* chore(agents): defines a new AGENTS.md focused on reporting vulnerabilities
* chore(security): makes SECURITY.md the source of truth
* Fix typos in SECURITY.md and minor grammar correction
* chore(security): clarify public GitHub repo PoC counts as disclosure
Per @ppkarwasz review on #1680: expand the PoC bullet to make explicit
that pushing a PoC to a public GitHub repo, gist, fork, or branch is
public disclosure, and note that private repos require granting access
to each PMC member individually.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: René Gielen <rgielen@apache.org>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Apply recommendations from CLAUDE.md benchmarking study (1,188 tests
across 3 models): remove redundant generic instructions, reframe
prohibitions as positive directives, trim inferable content, and
keep only project-specific knowledge that Claude cannot derive from
the codebase itself. Reduces file from 142 to 64 lines.
Key changes:
- Remove Common Pitfalls (negative framing, generic, duplicated)
- Remove Available Tools section (redundant with system prompt)
- Trim build commands to project-specific flags only
- Collapse Technology Stack into one-line overview
- Reframe security directives from "never do X" to "do Y instead"
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
Simplify the Claude Code guidance document by:
- Condensing verbose descriptions into concise bullet points
- Adding current version info (7.2.0-SNAPSHOT)
- Improving build commands section with more examples
- Reorganizing architecture section for better readability
- Streamlining security patterns section
- Adding clear request lifecycle diagram
- Consolidating available tools into organized sections
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude <noreply@anthropic.com>
* WW-5444 Defines new html5 theme
* feat(themes): move html5 theme from showcase to core
- Move 42 FreeMarker templates to core/src/main/resources/template/html5/
- Remove duplicate templates from showcase
- Makes html5 theme available to all applications via struts2-core.jar
- Enables unit testing in core module
- Fix Html5Action import from XWork2 to Struts2 package
- Add Apache license header to Html5Action
Resolves WW-5444
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* docs: add implementation plan for html5 theme migration
Add detailed implementation plan documenting the migration of html5 theme
from showcase to core, including step-by-step instructions, verification
procedures, and acceptance criteria.
Related to WW-5444
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* test(html5-theme): add comprehensive unit tests and fix template variables
- Add testGenericHtml5() methods to 13 UI tag test classes
- Create theme.properties with parent=simple configuration
- Migrate all 32 HTML5 templates from deprecated 'parameters' to 'attributes' variable
- Exclude DoubleSelect and UpDownSelect (not supported in HTML5 theme)
- All 26 HTML5 theme tests passing (100% success rate)
Components tested: Textfield, Textarea, Password, Checkbox, CheckboxList,
Radio, Select, File, Hidden, Label, ComboBox, Reset, Submit
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* docs: update CLAUDE.md and remove jakarta-migration-helper agent
- Update CLAUDE.md with current project guidelines
- Update test-runner agent documentation
- Remove deprecated jakarta-migration-helper agent
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* Adds missing header
* test(html5-theme): complete unit test coverage for remaining 5 tag classes
Add HTML5 theme tests to ActionErrorTagTest, ActionMessageTagTest,
FieldErrorTagTest, AnchorTest, and FormTagTest. This completes Phase 1
of the HTML5 theme testing plan.
Changes:
- Add 24 new HTML5 theme unit tests across 5 test classes
- Create 17 expected output files for HTML5 theme validation
- Test coverage: action errors, action messages, field errors, anchors, and forms
- All tests verify HTML5 clean markup without table-based layouts
Coverage: 18 of 18 UI tag test classes now have HTML5 tests (100%)
Tests passing: 24/24 HTML5 tests successful
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* test(html5-theme): add integration tests for showcase application
- Create Html5TagExampleTest with 5 comprehensive integration tests
- Add fielderror tag demonstration to html5/index.jsp
- Validate HTML5 theme rendering, error display, and clean markup
- All tests passing (5/5) with HtmlUnit and Jetty integration
Tests validate:
- Page load and HTTP status (200)
- Action errors, messages, and field errors display
- Clean semantic markup (ul lists, no table layouts)
- Anchor tag rendering
- Namespace isolation under /html5
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* feat(html5-theme): WW-5444 replace FreeMarker compress with Struts compress tag
- Create CompressModel.java to enable <@s.compress> in FreeMarker templates
- Register compress tag in StrutsModels.java for @s namespace access
- Migrate all 29 HTML5 theme templates from <#compress> to <@s.compress>
- Maintain identical compression behavior (uses same >\\s+< regex pattern)
- All 153 HTML5 theme unit tests pass without modification
This change leverages the new configurable Compress component (WW-5256)
which provides devMode awareness and security protections while maintaining
the same whitespace removal behavior as FreeMarker's built-in directive.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
* feat(html5-theme): WW-5444 simplifies tags templates and extends example
---------
Co-authored-by: Claude <noreply@anthropic.com>
* chore(docs): remove obsolete Claude Code configurations
Remove outdated and conflicting Claude Code agent and command files:
- jakarta-migration-helper agent (no longer needed for this project phase)
- run_tests command (replaced by test-runner agent)
- commit command (conflicts with commit_guideline.md)
These files were creating confusion and conflicts with the established
workflow guidelines in commit_guideline.md.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* docs(testing): improve test execution guidance
Update test-runner agent and CLAUDE.md with clearer test execution approach:
- Simplify test-runner agent description to be more direct
- Add tools field (bash_tool, view, str_replace) to agent metadata
- Replace /run_tests command reference with priority-based approach
- Document test execution priority: JetBrains MCP > test-runner agent > Maven
- Clarify when to use each test execution method
- Remove obsolete command from available commands list
This provides clearer guidance on test execution while maintaining flexibility
for different development environments.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
* fix(core): make Preparable.prepare() a default method
Allow actions to implement only per-method variants like prepareInput(),
prepareEdit() without requiring an empty prepare() override.
Fixes WW-5588
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
* docs: add PR guidelines requiring Jira ticket ID and link
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
- Add 5 specialized agents: security-analyzer, test-runner, code-quality-checker, config-validator, jakarta-migration-helper
- Add 4 new commands: security_scan, run_tests, quality_check, config_analyze
- Reduce CLAUDE.md from 271 to ~120 lines (55% reduction) by extracting procedural knowledge into automation
- Maintain all security principles and quality standards while improving developer workflow
- Enable guided, consistent application of Apache Struts best practices through intelligent automation
The new system provides expert-level guidance without requiring developers to memorize complex procedures,
improving both productivity and code quality consistency across the project.
Lukasz Lenart