feat(github): open on-host images so they draw inline #91

deadstyle · 2026-10-09T10:16:58-05:00

deadstyle commented

2026-10-09 10:16:58 -05:00

Summary

On GitHub, an image hosted on github.com that sits alone in its own paragraph of a PR or issue body (github.com/user-attachments/assets/…) now draws inline in the Details pane, as it already does on Forgejo. This works for public repos. A private repo's image stays an 🖼 alt link. design.md → Images already says that's what happens when an image fails to load.

Refs #87 (part of #83)

Live check (recorded on #87)

On 2026-10-09, an attachment from a public repo answered with a redirect to signed Amazon S3 storage, with or without a token. Following the redirect returned the file. I couldn't test a private repo live because no private repo on the test account has an attachment. GitHub is widely reported to serve those only to a signed-in browser.

Security

The token goes only to the session's web-root origin.
It's dropped on every hop off that origin, including another port or a subdomain. Go's default redirect rule would forward it there.
Error messages never carry the signed storage URL or its query string.
Job logs (#85) and images share one redirect helper.

Verification

make check after merging develop:

golangci-lint run
0 issues.
(all test packages ok)
No vulnerabilities found.
go build -ldflags "-X main.version=bd0355b" -o bin/lazyforge ./cmd/lazyforge
/bin/sh: line 1: shellcheck: command not found

shellcheck isn't installed locally. No shell files changed, and CI runs it.

The three forgetest.RunContract OpenAsset cases now run and pass on GitHub. Before this change they were skipped.

Mutation checks:

With the token drop removed, the test fails with "token sent to the asset host".
With the token never sent, the contract cases fail.

Review

Three fresh reviewers ran: standards, comments and spec. Standards and spec passed. I reworded two comments.

Dismissed: sending the token to any path on github.com, not just /user-attachments/. It's the same origin and the same party, which matches the gitea adapter's rule.

Docs

ADR 0017 gains an Images bullet. architecture.md and design.md are unchanged.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QhCwUhPRAFrAziCumaEa67

## Summary On GitHub, an image hosted on github.com that sits alone in its own paragraph of a PR or issue body (`github.com/user-attachments/assets/…`) now draws inline in the Details pane, as it already does on Forgejo. This works for public repos. A private repo's image stays an `🖼 alt` link. design.md → Images already says that's what happens when an image fails to load. Refs #87 (part of #83) ## Live check (recorded on #87) On 2026-10-09, an attachment from a public repo answered with a redirect to signed Amazon S3 storage, with or without a token. Following the redirect returned the file. I couldn't test a private repo live because no private repo on the test account has an attachment. GitHub is widely reported to serve those only to a signed-in browser. ## Security - The token goes only to the session's web-root origin. - It's dropped on every hop off that origin, including another port or a subdomain. Go's default redirect rule would forward it there. - Error messages never carry the signed storage URL or its query string. - Job logs (#85) and images share one redirect helper. ## Verification `make check` after merging develop: ``` golangci-lint run 0 issues. (all test packages ok) No vulnerabilities found. go build -ldflags "-X main.version=bd0355b" -o bin/lazyforge ./cmd/lazyforge /bin/sh: line 1: shellcheck: command not found ``` `shellcheck` isn't installed locally. No shell files changed, and CI runs it. The three `forgetest.RunContract` OpenAsset cases now run and pass on GitHub. Before this change they were skipped. Mutation checks: - With the token drop removed, the test fails with "token sent to the asset host". - With the token never sent, the contract cases fail. ## Review Three fresh reviewers ran: standards, comments and spec. Standards and spec passed. I reworded two comments. Dismissed: sending the token to any path on github.com, not just `/user-attachments/`. It's the same origin and the same party, which matches the gitea adapter's rule. ## Docs ADR 0017 gains an Images bullet. `architecture.md` and `design.md` are unchanged. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01QhCwUhPRAFrAziCumaEa67

deadstyle added 3 commits

2026-10-09 10:16:58 -05:00

feat(github): open on-host images so they draw inline dc82d881cd

The GitHub adapter implements AssetReader for images on the session's
web root (github.com/user-attachments). The token goes only to the web
root and is dropped on the signed storage redirect. Private-repo
attachments need a browser session, so they stay links.

Refs #87

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QhCwUhPRAFrAziCumaEa67

docs(github): tighten OpenAsset and assetLabel comments 80a52d73cf

Refs #87

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QhCwUhPRAFrAziCumaEa67

Merge remote-tracking branch 'origin/develop' into feature/87-github-inline-images

ci / check (pull_request) Successful in 1m4s

Details

bd0355ba36

deadstyle merged commit 0d2da21f5d into develop

2026-10-09 10:18:27 -05:00

deadstyle deleted branch feature/87-github-inline-images

2026-10-09 10:18:27 -05:00

deadstyle referenced this pull request

2026-10-09 10:18:27 -05:00

Show inline images on GitHub #87

deadstyle referenced this pull request

2026-10-09 10:18:27 -05:00

Add a GitHub adapter #83

deadstyle referenced this pull request from a commit

2026-10-09 10:18:28 -05:00

feat(github): open on-host images so they draw inline (#91)

Sign in to join this conversation.

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

deadstyle/lazyforge!91

Rows
Columns