2.3 KiB
2.3 KiB
phase, review, updated
| phase | review | updated |
|---|---|---|
| 11.2 | 11.2-REVIEW.md | 2026-10-01T14:49:40Z |
Phase 11.2 code review disposition
One row per finding in 11.2-REVIEW.md. Default open; set to fixed, accepted or deferred with a note.
| ID | Severity | Finding | Disposition | Note |
|---|---|---|---|---|
| CR-01 | critical | The install root is owned by the service account, so root's deploy steps can be redirected through symlinks | fixed | sm-summercmsio-app 8e5765e |
| WR-01 | warning | The HTTPS server block sends no Strict-Transport-Security header | fixed | sm-summercmsio-app 1dcf774 (no includeSubDomains; check on rome) |
| WR-02 | warning | The HTTP block redirects ACME challenges, and the app 404s /.well-known/ |
fixed | sm-summercmsio-app 1e934ab (webroot path to check on rome) |
| WR-03 | warning | The D-40 terminal check puts GOBIN on PATH, so it does not prove the page's commands work in a fresh shell | accepted | user chose option 1: card unchanged, PATH step added to the installation guide (summercms.go bd2f7e7) |
| WR-04 | warning | The site test gate and the pnpm test script only work on Node 22.18 to 22.x |
fixed | vue-summercmsio-app 60c3c4a, summercms.go be51bfe, sm-summercmsio-app aeac7bf |
| WR-05 | warning | The smoke script can test a different server that already holds the port | fixed | sm-summercmsio-app 8cfe055 |
| WR-06 | warning | A release build does not compile what its plugin tests checked, and does not require clean submodules | fixed | sm-summercmsio-app fffa38c |
| IN-01 | info | The extension-less docs 301 drops the query string | open | |
| IN-02 | info | site_label in site.yaml cannot be paired with --site-url alone |
open | |
| IN-03 | info | The og:image alt text is not reactive, unlike the other SEO fields | open | |
| IN-04 | info | Copy-button failures are silent and success is not announced | open | |
| IN-05 | info | The gate's built stage can check one framework checkout and build from another | open | |
| IN-06 | info | Pipelines in an assignment exit under set -e without a diagnostic |
open | |
| IN-07 | info | The external link check follows redirects, so a login redirect would count as a pass | open | |
| IN-08 | info | The scroll-spy section list is defined twice | open |
fixed: 6, accepted: 1, open: 8 of 15 (IN-01..IN-08, info, out of fix scope)