fix: Remediate 2026-08-09 audit findings by soulevilx · Pull Request #38 · jooservices/flickr

soulevilx · 2026-08-09T23:36:07Z

Summary

Ships the pending transport refactor (JooClientTransport → ClientTransport, HttpTransport enum, CircuitOpenException, connect timeout, upload content_type guessing) together with fixes from the accompanying audit (audit_260809.md):

Bump jooservices/dto to 1.6.0 and jooservices/exceptions to 1.0.0; add psr/log as an explicit direct dependency instead of relying on it transitively.
Close real coverage gaps: all 8 guessContentType() branches, FavoriteService::getListPages(), PeopleService::getPhotosPages(), and the PeopleService::getInfo('') guard (coverage 95.03% → 96.63%, giving real margin above the CI's 95% gate).
Replace the disabled Gitleaks placeholder in secret-scanning.yml with a working TruffleHog OSS scan (no license required, unlike Gitleaks for org-owned repos).
Fix the self-contradictory v2-roadmap.md, which still claimed the circuit breaker/rate limiter were "not wired yet" after they shipped in v2.0.0.
De-duplicate the pagination pattern shared by FavoriteService and PeopleService into AbstractRawService::paginatePhotoListMethod().
FlickrConfig now rejects connectTimeoutSeconds > timeoutSeconds; FlickrFactory::make() accepts an optional logger; mark a few single-dependency constructor properties readonly.
Port ci-triage/release-readiness Claude commands adapted from the jooservices/dto sibling for AI-contributor tooling parity.

Full findings and evidence: audit_260809.md.

Test plan

composer ci (lint matrix, static analysis, registry/API-index verification, coverage, consumer smoke test) passes locally
Coverage 96.63%, clear of the 95% CI gate
composer audit clean, no vulnerability advisories
CI green on this PR

🤖 Generated with Claude Code

Transport refactor (JooClientTransport -> ClientTransport, HttpTransport enum, CircuitOpenException, connect timeout, upload content_type guessing) plus fixes from the accompanying audit: - Bump jooservices/dto to 1.6.0 and jooservices/exceptions to 1.0.0; add psr/log as an explicit direct dependency instead of relying on it transitively. - Close real coverage gaps: all 8 guessContentType() branches, FavoriteService::getListPages(), PeopleService::getPhotosPages(), and the PeopleService::getInfo('') guard (95.03% -> 96.63%). - Replace the disabled Gitleaks placeholder in secret-scanning.yml with a working TruffleHog OSS scan (no license required, unlike Gitleaks for org-owned repos). - Fix the self-contradictory v2-roadmap.md, which still claimed the circuit breaker/rate limiter were "not wired yet" after they shipped in v2.0.0. - De-duplicate the pagination pattern shared by FavoriteService and PeopleService into AbstractRawService::paginatePhotoListMethod(). - FlickrConfig now rejects connectTimeoutSeconds > timeoutSeconds; FlickrFactory::make() accepts an optional logger; mark a few single-dependency constructor properties readonly. - Port ci-triage/release-readiness Claude commands adapted from the jooservices/dto sibling for AI-contributor tooling parity. See audit_260809.md for the full findings this addresses.

qodo-code-review · 2026-08-09T23:36:13Z

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

coderabbitai · 2026-08-09T23:36:17Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 94b4390f-44d6-4c59-a96d-5520fd3c8f5f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codacy-production · 2026-08-09T23:36:55Z

Not up to standards ⛔

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer}
_{TIP This summary will be updated as you push new changes.}

codecov-commenter · 2026-08-09T23:37:58Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.04%. Comparing base (0d720ba) to head (b4380ec).

Additional details and impacted files

@@              Coverage Diff              @@
##             develop      #38      +/-   ##
=============================================
+ Coverage      95.95%   97.04%   +1.08%     
- Complexity       765      776      +11     
=============================================
  Files            124      124              
  Lines           2052     2096      +44     
=============================================
+ Hits            1969     2034      +65     
+ Misses            83       62      -21

Flag	Coverage Δ
unittests	`97.04% <100.00%> (+1.08%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Bring flickr's GitHub Actions in line with sibling packages (dto, exceptions, client), which already run both scans.

github-advanced-security · 2026-08-09T23:48:59Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.