dependabot/github_actions/actions/checkout-7 → main

Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@​yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> <h2>v6.0.2</h2> <h2>What's Changed</h2> <ul> <li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> <li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@​aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@​yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@​ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@​motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@​mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@​benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@​joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@​TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@​salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@​jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@​orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@​actions/core</code> and <code>@​actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li>See full diff in <a href="https://github.com/actions/checkout/compare/v6...v7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

chore/bump-actions-node24 → main

## What & Why `actions/checkout@v4` and `actions/setup-node@v4` run on the deprecated Node 20 action runtime. Bumped both to v6 (Node 24) to clear the deprecation warnings. The `[20, 22]` app build matrix is unchanged. ## Related Issue N/A ## How to Verify 1. Open this PR and confirm CI passes. 2. Check the run Summary — the two "Node.js 20 actions are deprecated" warnings should be gone. ## Checklist - [x] PR title follows [Conventional Commits](https://www.conventionalcommits.org/) (`feat:`, `fix:`, `chore:`, `refactor:`, `docs:`, `i18n:`) - [ ] Translations added to both `locales/ko.json` and `locales/en.json` (if UI text changed) - [ ] Tested on mobile viewport (if UI changed)

i18n/refine-ko-en-dictionaries → main

## What & Why Refines the KO/EN dictionaries and removes dead keys. - **KO policy** — GitHub status badges stay English as fixed API-enum labels(`Added/Removed/Modified/Renamed`, `Merged/Open/Closed`, `Private/Public`), while navigation, actions, and descriptions are Korean. - **EN polish** — capitalize file-status badges to match the other badges, sentence-case the expand/collapse actions, and drop the desktop-only "from the left" wording in `selectFile`. - **Cleanup** — remove unused keys: `code.branch`, `pulls.filesChanged` / `pulls.additions` / `pulls.deletions`. - **Docs** — AGENTS.md now states that API-enum status badges stay English in both locales, so they aren't "fixed" as untranslated strings later. ## Related Issue N/A ## How to Verify 1. Browse in **KO** (`/ko/...`) — repo list, file viewer, commits, PR list & detail tabs: status badges show in English, everything else in Korean. 2. Browse in **EN** — file-status badges read `Added/Removed/Modified/Renamed`; expand/collapse buttons are sentence case. 3. `npm run typecheck && npm run build` pass (removing unused keys doesn't break the `Dictionary` type). ## Checklist - [x] PR title follows [Conventional Commits](https://www.conventionalcommits.org/) (`feat:`, `fix:`, `chore:`, `refactor:`, `docs:`, `i18n:`) - [x] Translations added to both `locales/ko.json` and `locales/en.json` (if UI text changed) - [x] Tested on mobile viewport (if UI changed)

refactor/component-named-exports → main

## What & Why `UnauthorizedForm` was the only component in `components/` using a default export — every other component uses a named export. Switched it to a named export and updated the import in `app/unauthorized/page.tsx` to match the convention. Also documented in AGENTS.md: - the export convention (`components/` → named; Next.js file conventions follow the framework's required shape). - how the `/unauthorized` page resolves its locale (it lives outside `app/[lang]/`, so it reads `Accept-Language`). ## Related Issue N/A ## How to Verify 1. `npm run typecheck && npm run lint && npm run build` — all pass. 2. Visit `/unauthorized` → the token form still renders, localized via `Accept-Language`, and submitting a token works. (No behavior change — export refactor only.) ## Checklist - [x] PR title follows [Conventional Commits](https://www.conventionalcommits.org/) (`feat:`, `fix:`, `chore:`, `refactor:`, `docs:`, `i18n:`) - [x] Translations added to both `locales/ko.json` and `locales/en.json` (if UI text changed) - [x] Tested on mobile viewport (if UI changed)

fix/locale-switch-preserve-query → main

## What & Why Switching the language dropped the URL query string, because `LangSwitcher` built the target href from `pathname` alone. On a PR detail page this lost the `?tab=` param and reset the view to **Overview**; commit pagination(`?page=`) and the file viewer's `?path=`/`?branch=` were lost the same way. Fixed by reading the current query via `useSearchParams` and re-appending it, isolated behind a `Suspense` boundary so prerendered routes stay static. ## Related Issue N/A ## How to Verify 1. Open any PR detail page, switch to the **Commits** or **Files changed** tab. 2. Click `EN`/`KO` in the language switcher → stays on the same tab (previously reset to Overview). 3. On a commits list at `?page=2`, switch locale → still on page 2. 4. In the file viewer with a file open on a non-default branch, switch locale → `?path=` and `?branch=` retained. ## Checklist - [x] PR title follows [Conventional Commits](https://www.conventionalcommits.org/) (`feat:`, `fix:`, `chore:`, `refactor:`, `docs:`, `i18n:`) - [x] Translations added to both `locales/ko.json` and `locales/en.json` (if UI text changed) - [x] Tested on mobile viewport (if UI changed)

fix/auth-timing-and-cookie-exposure → main

## What & Why Replace raw `===` token checks with `crypto.timingSafeEqual` to prevent timing attacks. Store HMAC-SHA256 of the share token in the auth cookie instead of the raw value, so that a leaked cookie does not directly expose the master token. ## Related Issue N/A ## How to Verify 1. Access with `?token=<SHARE_TOKEN>` → cookie is set and page redirects. 2. Refresh → cookie-based auth works normally. 3. Submit token on `/unauthorized` page → cookie is set and redirects to `/`. 4. Try an invalid token → rejected with 401. 5. Check cookie value in DevTools → hex string (HMAC), not the raw token. ## Checklist - [x] PR title follows [Conventional Commits](https://www.conventionalcommits.org/) (`feat:`, `fix:`, `chore:`, `refactor:`, `docs:`, `i18n:`) - [x] Translations added to both `locales/ko.json` and `locales/en.json` (if UI text changed) - [x] Tested on mobile viewport (if UI changed)

fix/proxy-auth-bypass → main

## What & Why Closes two ways a viewer could bypass the `SHARE_TOKEN` check: - **Removed the `/api/github/[...path]` proxy route.** It was excluded from `proxy.ts` (the matcher skips `/api/*`) and never checked the `smc_auth` cookie, so anyone could read allowlisted private-repo contents without the share token. No client code used it — all GitHub calls happen server-side via `lib/github.ts`. - **Fixed the `proxy.ts` matcher.** The old `.*\..*` exclusion skipped every path containing a dot, so repository pages whose name contains a dot (e.g. `next.js`) bypassed the share-token check entirely. It now excludes only framework internals and named static assets. Also updated `CLAUDE.md` to match the real architecture (server-side GitHub fetches, 60s cache, matcher behavior). ## Related Issue N/A ## How to Verify 1. Without the `smc_auth` cookie, request `/<lang>/repository/<owner>/<dotted-repo>` (e.g. a repo named `next.js`) → now `307 → /unauthorized` (was `200`). 2. `curl -i /api/github/repos/<owner>/<repo>/contents/README.md` → `404` (route removed). 3. `npm run build && npm run typecheck && npm run lint && npm run format:check` all pass. ## Checklist - [x] PR title follows [Conventional Commits](https://www.conventionalcommits.org/) (`feat:`, `fix:`, `chore:`, `refactor:`, `docs:`, `i18n:`) - [x] Translations added to both `locales/ko.json` and `locales/en.json` (if UI text changed) - [x] Tested on mobile viewport (if UI changed)

chore/native-git-hooks → main

## Related Issue N/A ## Changes - Add native git hooks in `.githooks/` — `commit-msg` enforces Conventional Commits prefixes (`feat:`, `fix:`, `chore:`, `refactor:`, `docs:`, `i18n:`), `pre-push` enforces matching branch name prefixes. - Hooks are activated automatically on `npm install` via the `prepare` script (`git config core.hooksPath .githooks`) — no husky needed. - Remove commitlint: it was never wired to a git hook, so it never actually ran. Deletes `commitlint.config.js`, two devDependencies, and 66 transitive packages. - Drop the unused `test` label from commit/branch conventions and the PR template, since this project intentionally has no test suite. - Document the hooks in `CLAUDE.md`. ## How to Verify 1. Run `npm install` (activates the hooks), then check `git config core.hooksPath` prints `.githooks`. 2. `git commit --allow-empty -m "bad message"` → rejected with a prefix error. 3. `git commit --allow-empty -m "chore: valid message"` → succeeds (then reset). 4. Push a branch named without a prefix → rejected by `pre-push`. ## Checklist - [x] `npm run format:check` passes - [x] `npm run lint` passes - [x] `npm run typecheck` passes - [x] `npm run build` passes - [x] PR title follows Conventional Commits (`feat:`, `fix:`, `chore:`, `refactor:`, `docs:`, `i18n:`)

docs/sync-claude-md → main

## Related Issue N/A ## Changes - CLAUDE.md: split the Diff view description into `FilesChanged.tsx` (diff rendering) and `FilesChangedWithTree.tsx` (tree-sidebar wrapper, the component the detail pages actually import). - CLAUDE.md: add `FilesChangedWithTree.tsx` to the `"use client"` component list. - CLAUDE.md: document the Error UI pattern (`global-error.tsx`, repo-scoped `error.tsx`). - CLAUDE.md: document the `/api/auth` manual token-entry flow and the `smc_auth` cookie in Access Control; switch "middleware" wording to "proxy.ts" for consistency. - .env.example: translate the two Korean comments to English to match the rest of the file and the English-comment convention. ## How to Verify 1. Read the updated sections in CLAUDE.md and confirm they match the code(`FilesChangedWithTree.tsx`, `app/api/auth/route.ts`, `error.tsx`). 2. Confirm `.env.example` has no remaining non-English comments. ## Checklist - [x] `npm run format:check` passes - [x] `npm run lint` passes - [x] `npm run typecheck` passes - [x] `npm run build` passes - [x] PR title follows Conventional Commits (`feat:`, `fix:`, `chore:`, `refactor:`, `docs:`, `test:`, `i18n:`)

fix/diff-page-mobile-padding → main

## Related Issue N/A ## Changes - Replace bare `px-6` with `px-3 md:px-6` on the `<main>` of the commit-detail and PR-detail pages (and their `loading.tsx` skeletons), per the page-level padding convention in CLAUDE.md. - These four pages were the only ones violating the rule; mobile (≥320px) now gets 12px side padding instead of 24px, freeing up horizontal space for diffs. Desktop (`md:` and up) keeps 24px unchanged. ## How to Verify 1. Open a PR detail and a commit detail page at a 320px viewport width. 2. Confirm side padding is tighter (12px) and the diff has more room. 3. Resize to ≥768px and confirm padding returns to 24px. ## Checklist - [x] `npm run format:check` passes - [x] `npm run lint` passes - [x] `npm run typecheck` passes - [x] `npm run build` passes - [x] PR title follows Conventional Commits (`feat:`, `fix:`, `chore:`, `refactor:`, `docs:`, `test:`, `i18n:`)