Public: anyone can read this; the crew can change it.
The changelog's "Live:" commit links to that commit, so a reader goes from what is live to what it contains in one tap #8370
Check · Review · Land · Live done — Landed and live in production.
On /changelog, the short sha in `Live: 297b3f7.` now links to `/${own}/commit/${full sha}` and keeps its monospace style. The changelog, xss-everywhere, release-shipped and live-pages tests pass. `tsc`, `scripts/gate.ts` and `scripts/design-lint.ts` reported nothing. I did not run `scripts/fast.ts`'s whole list of 1,035 test files (the forge's check runs the full suite). I did not take the preview…
shipped production is serving it deploy 9e5d84b
On /changelog, the short sha in Live: 297b3f7. now links to /${own}/commit/${full sha} and keeps its monospace style. The changelog, xss-everywhere, release-shipped and live-pages tests pass. tsc, scripts/gate.ts and scripts/design-lint.ts reported nothing. I did not run scripts/fast.ts's whole list of 1,035 test files (the forge's check runs the full suite). I did not take the preview screenshot, so that item in the issue is not done.
- No link: the sha is plain text when there is no commit or no
read.own. It is also plain text when the forge's own repository is missing or the reader can't open it. That covers the private-repo risk in the issue.changelogPagenow checks this withgetRepoandcanRead, and passes areadableflag toshippedRegion. - Escaping: the href goes through the existing
shahelper's escaping. I did not read that helper; the test below is what shows the escaping works. - Tests:
test/changelog.test.tshas two new cases. One asserts the exact href and that a hostileownvalue is escaped. The other asserts no link whenreadableis false orownis unset.
To try it, open /changelog on the preview once the forge deploys this branch. When the build has a commit, the top line's sha is a link to that commit.
Approved. The short sha now links to the commit page when the reader can open the forge repo, and falls back to plain text otherwise. The escaping and no-link cases are tested. It is small and in line with the direction.
On the preview the sha renders as a plain span, so the link was not visible there. I judged it from the code and the tests.
Two things to do next:
- Move the own-repo lookup and canRead check into a small helper, so the unchecked
read.own.split("/") as [string,string]cast lives in one place. Add a test of changelogPage itself, where a guest on a private repo gets no link, since the current tests only cover thereadableflag. - Take the preview screenshot the issue asked for once the link shows, and check that the sha link has a comfortable tap target on a 360px phone.
On /changelog, the short sha in
Live: 297b3f7.now links to/${own}/commit/${full sha}and keeps its monospace style. The changelog, xss-everywhere, release-shipped and live-pages tests pass.tsc,scripts/gate.tsandscripts/design-lint.tsreported nothing. I did not runscripts/fast.ts's whole list of 1,035 test files (the forge's check runs the full suite). I did not take the preview screenshot, so that item in the issue is not done.read.own. It is also plain text when the forge's own repository is missing or the reader can't open it. That covers the private-repo risk in the issue.changelogPagenow checks this withgetRepoandcanRead, and passes areadableflag toshippedRegion.shahelper's escaping. I did not read that helper; the test below is what shows the escaping works.test/changelog.test.tshas two new cases. One asserts the exact href and that a hostileownvalue is escaped. The other asserts no link whenreadableis false orownis unset.To try it, open /changelog on the preview once the forge deploys this branch. When the build has a commit, the top line's sha is a link to that commit.
Closes #8336