAt, matching check_recent_issues() behavior. Also fixes the block message which now accurately says "created". (claude)
There was a problem hiding this comment.
Pull request overview
This PR extends the plugin suite by adding a README validation hook + skill, tightening GitHub CLI guardrails with 24h rate limiting for issues/PRs, and removing the bespoke /init-worktree skill in favor of external superpowers:using-git-worktrees guidance plus a local conventions rule.
Changes:
- Add README validation (new
/validate-readmeskill, new PostToolUse hook +.readme-validator.yamlconfig). - Expand
enforce-issue-limits.pyto detectgh pr create/gh pr editand enforce 24h rate limits. - Remove
git-workflows’/init-worktreeskill and add.claude/rules/worktree-conventions.mdfor standardized worktree conventions.
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
| git-workflows/skills/init-worktree/SKILL.md | Removes the custom /init-worktree skill definition. |
| git-workflows/.claude-plugin/plugin.json | Drops init-worktree from the plugin skill manifest and updates plugin description accordingly. |
| content-guards/skills/validate-readme/SKILL.md | Adds a /validate-readme skill describing repository-wide README audits. |
| content-guards/scripts/validate-readme.py | Introduces a PostToolUse hook to validate README structure + badges using .readme-validator.yaml. |
| content-guards/scripts/enforce-issue-limits.py | Adds 24h issue/PR rate limiting and expands command matching to PR create/edit. |
| content-guards/hooks/hooks.json | Registers the README validator as a PostToolUse hook for Write/Edit. |
| content-guards/README.md | Documents the new readme-validator and updated issue limiter behavior. |
| content-guards/.claude-plugin/plugin.json | Bumps version to 1.1.0, updates description/keywords, and adds the validate-readme skill. |
| AGENTS.md | Updates plugin quick reference table and adds delegation guidance. |
| .readme-validator.yaml | Adds repo-wide defaults for README validation requirements. |
| .claude/rules/worktree-conventions.md | Adds worktree path/branch/cleanup conventions intended to pair with superpowers:using-git-worktrees. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Fix YAML parser bug: flush pending list key when a new key is encountered, preventing silent data loss when a list key has no items before the next key - Narrow broad `except Exception` to `except (OSError, ValueError)` for more precise error handling in load_config - Fix SSRF vulnerability in check_badges: add BADGE_ALLOWED_HOSTS allowlist of known badge domains, skip all non-allowlisted image URLs, and add private/loopback IP check via _is_private_ip() - Fix urlopen resource leak: use context manager `with urlopen(...)` to ensure socket/file descriptors are always closed (claude)
- Fix rate-limit block message to say "creating or updating" to cover gh pr edit operations, not just creation - Fix docstring to accurately document per-resource-type 24h counters instead of implying a combined budget - Replace nonexistent agentsmd/skills/consolidate-issues/SKILL.md reference with actionable remediation steps - Add bats test suite with 12 tests covering command matching, hard limits, rate limits, fail-open, and message content (claude)
- worktree-conventions.md: add `git switch main` before `git pull`
and normalize placeholder to `{repo-name}` brace style (threads
PRRT_kwDOQx7E5c5yVnwA and PRRT_kwDOQx7E5c5yVrVM)
- git-workflows/README.md: remove `/init-worktree` skill listing and
usage example; update description to point to
`superpowers:using-git-worktrees` (thread PRRT_kwDOQx7E5c5yVrUP)
- github-workflows/skills/finalize-pr/SKILL.md: update workflow
diagram to reference `superpowers:using-git-worktrees` instead of
removed `/init-worktree` (thread PRRT_kwDOQx7E5c5yVrUP)
- content-guards/scripts/validate-markdown.sh: fix cspell running
from wrong directory causing false "Files checked: 0" failures
(claude)
- validate-readme.py: remove badge checking (~90 lines), simplify YAML parser (47 → 20 lines), inline get_section_content into caller - enforce-issue-limits.py: unify check_recent_issues/check_recent_prs into _count_recent(), extract _GH_ERRORS tuple, tighten block messages - validate-markdown.sh: trim verbose cspell comment block - enforce-issue-limits.bats: add utc_now() and build_json_array() helpers, replace 6 copy-paste for-loops - AGENTS.md: remove 3 duplicate plugin rows and sections already in CLAUDE.md (260 → 25 lines) - content-guards/README.md: fix test path, add coverage bullets - validate-readme/SKILL.md: replace bash block with prose, add config schema section - delete .readme-validator.yaml from repo root (project-specific config) All 20 tests pass. (claude)
Conflicts resolved: - AGENTS.md: keep HEAD minimal version (sections duplicated from CLAUDE.md removed) - content-guards/scripts/validate-markdown.sh: keep short comment, adopt --no-must-find-files flag from main (cspell fix) - git-workflows/skills/init-worktree/SKILL.md: keep deleted (externalized) - github-workflows/skills/finalize-pr/SKILL.md: take main's diagram (shows both invocation modes + multi-PR modes from PR #76) (claude)
|
Claude finished @JacobPEvans's task in 3m 10s —— View job PR #72 Review
Good PR overall — the validate-readme hook is clean, the test suite follows the established bats pattern well, and badge checking was correctly removed after the SSRF concern. A few real issues found: Issues flagged inline:
Also noted: The |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
…it limitation - Add ["--author", "@me"] to the 24h issue rate-limit call so only Claude-created issues count against the limit, consistent with the existing PR rate-limit filter. - Add inline comment documenting that `gh pr edit` on PRs created >24h ago does not accumulate against the rate limit because _count_recent uses createdAt; tracking edit frequency separately is out of scope. (claude)
…ormat
Replace all <angle-bracket> placeholders with {brace} style to match
the existing convention used in the Before Creating section.
(claude)
parse_headings and check_install_code_blocks only matched ## (h2),
causing false-positive blocking when READMEs use # or ### for major
sections. Update both regex patterns to #{1,3} to cover h1, h2, h3.
(claude)
Summary
enforce-issue-limits.py, expanding command matching to catchgh pr createandgh pr editvalidate-readme.pyPostToolUse hook checks required sections, badge health, and install code blocks with configurable.readme-validator.yaml/init-worktreeskill withsuperpowers:using-git-worktreesplus.claude/rules/worktree-conventions.mdfor path/branch/cleanup conventions/delegate-to-aireference in CLAUDE.mdTest plan
enforce-issue-limits.pypasses through non-matching commands (echo hello)enforce-issue-limits.pycatchesgh issue create,gh pr create,gh pr editvalidate-readme.pyskips non-README filesvalidate-readme.pypasses READMEs with required sectionsvalidate-readme.pyblocks READMEs missing required sections.readme-validator.yamlconfig is loaded (only Installation required)superpowers:using-git-worktreesworks with worktree-conventions rule/delegate-to-aiis visible in CLAUDE.md🤖 Generated with Claude Code