Skip to content

fix(speckit): change branch naming scheme#8399

Open
fatih-acar wants to merge 2 commits intodevelopfrom
fac-speckit-branch-naming
Open

fix(speckit): change branch naming scheme#8399
fatih-acar wants to merge 2 commits intodevelopfrom
fac-speckit-branch-naming

Conversation

@fatih-acar
Copy link
Contributor

@fatih-acar fatih-acar commented Feb 17, 2026

Summary by CodeRabbit

  • New Features

    • Optional initials prefix for feature branch names (e.g., initials-###-feature-name); initials can be auto-detected or provided manually.
    • Branch/feature discovery now recognizes both initials-prefixed and legacy numeric-only formats.
  • Documentation

    • Added PR checklist item to review AI-generated content.
    • Updated templates and command docs to reflect the optional initials-based branch naming and examples.

@github-actions github-actions bot added the group/ci Issue related to the CI pipeline label Feb 17, 2026
@coderabbitai
Copy link
Contributor

coderabbitai bot commented Feb 17, 2026

Walkthrough

Adds an optional developer-initials prefix to feature branch naming across scripts, templates, and documentation. Updates include regex and parsing changes in bash helpers, extended branch validation, new --initials option and get_git_initials helper, JSON output now includes INITIALS, and branch-name generation/length handling adjusted. Spec templates and guidance were modified to show initials-###-feature-name paths. PR template gains a checklist item to confirm review of AI-generated content. Backward-compatible handling for legacy numeric-only prefixes retained.

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Description check ⚠️ Warning No pull request description was provided by the author, leaving reviewers without context about the changes, rationale, or testing approach. Add a comprehensive description following the template, including: Why (problem/goal), What changed (behavioral/implementation notes), How to review, How to test, and backward compatibility details.
Docstring Coverage ⚠️ Warning Docstring coverage is 75.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (1 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly summarizes the main change: updating the branch naming scheme to support optional initials prefixes across the speckit system.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (2)
.github/pull_request_template.md (1)

73-73: Consider clarifying what "AI-generated content" means.

The checklist item is generic and may be unclear to PR authors. Consider specifying what types of AI-generated content should be reviewed (e.g., "AI-generated code changes", "AI-generated documentation", or "AI-generated PR summaries").

💡 Example clarification
-- [ ] I have reviewed AI generated content
+- [ ] I have reviewed AI-generated code/documentation (if applicable)

Or provide a comment above the checklist item explaining when this applies.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/pull_request_template.md at line 73, The checklist item "[ ] I have
reviewed AI generated content" is ambiguous; update the pull request template to
clarify what qualifies as AI-generated content by either replacing that single
line with more specific options like "[ ] I have reviewed AI-generated code
changes", "[ ] I have reviewed AI-generated documentation", and/or "[ ] I have
reviewed AI-generated PR summaries" or add a short explanatory comment above the
checkbox describing when it applies; locate and edit the exact checklist line in
.github/pull_request_template.md to implement one of these clearer alternatives.
.specify/scripts/bash/create-new-feature.sh (1)

302-316: No validation on --initials input format.

When provided via --initials, the value is used as-is with no check against the expected [a-z]{2,4} pattern. An invalid value (e.g., uppercase, too long, or containing special characters) would create a branch that fails check_feature_branch validation later. Consider adding a guard:

Proposed fix
 # Determine initials
 if [ -z "$INITIALS" ]; then
     if [ "$HAS_GIT" = true ]; then
         INITIALS=$(get_git_initials)
         if [ -z "$INITIALS" ]; then
             echo "Error: Could not determine initials from git config user.name." >&2
             echo "Set git config user.name or use --initials <initials>" >&2
             exit 1
         fi
     else
         echo "Error: No git available and --initials not provided." >&2
         echo "Use --initials <initials> to specify manually." >&2
         exit 1
     fi
 fi
+
+# Validate initials format (2-4 lowercase letters)
+INITIALS=$(echo "$INITIALS" | tr '[:upper:]' '[:lower:]')
+if [[ ! "$INITIALS" =~ ^[a-z]{2,4}$ ]]; then
+    echo "Error: Initials must be 2-4 lowercase letters, got: '$INITIALS'" >&2
+    exit 1
+fi
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.specify/scripts/bash/create-new-feature.sh around lines 302 - 316, The
script accepts --initials into the INITIALS variable without validating format,
which later causes check_feature_branch to fail; add a validation step after
INITIALS is set (whether from get_git_initials or the flag) to enforce
/^[a-z]{2,4}$/: if INITIALS contains uppercase, non-alpha chars, or wrong
length, print a clear error telling the user to provide lowercase 2–4 letters
(or auto-lowercase then re-validate), and exit non-zero; reference the INITIALS
variable, the existing get_git_initials branch, and check_feature_branch
validation so you validate immediately after assignment and before any branch
creation.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/pull_request_template.md:
- Line 73: Update the checklist item text "I have reviewed AI generated content"
to hyphenate the compound adjective by changing it to "I have reviewed
AI-generated content"; locate and edit the checkbox line in the pull request
template (the string "I have reviewed AI generated content") and replace it with
the hyphenated form to fix the grammar.

In @.specify/scripts/bash/create-new-feature.sh:
- Around line 98-127: get_git_initials currently leaves apostrophes, hyphens and
accented chars in the name which breaks the branch validation; sanitize and
normalize the name first (use iconv -t ascii//TRANSLIT if available to remove
diacritics, fall back to the original), then strip any non-letter characters
except spaces (e.g. sed 's/[^A-Za-z ]//g') into a cleaned variable, and use that
cleaned name for splitting into first_name/last_name and for the single-name
cut; ensure the same sanitized output meets the [a-z]{2,4} expectation so
check_feature_branch will accept the initials.

In `@dev/commands/speckit.specify.md`:
- Around line 60-61: The PowerShell example uses PowerShell-style parameters
(-Number, -ShortName) that the bash script
.specify/scripts/bash/create-new-feature.sh does not recognize; update the
PowerShell example to pass the same long flags the script parses (use --number
and --short-name) so both examples use
`.specify/scripts/bash/create-new-feature.sh --json --number 5 --short-name
"user-auth" "Add user authentication"`.

---

Nitpick comments:
In @.github/pull_request_template.md:
- Line 73: The checklist item "[ ] I have reviewed AI generated content" is
ambiguous; update the pull request template to clarify what qualifies as
AI-generated content by either replacing that single line with more specific
options like "[ ] I have reviewed AI-generated code changes", "[ ] I have
reviewed AI-generated documentation", and/or "[ ] I have reviewed AI-generated
PR summaries" or add a short explanatory comment above the checkbox describing
when it applies; locate and edit the exact checklist line in
.github/pull_request_template.md to implement one of these clearer alternatives.

In @.specify/scripts/bash/create-new-feature.sh:
- Around line 302-316: The script accepts --initials into the INITIALS variable
without validating format, which later causes check_feature_branch to fail; add
a validation step after INITIALS is set (whether from get_git_initials or the
flag) to enforce /^[a-z]{2,4}$/: if INITIALS contains uppercase, non-alpha
chars, or wrong length, print a clear error telling the user to provide
lowercase 2–4 letters (or auto-lowercase then re-validate), and exit non-zero;
reference the INITIALS variable, the existing get_git_initials branch, and
check_feature_branch validation so you validate immediately after assignment and
before any branch creation.

- [ ] [Changelog entry](../dev/guidelines/changelog.md) added (`uv run towncrier create ...`)
- [ ] External docs updated (if user-facing or ops-facing change)
- [ ] Internal .md docs updated (internal knowledge and AI code tools knowledge)
- [ ] I have reviewed AI generated content
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fix grammar: hyphenate "AI-generated".

When "AI generated" is used as a compound adjective modifying "content", it should be hyphenated.

📝 Proposed fix
-- [ ] I have reviewed AI generated content
+- [ ] I have reviewed AI-generated content
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- [ ] I have reviewed AI generated content
- [ ] I have reviewed AI-generated content
🧰 Tools
🪛 LanguageTool

[grammar] ~73-~73: Use a hyphen to join words.
Context: ...ools knowledge) - [ ] I have reviewed AI generated content

(QB_NEW_EN_HYPHEN)

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/pull_request_template.md at line 73, Update the checklist item text
"I have reviewed AI generated content" to hyphenate the compound adjective by
changing it to "I have reviewed AI-generated content"; locate and edit the
checkbox line in the pull request template (the string "I have reviewed AI
generated content") and replace it with the hyphenated form to fix the grammar.

Comment on lines 98 to 127
# Function to extract initials from git user.name
# Takes first letter of first name + first two letters of last name, lowercased
# Example: "Fatih Acar" -> "fac", "John Doe" -> "jdo"
get_git_initials() {
local full_name
full_name=$(git config user.name 2>/dev/null || echo "")

if [ -z "$full_name" ]; then
echo ""
return 1
fi

# Split into words, take first and last
local first_name last_name
first_name=$(echo "$full_name" | awk '{print $1}')
last_name=$(echo "$full_name" | awk '{print $NF}')

# If only one name provided, use first 3 chars of that name
if [ "$first_name" = "$last_name" ]; then
echo "$full_name" | tr '[:upper:]' '[:lower:]' | cut -c1-3
return 0
fi

# First letter of first name + first two letters of last name
local first_initial last_initials
first_initial=$(echo "$first_name" | tr '[:upper:]' '[:lower:]' | cut -c1)
last_initials=$(echo "$last_name" | tr '[:upper:]' '[:lower:]' | cut -c1-2)

echo "${first_initial}${last_initials}"
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

get_git_initials doesn't sanitize non-alpha characters from names.

Names containing apostrophes (O'Brien), hyphens (Smith-Jones), accented characters (José), or other non-[a-z] characters will produce initials that fail the [a-z]{2,4} validation regex in check_feature_branch. For example, "Fiona O'Brien" → "fo'", which would create a branch that doesn't pass validation.

Consider stripping non-alpha characters before extracting initials:

Proposed fix
     # First letter of first name + first two letters of last name
     local first_initial last_initials
-    first_initial=$(echo "$first_name" | tr '[:upper:]' '[:lower:]' | cut -c1)
-    last_initials=$(echo "$last_name" | tr '[:upper:]' '[:lower:]' | cut -c1-2)
+    first_initial=$(echo "$first_name" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z]//g' | cut -c1)
+    last_initials=$(echo "$last_name" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z]//g' | cut -c1-2)

And similarly for the single-name case:

     if [ "$first_name" = "$last_name" ]; then
-        echo "$full_name" | tr '[:upper:]' '[:lower:]' | cut -c1-3
+        echo "$full_name" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z]//g' | cut -c1-3
         return 0
     fi
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Function to extract initials from git user.name
# Takes first letter of first name + first two letters of last name, lowercased
# Example: "Fatih Acar" -> "fac", "John Doe" -> "jdo"
get_git_initials() {
local full_name
full_name=$(git config user.name 2>/dev/null || echo "")
if [ -z "$full_name" ]; then
echo ""
return 1
fi
# Split into words, take first and last
local first_name last_name
first_name=$(echo "$full_name" | awk '{print $1}')
last_name=$(echo "$full_name" | awk '{print $NF}')
# If only one name provided, use first 3 chars of that name
if [ "$first_name" = "$last_name" ]; then
echo "$full_name" | tr '[:upper:]' '[:lower:]' | cut -c1-3
return 0
fi
# First letter of first name + first two letters of last name
local first_initial last_initials
first_initial=$(echo "$first_name" | tr '[:upper:]' '[:lower:]' | cut -c1)
last_initials=$(echo "$last_name" | tr '[:upper:]' '[:lower:]' | cut -c1-2)
echo "${first_initial}${last_initials}"
}
# Function to extract initials from git user.name
# Takes first letter of first name + first two letters of last name, lowercased
# Example: "Fatih Acar" -> "fac", "John Doe" -> "jdo"
get_git_initials() {
local full_name
full_name=$(git config user.name 2>/dev/null || echo "")
if [ -z "$full_name" ]; then
echo ""
return 1
fi
# Split into words, take first and last
local first_name last_name
first_name=$(echo "$full_name" | awk '{print $1}')
last_name=$(echo "$full_name" | awk '{print $NF}')
# If only one name provided, use first 3 chars of that name
if [ "$first_name" = "$last_name" ]; then
echo "$full_name" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z]//g' | cut -c1-3
return 0
fi
# First letter of first name + first two letters of last name
local first_initial last_initials
first_initial=$(echo "$first_name" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z]//g' | cut -c1)
last_initials=$(echo "$last_name" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z]//g' | cut -c1-2)
echo "${first_initial}${last_initials}"
}
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.specify/scripts/bash/create-new-feature.sh around lines 98 - 127,
get_git_initials currently leaves apostrophes, hyphens and accented chars in the
name which breaks the branch validation; sanitize and normalize the name first
(use iconv -t ascii//TRANSLIT if available to remove diacritics, fall back to
the original), then strip any non-letter characters except spaces (e.g. sed
's/[^A-Za-z ]//g') into a cleaned variable, and use that cleaned name for
splitting into first_name/last_name and for the single-name cut; ensure the same
sanitized output meets the [a-z]{2,4} expectation so check_feature_branch will
accept the initials.

Comment on lines +60 to +61
- Bash example: `.specify/scripts/bash/create-new-feature.sh --json --number 5 --short-name "user-auth" "Add user authentication"`
- PowerShell example: `.specify/scripts/bash/create-new-feature.sh --json -Number 5 -ShortName "user-auth" "Add user authentication"`
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

PowerShell example uses parameter names the bash script doesn't recognize.

Line 61 passes -Number and -ShortName (PowerShell cmdlet-style), but the bash script only parses --number and --short-name. An AI agent following this example will get an error or silently misinterpret the arguments.

Proposed fix
-      - PowerShell example: `.specify/scripts/bash/create-new-feature.sh --json -Number 5 -ShortName "user-auth" "Add user authentication"`
+      - PowerShell example: `.specify/scripts/bash/create-new-feature.sh --json --number 5 --short-name "user-auth" "Add user authentication"`
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- Bash example: `.specify/scripts/bash/create-new-feature.sh --json --number 5 --short-name "user-auth" "Add user authentication"`
- PowerShell example: `.specify/scripts/bash/create-new-feature.sh --json -Number 5 -ShortName "user-auth" "Add user authentication"`
- Bash example: `.specify/scripts/bash/create-new-feature.sh --json --number 5 --short-name "user-auth" "Add user authentication"`
- PowerShell example: `.specify/scripts/bash/create-new-feature.sh --json --number 5 --short-name "user-auth" "Add user authentication"`
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@dev/commands/speckit.specify.md` around lines 60 - 61, The PowerShell example
uses PowerShell-style parameters (-Number, -ShortName) that the bash script
.specify/scripts/bash/create-new-feature.sh does not recognize; update the
PowerShell example to pass the same long flags the script parses (use --number
and --short-name) so both examples use
`.specify/scripts/bash/create-new-feature.sh --json --number 5 --short-name
"user-auth" "Add user authentication"`.

# Force base-10 interpretation to prevent octal conversion (e.g., 010 → 8 in octal, but should be 10 in decimal)
FEATURE_NUM=$(printf "%03d" "$((10#$BRANCH_NUMBER))")
BRANCH_NAME="${FEATURE_NUM}-${BRANCH_SUFFIX}"
BRANCH_NAME="${INITIALS}-${FEATURE_NUM}-${BRANCH_SUFFIX}"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could perhaps get to this later, but if we're looking at changing the existing files it could also be good to mention that we can add a suffix key to link any PR to a Jira issue. I.e. if the branch name ends with something like "-IFC-906" we can then see that the issue is linked to a PR from with Jira.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah I also thought including Jira IDs could be good, that would require asking the user for the ID during /speckit.specify I guess
We can come back to this later?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes

Signed-off-by: Fatih Acar <fatih@opsmill.com>
Signed-off-by: Fatih Acar <fatih@opsmill.com>
@fatih-acar fatih-acar force-pushed the fac-speckit-branch-naming branch from bfd456b to bcf3264 Compare February 17, 2026 11:42
Copy link
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (2)
.specify/scripts/bash/create-new-feature.sh (2)

367-368: JSON output built with printf is not safe against special characters.

If any of the interpolated values (particularly INITIALS, BRANCH_NAME, or SPEC_FILE) contain double quotes, backslashes, or other special characters, the JSON output will be malformed. Proper INITIALS validation (as suggested above) mitigates the INITIALS risk, and BRANCH_NAME/SPEC_FILE are already sanitized via clean_branch_name. Consider using jq for robust JSON construction if the tool is available, or at minimum document the safety invariant.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.specify/scripts/bash/create-new-feature.sh around lines 367 - 368, The JSON
emitted when JSON_MODE is true currently uses printf with unescaped
interpolations (BRANCH_NAME, SPEC_FILE, FEATURE_NUM, INITIALS) which will break
if values contain quotes/backslashes; update the JSON emission to construct JSON
safely: if jq is available use jq --null-input --arg BRANCH_NAME "$BRANCH_NAME"
--arg SPEC_FILE "$SPEC_FILE" --arg FEATURE_NUM "$FEATURE_NUM" --arg INITIALS
"$INITIALS" '{BRANCH_NAME:$BRANCH_NAME, SPEC_FILE:$SPEC_FILE,
FEATURE_NUM:$FEATURE_NUM, INITIALS:$INITIALS}' to produce well-formed JSON,
otherwise fallback to a safe JSON-encoder (eg python -c 'import json,sys;
print(json.dumps({...}))') or explicitly document the invariant and
validate/escape INITIALS and outputs from clean_branch_name before printing;
replace the printf branch under JSON_MODE with this safe construction and
include the new runtime jq/python check.

169-176: Branch parsing for new format is correct, minor inconsistency in sed pattern.

Line 171 uses sed 's/^[a-z]*-//' (unbounded *) to strip initials, while the guard on line 170 uses \{2,4\}. This works because the guard restricts entry, but aligning the sed to s/^[a-z]\{2,4\}-// would be more self-documenting.

📝 Proposed fix
-                number=$(echo "$clean_branch" | sed 's/^[a-z]*-//' | grep -o '^[0-9]\{3\}' || echo "0")
+                number=$(echo "$clean_branch" | sed 's/^[a-z]\{2,4\}-//' | grep -o '^[0-9]\{3\}' || echo "0")
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.specify/scripts/bash/create-new-feature.sh around lines 169 - 176, The sed
used to strip initials in the branch-parsing block should match the same
initials length as the grep guard: update the sed expression in the block that
processes clean_branch (the branch-parsing if that checks
'^[a-z]\{2,4\}-[0-9]\{3\}-') from using 's/^[a-z]*-//' to 's/^[a-z]\{2,4\}-//'
so the substitution self-documents the expected 2–4 letter initials and stays
consistent with the guard that detects that pattern.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.specify/scripts/bash/create-new-feature.sh:
- Around line 309-323: After INITIALS is set (from --initials,
OPSMILL_GIT_USER_SHORT, or get_git_initials) validate it against the required
lowercase-letter pattern /^[a-z]{2,4}$/ before proceeding: use a shell regex
check (e.g. [[ "$INITIALS" =~ ^[a-z]{2,4}$ ]]) or convert to lowercase then
test, and if it fails emit a clear error and exit non-zero; this prevents bad
branch names used by check_feature_branch and avoids corrupting the printf-based
JSON output—ensure you reference and validate INITIALS right after assignment
and before any use in branch creation or printf output.

---

Duplicate comments:
In @.github/pull_request_template.md:
- Line 73: Update the checklist item string "- [ ] I have reviewed AI generated
content" to hyphenate the compound adjective so it reads "- [ ] I have reviewed
AI-generated content"; locate and edit the checklist line in the pull request
template (the checklist item text) to apply the grammar fix.

In @.specify/scripts/bash/create-new-feature.sh:
- Around line 98-134: Sanitize and ASCII-normalize the name before extracting
initials in get_git_initials: after computing full_name, run it through iconv -t
ascii//TRANSLIT (fallback to original if iconv missing) and then strip
non-letter chars with sed 's/[^A-Za-z]//g' for first_name and last_name, then
lowercase and cut from those sanitized variables (replace uses of first_name,
last_name, first_initial, last_initials with sanitized versions) so names like
O'Brien, Smith-Jones, or José produce valid [a-z]{2,4} initials.

---

Nitpick comments:
In @.specify/scripts/bash/create-new-feature.sh:
- Around line 367-368: The JSON emitted when JSON_MODE is true currently uses
printf with unescaped interpolations (BRANCH_NAME, SPEC_FILE, FEATURE_NUM,
INITIALS) which will break if values contain quotes/backslashes; update the JSON
emission to construct JSON safely: if jq is available use jq --null-input --arg
BRANCH_NAME "$BRANCH_NAME" --arg SPEC_FILE "$SPEC_FILE" --arg FEATURE_NUM
"$FEATURE_NUM" --arg INITIALS "$INITIALS" '{BRANCH_NAME:$BRANCH_NAME,
SPEC_FILE:$SPEC_FILE, FEATURE_NUM:$FEATURE_NUM, INITIALS:$INITIALS}' to produce
well-formed JSON, otherwise fallback to a safe JSON-encoder (eg python -c
'import json,sys; print(json.dumps({...}))') or explicitly document the
invariant and validate/escape INITIALS and outputs from clean_branch_name before
printing; replace the printf branch under JSON_MODE with this safe construction
and include the new runtime jq/python check.
- Around line 169-176: The sed used to strip initials in the branch-parsing
block should match the same initials length as the grep guard: update the sed
expression in the block that processes clean_branch (the branch-parsing if that
checks '^[a-z]\{2,4\}-[0-9]\{3\}-') from using 's/^[a-z]*-//' to
's/^[a-z]\{2,4\}-//' so the substitution self-documents the expected 2–4 letter
initials and stays consistent with the guard that detects that pattern.

Comment on lines +309 to +323
# Determine initials
if [ -z "$INITIALS" ]; then
if [ "$HAS_GIT" = true ]; then
INITIALS=$(get_git_initials)
if [ -z "$INITIALS" ]; then
echo "Error: Could not determine initials." >&2
echo "Set OPSMILL_GIT_USER_SHORT, git config user.name, or use --initials <initials>" >&2
exit 1
fi
else
echo "Error: No git available and --initials not provided." >&2
echo "Use --initials <initials> to specify manually." >&2
exit 1
fi
fi
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Missing validation of INITIALS against the expected [a-z]{2,4} pattern.

INITIALS is used unchecked from three sources (--initials, OPSMILL_GIT_USER_SHORT, get_git_initials), none of which validate the final value. Invalid initials (e.g., containing digits, uppercase, special characters, or wrong length) will produce branch names that fail check_feature_branch validation later—and corrupt the printf-based JSON output on line 368 if they contain quotes.

Add a validation gate after INITIALS is determined:

📝 Proposed fix
     fi
 fi
 
+# Validate initials format
+if [[ ! "$INITIALS" =~ ^[a-z]{2,4}$ ]]; then
+    echo "Error: Initials '$INITIALS' must be 2-4 lowercase letters." >&2
+    echo "Use --initials <initials> to specify manually." >&2
+    exit 1
+fi
+
 # Force base-10 interpretation ...
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Determine initials
if [ -z "$INITIALS" ]; then
if [ "$HAS_GIT" = true ]; then
INITIALS=$(get_git_initials)
if [ -z "$INITIALS" ]; then
echo "Error: Could not determine initials." >&2
echo "Set OPSMILL_GIT_USER_SHORT, git config user.name, or use --initials <initials>" >&2
exit 1
fi
else
echo "Error: No git available and --initials not provided." >&2
echo "Use --initials <initials> to specify manually." >&2
exit 1
fi
fi
# Determine initials
if [ -z "$INITIALS" ]; then
if [ "$HAS_GIT" = true ]; then
INITIALS=$(get_git_initials)
if [ -z "$INITIALS" ]; then
echo "Error: Could not determine initials." >&2
echo "Set OPSMILL_GIT_USER_SHORT, git config user.name, or use --initials <initials>" >&2
exit 1
fi
else
echo "Error: No git available and --initials not provided." >&2
echo "Use --initials <initials> to specify manually." >&2
exit 1
fi
fi
# Validate initials format
if [[ ! "$INITIALS" =~ ^[a-z]{2,4}$ ]]; then
echo "Error: Initials '$INITIALS' must be 2-4 lowercase letters." >&2
echo "Use --initials <initials> to specify manually." >&2
exit 1
fi
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.specify/scripts/bash/create-new-feature.sh around lines 309 - 323, After
INITIALS is set (from --initials, OPSMILL_GIT_USER_SHORT, or get_git_initials)
validate it against the required lowercase-letter pattern /^[a-z]{2,4}$/ before
proceeding: use a shell regex check (e.g. [[ "$INITIALS" =~ ^[a-z]{2,4}$ ]]) or
convert to lowercase then test, and if it fails emit a clear error and exit
non-zero; this prevents bad branch names used by check_feature_branch and avoids
corrupting the printf-based JSON output—ensure you reference and validate
INITIALS right after assignment and before any use in branch creation or printf
output.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

group/ci Issue related to the CI pipeline

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants