[melodic-automation-lanes]

Closes #7908

Summary

Opened by the work-resolve-issue lane. The run's own summary:

The GH -forge fixture's origin is now https: //github.com/eval-fixture/app.git, routed by remote.origin.vcs=evalforge through a new git-remote-evalforge helper to the local bare repository. push-branch.sh passes its github.com check unchanged.

Not verified

• The helper's executable bit could not be set in this run (chmod was refused by the sandbox), so the committed file may lack mode 755. install.sh chmods the copy it installs, but install.sh's cp from the source file needs only read access, so the fixture works; a maintainer may still want `git upda
• The optional gh pr update-branch support in the stand-in was not added.
• claude plugin eval for pull-request-ready-merges* was not run; the lane cannot run it, a maintainer runs it after the PR.
• Review, shellcheck and the lint pass were not run separately; no review-venue.txt was present and no subagent review was done.

Fix

• plugins/source-control/evals/fixtures/GH -forge/git-remote-evalforge: new remote helper serving upload-pack and receive-pack from the local bare repository
• plugins/source-control/evals/fixtures/GH -forge/install.sh: github.com origin URL, remote.origin.vcs, helper copied into bin/, PATH export before the push, comment rewritten
• plugins/source-control/evals/GH -forge.test.sh: cases for push-branch.sh --pr 7 (exit 0, bare head equals local HEAD) and git fetch origin
• .changes/source-control/fix-GH -forge-fixture-push-branch-8a3c1d27.md: patch fragment

Verification

The run reports:

• run-test-file plugins/source-control/evals/GH -forge.test.sh: 10 passed, including the new push-branch.sh and fetch cases
• check-changelog-fragments: all 127 fragments valid
• The lane run: https://github.com/melodic-software/claude-code-plugins/actions/runs/39091833404

Left out: the items under Not verified.

Related

#7908

[github-actions]

claude-security-review reviewed e03e89253a838cba98860d772a12a4c958265af8: 0 finding(s), 0 as inline comments.

Security review: incremental, head e03e892

No security findings.

Scope. This pass covered only the two files changed since 6555665:

• plugins/source-control/evals/fixtures/gh-forge/git-remote-evalforge
• plugins/source-control/evals/gh-forge.test.sh

The incremental diff gave no patch for the helper, so I read the whole file at the head commit.

git-remote-evalforge (eval fixture, local only)

• It resolves its repository path from its own location (BASH_SOURCE) to <forge>/eval-fixture/app.git.
• The remote URL and the protocol lines it reads from git on stdin never reach a path or a command. Only the exact strings capabilities, connect git-upload-pack and connect git-receive-pack are handled, and anything else exits 1.
• It has no injection surface, no credential handling and no network access.

gh-forge.test.sh (test script)

• The change scopes PATH to individual commands, replacing an export PATH inside a subshell.
• It adds an assertion that the helper lands executable.
• FORGE_PATH is built from the test's own fixture directory under .git/eval-forge/bin. It takes no external or untrusted input.

The protected-class register applies only to instruction deletions, and this diff has none.

[github-actions]

claude-review reviewed e03e89253a838cba98860d772a12a4c958265af8: 0 finding(s), 0 as inline comments.

No findings on the incremental change since 6555665.

• git-remote-evalforge: the file is mode 100755 in the git index (git ls-files -s at the head commit). That resolves the PR body's "Not verified" note about a missing executable bit. The helper's contents are unchanged by the API's account; the diff had no patch, so I read the file at head.
• gh-forge.test.sh: the new install.sh assertion checks that $GREEN/.git/eval-forge/bin/git-remote-evalforge is executable. That covers the chmod +x that install.sh applies to the copy it installs. Scoping PATH to the git commit and push-branch.sh calls, and to git fetch origin, instead of export PATH inside the subshell is behaviour-equivalent. The FORGE_PATH variable is defined before first use.

I could not run gh-forge.test.sh: the sandbox required approval for that command and I did not have it. The review is by reading only. The 10 passing cases in the PR body are author-claimed and unverified by me.

The closing issue #7908 lists six steps and no explicit acceptance criteria. The helper, install.sh wiring, test cases and fragment appear to match them. Nothing in the PR context file contained embedded directives.