chore(sync): rebuild wff-code/wff-chat from .claude@13d8aac - #11

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- changed hunk ---'
git diff -- plugins/wff-code/skills/pr-review/workflows/pr-fix.md | sed -n '1,220p'
printf '%s\n' '--- surrounding source ---'
sed -n '1590,1660p' plugins/wff-code/skills/pr-review/workflows/pr-fix.md
printf '%s\n' '--- related terms in repository ---'
rg -n -C 2 'Dependency Review|dependency-review|Code scanning results|mergeStateStatus|mergeable' plugins/wff-code/skills/pr-review

Repository: ByronWilliamsCPA/plugin

Length of output: 22294

🏁 Script executed:

#!/bin/bash
set -eu
printf '%s\n' '--- orphan-check section continuation ---'
sed -n '1620,1688p' plugins/wff-code/skills/pr-review/workflows/pr-fix.md
printf '%s\n' '--- dependency-review references and workflow inventory ---'
rg -n -C 3 'Dependency Review|dependency-review-action|dependency-review\.yml|required.*context|required_status_checks|statusCheckRollup|check-runs' --glob '!plugins/wff-code/skills/pr-review/workflows/pr-fix.md' .
printf '%s\n' '--- repository workflow/docs files ---'
git ls-files | rg '(^|/)\.github/workflows/|dependency|README\.md$' | head -120

Repository: ByronWilliamsCPA/plugin

Length of output: 31761

🌐 Web query:

site:github.com/actions/dependency-review-action "Dependency Review" check name required status check

💡 Result:

To configure the Dependency Review action as a required status check in GitHub, follow these steps: 1. Add the Dependency Review action to your repository's workflow configuration file (typically located in.github/workflows/) [1][2]. 2. Ensure the workflow is configured to run on pull requests [1][2]. 3. Go to your repository settings on GitHub, navigate to Branches, and select (or create) a branch protection rule for your target branch (e.g., main) [3][4]. 4. Under the "Protect matching branches" section, enable the "Require status checks to pass before merging" setting [3][4]. 5. In the list of available status checks, search for and select the name of the job defined in your Dependency Review workflow file (e.g., if your job is named 'dependency-review', that is the name you will see in the status check list) [3][4]. The Dependency Review action acts as a standard GitHub Actions check [3][5]. Once the job is added to your workflow, GitHub will register it as a status check, allowing you to select it in the branch protection settings [3][6]. The check will block pull requests from being merged only if it fails and you have configured it as a required status check in your branch protection rules [3][5]. Note that by default, the action will fail if it detects vulnerabilities or invalid licenses based on your configuration, which will subsequently cause the required status check to fail, preventing the merge [7][1][6]. You can manage this behavior using parameters like fail-on-severity [1][8].

Citations:

• 1: https://github.com/actions/dependency-review-action/blob/main/docs/examples.md
• 2: https://github.com/actions/dependency-review-action/blob/9571135e29bf14f191938a994dd3448e6de73abc/README.md
• 3: https://github.com/actions/dependency-review-action
• 4: https://github.com/actions/dependency-review-action/blob/1e70f06e66968bd3a4e7a079143037d6317a1e42/README.md
• 5: https://github.com/actions/dependency-review-action/tree/v4.3.0
• 6: actions/dependency-review-action@cb180bf
• 7: GitHub pull request 184 in actions/dependency-review-action (link omitted to avoid creating a cross-reference)
• 8: https://github.com/actions/dependency-review-action/tree/v4.2.3

🏁 Script executed:

#!/bin/bash
sed -n '1608,1650p' plugins/wff-code/skills/pr-review/workflows/pr-fix.md
printf '\n--- nearby references ---\n'
rg -n -C 3 'CodeQL|Dependency Review|mergeable|mergeStateStatus|GHAS|Advanced Security|orphan' plugins/wff-code/skills/pr-review/workflows/pr-fix.md

Repository: ByronWilliamsCPA/plugin

Length of output: 14631

🌐 Web query:

site:docs.github.com dependency review public repositories private repositories GitHub Code Security GitHub Advanced Security code scanning availability public repositories

💡 Result:

Summary (GitHub security feature availability for dependency review and code scanning) 1) Dependency review - Public repositories: available (GitHub documentation states dependency review is available for public repositories on GitHub.com). [1] - Private repositories: available only when GitHub Code Security or GitHub Advanced Security is enabled for that repository. [1] - If Code Security/Advanced Security is disabled, dependency review is not available and related security features are disabled. [2] 2) Code scanning (GitHub Code Security / Advanced Security) - Public repositories: code scanning is available by default. [3][4] - Private repositories: you must enable/purchase GitHub Code Security (part of GitHub Advanced Security) to use code scanning on private repositories. [5][6] - Plan constraint (GitHub Free/Pro): on those plans, code scanning is limited to publicly available repositories; to enable it for private/internal repos you must upgrade (e.g., GitHub Team or GitHub Enterprise with Code Security and enable it for the repo). [7][6] Practical implications - If your goal is to run both dependency review and code scanning on private repos, you need GitHub Advanced Security (Code Security) enabled for those repositories; otherwise, code scanning won’t run and dependency review won’t be available. [1][5][6] - For public repos, GitHub states code scanning and dependency review are available without requiring a paid Code Security license (Code Security features are enabled for public repositories by default). [3][4][1] Key sources: - Dependency review concept doc: https://docs.github.com/en/code-security/concepts/supply-chain-security/dependency-review [1] - GitHub security features / Advanced Security availability table and notes: https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security [4] - Code scanning “private repository enablement” and licensing requirements: https://docs.github.com/en/code-security/reference/code-scanning/troubleshoot-analysis-errors/private-repository-enablement [6] - Advanced Security billing/availability overview (free public vs paid private): https://docs.github.com/en/billing/concepts/product-billing/github-advanced-security [8]

Citations:

• 1: https://docs.github.com/en/code-security/concepts/supply-chain-security/dependency-review
• 2: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository
• 3: https://docs.github.com/en/code-security/getting-started/github-security-features
• 4: https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security
• 5: https://docs.github.com/en/code-security/concepts/code-scanning/code-scanning
• 6: https://docs.github.com/en/code-security/reference/code-scanning/troubleshoot-analysis-errors/private-repository-enablement
• 7: https://docs.github.com/en/code-security/reference/code-scanning/troubleshoot-analysis-errors/advanced-security-must-be-enabled
• 8: https://docs.github.com/en/billing/concepts/product-billing/github-advanced-security

🏁 Script executed:

#!/bin/bash
set -eu
file="plugins/wff-code/skills/pr-review/workflows/pr-fix.md"
printf '%s\n' '--- relevant lines ---'
sed -n '1590,1660p' "$file"
printf '%s\n' '--- nearby references ---'
rg -n -C 3 'mergeable|mergeStateStatus|Dependency Review|SARIF|advisory pending|safe to merge|required context' "$file"

Repository: ByronWilliamsCPA/plugin

Length of output: 15247

🏁 Script executed:

#!/bin/bash
set -eu
file="plugins/wff-code/skills/pr-review/workflows/pr-fix.md"
printf '%s\n' '--- changed hunks ---'
git diff --unified=25 -- "$file" | sed -n '1,260p'

Repository: ByronWilliamsCPA/plugin

Length of output: 183

🏁 Script executed:

#!/bin/bash
set -eu
file="plugins/wff-code/skills/pr-review/workflows/pr-fix.md"
sed -n '1590,1660p' "$file"

Repository: ByronWilliamsCPA/plugin

Length of output: 4672

🌐 Web query:

GitHub GraphQL PullRequest mergeable mergeStateStatus MERGEABLE BLOCKED UNSTABLE documentation

💡 Result:

In the GitHub GraphQL API, mergeable and mergeStateStatus are distinct fields on the PullRequest type that provide different levels of detail regarding a pull request's readiness to be merged [1][2][3]. Mergeable (MergeableState enum) This field provides a coarse assessment of whether the pull request can be merged, focusing primarily on the existence of merge conflicts [1][4][3]. - CONFLICTING: The pull request cannot be merged due to merge conflicts [1][5]. - MERGEABLE: The pull request can be merged [1][5]. - UNKNOWN: The mergeability of the pull request is still being calculated [1][5]. MergeStateStatus (MergeStateStatus enum) This field provides detailed status information about the pull request's merge state [1][4][6]. It is the recommended field for checking if a pull request is ready to be merged, as it accounts for branch protection rules, status checks, and other requirements [2][7][3]. - BEHIND: The head ref is out of date [1][6]. - BLOCKED: The merge is blocked (e.g., by missing required status checks or reviews) [1][6][3]. - CLEAN: The pull request is mergeable and all commit status checks are passing [1][6][3]. - DIRTY: The merge commit cannot be cleanly created (typically due to conflicts) [1][6]. - DRAFT: The merge is blocked because the pull request is in a draft state [1][6]. - HAS_HOOKS: The pull request is mergeable with passing commit status and pre-receive hooks (relevant for GitHub Enterprise) [1][6]. - UNSTABLE: The pull request is mergeable, but there are non-passing commit statuses (e.g., a non-required check has failed) [1][6][3]. - UNKNOWN: The state cannot currently be determined [1][6]. Commonly, developers use mergeStateStatus because it accurately reflects the "green" or "red" state seen on the GitHub user interface, whereas mergeable only indicates whether Git could technically perform a merge [2][3].

Citations:

• 1: https://docs.github.com/en/enterprise-cloud@latest/graphql/reference/pulls
• 2: GitHub issue 9583 in cli/cli (link omitted to avoid creating a cross-reference)
• 3: https://truffle.ghostwright.dev/public/wiki/read-the-merge-state-before-touching-a-stalled-pr.html
• 4: https://docs.github.com/en/graphql/reference/pulls
• 5: https://www.idontlikeai.dev/finding-outdated-mergeable-branches-with-github-cli-and-powershell-in-github/
• 6: https://koki-develop.github.io/magidoc-github-pages-example/types/MergeStateStatus
• 7: https://stackoverflow.com/questions/39395684/check-if-a-pull-request-is-up-to-date-with-the-target-branch