claude-code-action sets origin to its GitHub App token and revokes it at
the end of its step, so the following push in "Record the release commit
the page describes" failed with "Invalid username or token".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The run reads untrusted ticket text, and `Bash(npx tsx:*)` allowed
`npx tsx -e` with YOUTRACK_TOKEN and the Anthropic key in the environment.
- Allow only the youtrack-cli scripts the prompt uses.
- Force every comment from this run to be private, so it can't publish
anything it read.
- Pass the dispatch input via env instead of interpolating it into `run:`.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude reads untrusted text (PR comments, YouTrack tickets) while updating
the changelog, and its PRs were auto-merged, so a prompt injection could
reach master or leak secrets through `gh`.
- Claude can only edit CHANGES.md and use read-only git/gh commands; the
push token is not persisted in .git/config.
- A separate step opens the PR with GITHUB_TOKEN only if CHANGES.md is the
only changed file, dispatches PR verification for it and enables
auto-merge.
- Remove mergeClaudeChangelogPR.yml, Claude no longer opens these PRs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- youtrackAutoAnalysis: pass step outputs (ticket summary, Claude-generated
statuses and attention reasons) to run scripts via env instead of
interpolating them into the script, so a crafted ticket summary can't
execute shell commands on the runner.
- mergeClaudeChangelogPR: auto-merge only PRs that change CHANGES.md alone,
and disable auto-merge if a later push touches other files.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Anyone could open a fork PR with the What's New title and inject a prompt
via a comment into a Claude run with repository write access.
- Run only for OWNER/MEMBER/COLLABORATOR comments, and verify the PR head is
JetBrains/ideavim:whatsnew-tbr and the commenter has write access.
- Claude can only edit whatsnew-tbr.html and CHANGES.md and has no
commit/push access; the push token is not persisted in .git/config.
- A separate step pushes the edits only if no other files changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Our pipeline could mark issues on youtrack as fixed even if they were not in release branch.
Added single script for all pipelines to deremine which commits enetered given release so changelog, whats new and release itself are using exactly same logic
Commands describe themselves in @ExCommand/@CommandOrMotion, generateHelp renders the Vim-style help file and a workflow keeps it up to date on master.
Moves the Area field agent from the JetBrains/vim-claude-robot repository
into this one, where the YouTrack tooling and the Claude proxy setup
already exist.
The previous agent passed a single prompt to `claude -p` with the ticket
summary, the ticket description, and the list of Area values. It had no
tools, so it could not read the ticket comments, see how an Area value is
used on other tickets, or look at the source. The new workflow runs an
agent that reads the ticket, searches comparable tickets when the right
value is not obvious, and greps the code when the ticket names a command
or an option.
A script selects the ticket, so a run with nothing to triage ends before
the agent starts.
Add to the YouTrack tools:
- searchTickets, which reports the Area values of the tickets it finds
- getAreaValues and setArea, which reject unknown value names before
writing and verify the field afterwards
- setTagByName, so a tag no longer needs a hardcoded id
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
It's two-step process
1. manual run of prepare what's new that will generate html page with blogpost about what's new
2. promote current whatsnew-tbr.html to new version in release pipeline
`build.gradle.kts` `changeNotes` is now auto-derived from CHANGES.md at
build time via the org.jetbrains.changelog plugin, so the skill and the
claude-code-review workflow note no longer need to mention syncing it
by hand.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The pull_request_review event check was failing on nearly every review,
adding noise without value. Other triggers (issue comments, PR review
comments, issues) still respond to @claude mentions.
Step 5/N of removing the octopus handler. Cleanup pass over build config,
CI workflows, and stale comments. No runtime behavior change.
- build.gradle.kts: drop systemProperty("octopus.handler", ...) from
runIde, runPycharm, runWebstorm, runClion, and runIdeForUiTests.
The runIde { } block becomes empty and is removed entirely.
- Delete .github/workflows/runUiOctopusTests.yml: this workflow ran the
UI test suite with -Doctopus.handler=false to verify behavior without
octopus. That is now the only behavior, so the workflow is redundant
with runUiTestsIJ.yml.
- IdeaSpecifics.LookupTopicListener and RiderEscLookupListener: update
comments that justified Rider/CLion Nova-specific handling as "octopus
is disabled (VIM-3815)". The actual reason is unrelated to octopus:
these IDEs' popup manager consumes Escape before the action system
runs. The Rider/CLion Nova gating remains correct.
Add general guidance for fixing flaky UI tests:
- Flaky = race condition, not timeout issue
- Wait for unique state identifiers, not shared elements
- Understand framework built-in waits (findText already waits)
- Trace causality backwards to find correct wait condition
- State transitions have intermediate states
These principles should improve autofix success rate for UI test failures.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Install Neovim in workflows that run tests:
- testsMaintenance.yml: deals with @TestWithoutNeovim annotations
- codebaseMaintenance.yml: can run gradle tests
- youtrackAutoAnalysis.yml: uses TDD for bug fixes and features
Also add guidance in testsMaintenance to verify actual Neovim behavior
when working with skip reasons, and allow nvim/echo bash commands.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add disk space cleanup and reduce video recording size for Linux runners:
- Add "Free up disk space" step to remove .NET, Android SDK, GHC, CodeQL
- Reduce Xvfb resolution from 1920x1080 to 1280x720
- Optimize ffmpeg: 15fps, ultrafast preset, crf 28
This aligns with the existing Rider Linux workflow settings.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add explicit cache-read-only: false to ensure Gradle cache
is properly written and read on macOS builds, matching the
configuration used in the unified IntelliJ workflow.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Added --configuration-cache flag to buildPlugin task in all Linux
UI test workflows to significantly improve build performance.
The configuration cache stores the result of the configuration phase
and reuses it for subsequent builds, avoiding the need to re-evaluate
build scripts when inputs haven't changed. This is particularly
beneficial for UI tests that run frequently on schedule.
Note on "Gradle User Home cache not found" message: This is expected
when the commit SHA changes, as the gradle-home cache key includes it
for security. However, the more important dependency and transform
caches use content-based hashing and are restored correctly across
commits, which is why builds still benefit from caching.
Updated workflows:
- runUiTestsLinux.yml
- runUiRdTestsLinux.yml
- runUiPyTestsLinux.yml
- runUiTestsUnified.yml (both jobs)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
