feat: Ready to merge #94
Conversation
![baz-reviewer[bot]](https://avatars.githubusercontent.com/in/933528?s=60&v=4){kind=small}
![baz-reviewer-dev[bot]](https://avatars.githubusercontent.com/in/389167?s=60&v=4){kind=small}
| if (hasApprovals) { | ||
| return "approved"; | ||
| } | ||
| return "reviewed"; |
There was a problem hiding this comment.
getReviewStatus collapses every non-approved state into reviewed (lines 79‑82), yet GitHub's PullRequestReviewState enum includes pending, commented, changes_requested, dismissed, etc. When a reviewer requests changes the backend says the PR is blocked, but the CLI now shows ◐ Reviewed (yellow) and implies the review is done. Please expose the actual state (e.g. “changes requested” or “awaiting review”) instead of lumping them into this catch‑all so the label still matches the backend semantics.
Finding type: Breaking Changes
| <Text bold={isSelected} color={titleColor}> | ||
| {isSelected ? ITEM_SELECTOR : ITEM_SELECTION_GAP}#{pr.prNumber}{" "} | ||
| {pr.title} <Text color="gray">[{pr.repositoryName}]</Text>{" "} | ||
| {ciIcon?.icon && ( | ||
| <Text bold color={ciIcon.color}> | ||
| {ciIcon.icon} | ||
| </Text> | ||
| )} | ||
| </Text> | ||
| </Box> | ||
| <Text dimColor={!isSelected} color={metadataColor}> | ||
| {" "}by {pr.authorName} | ||
| {" • "} | ||
| {updatedTime} | ||
| {" • "} | ||
| <Text dimColor={!isSelected} color={reviewDisplay.color}> | ||
| {reviewDisplay.text} | ||
| </Text> | ||
| {ciIcon?.text && <Text> • CI {ciIcon.text}</Text>} |
There was a problem hiding this comment.
Pull request metadata (title, repository, author) is rendered directly inside Ink components without stripping ANSI/escape sequences. Since these fields come straight from the Baz/GitHub APIs (see src/lib/clients/{baz,github}.ts where they’re mapped 1:1), a malicious PR title/author/repo name can inject terminal control codes, so the CLI now mirrors untrusted text which is a security risk.
Finding type: Basic Security Patterns
Generated description
Below is a concise technical summary of the changes proposed in this PR:
graph LR PullRequestSelectorContainer_("PullRequestSelectorContainer"):::modified usePullRequests_("usePullRequests"):::modified PullRequestSelector_("PullRequestSelector"):::modified PullRequestCard_("PullRequestCard"):::added useFetchUser_("useFetchUser"):::added MergeConfirmationPrompt_("MergeConfirmationPrompt"):::added appMode_mode_dataProvider_("appMode.mode.dataProvider"):::added PullRequestSelectorContainer_ -- "Added updateData to manage pull request data updates." --> usePullRequests_ PullRequestSelectorContainer_ -- "Passes updateData prop to PullRequestSelector for data updates." --> PullRequestSelector_ PullRequestSelector_ -- "Uses PullRequestCard to render detailed pull request info." --> PullRequestCard_ PullRequestSelector_ -- "Fetches current user data for display and logic." --> useFetchUser_ PullRequestSelector_ -- "Adds merge confirmation UI and logic." --> MergeConfirmationPrompt_ MergeConfirmationPrompt_ -- "Uses dataProvider to fetch merge status and merge PR." --> appMode_mode_dataProvider_ usePullRequests_ -- "Uses dataProvider to fetch pull requests list." --> appMode_mode_dataProvider_ classDef added stroke:#15AA7A classDef removed stroke:#CD5270 classDef modified stroke:#EDAC4C linkStyle default stroke:#CBD5E1,font-size:13pxEnhance the pull request data model and fetching mechanisms to include CI run statuses and code review information, refactoring
github.tsto use GraphQL for richer data. Introduce new UI components,PullRequestCardandMergeConfirmationPrompt, to display this detailed information and enable direct merging of pull requests from thePullRequestSelector.PullRequestCardcomponent to display detailed CI and review statuses, and introduce an interactiveMergeConfirmationPromptto allow users to merge pull requests directly from thePullRequestSelector.Modified files (6)
Latest Contributors(2)
PullRequestdata model to include CI run statuses and code review information, and refactor data providers ingithub.tsandbaz.tsto fetch this enriched data using GraphQL for GitHub.Modified files (4)
Latest Contributors(2)