This is an automated email from the ASF dual-hosted git repository. lukaszlenart pushed a commit to branch docs/trim-derivable-claude-md in repository https://gitbox.apache.org/repos/asf/struts.git
commit 180ad1798facbf372c54875e705181065a0d5b8e Author: Lukasz Lenart <[email protected]> AuthorDate: Fri Sep 25 10:48:19 2026 +0200 docs: drop derivable layout and architecture sections from CLAUDE.md CLAUDE.md is loaded into every Claude Code session. The Project Structure tree and the Core Architecture tour restate what `ls` and the source already show, and the Testing section repeated the build command listed above it. Keep what a session cannot derive: the version gotcha, the non-standard build flags, security patterns and pointers, the JUnit 3/4 trap, PR rules. The Copilot code-review skill described CLAUDE.md by the removed sections; point it at what the file still covers. Co-Authored-By: Claude Opus 5.5 <[email protected]> --- .github/skills/code-review/SKILL.md | 2 +- CLAUDE.md | 27 --------------------------- 2 files changed, 1 insertion(+), 28 deletions(-) diff --git a/.github/skills/code-review/SKILL.md b/.github/skills/code-review/SKILL.md index 0d8680a50..8bf698e6d 100644 --- a/.github/skills/code-review/SKILL.md +++ b/.github/skills/code-review/SKILL.md @@ -14,7 +14,7 @@ tend to go wrong in this codebase. Deeper references, when a review needs them: -- [`CLAUDE.md`](../../../CLAUDE.md) — build commands, module layout, request lifecycle +- [`CLAUDE.md`](../../../CLAUDE.md) — build commands, test style (JUnit 3 vs 4), PR conventions - [`SECURITY.md`](../../../SECURITY.md) — the vulnerability reporting process (source of truth) - [`THREAT_MODEL.md`](../../../THREAT_MODEL.md) — scope, trust boundaries, known non-findings - [`AGENTS.md`](../../../AGENTS.md) — rules for AI agents working on security findings diff --git a/CLAUDE.md b/CLAUDE.md index 5f4bf19bb..2419ff6ff 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -23,31 +23,6 @@ mvn test -DskipAssembly -pl core -Dtest=MyClassTest#testMethodName mvn clean install -Pjakartaee11 ``` -### Project Structure - -``` -struts/ -├── core/ # struts2-core - main framework -├── plugins/ # Plugin modules (json, rest, spring, tiles, velocity, etc.) -├── apps/ # Sample applications (showcase, rest-showcase) -├── assembly/ # Distribution packaging -├── bom/ # Bill of Materials for dependency management -├── parent/ # Parent POM with shared configuration -└── jakarta/ # Jakarta EE compatibility modules -``` - -### Core Architecture - -**Request Lifecycle**: `Dispatcher` → `ActionProxy` → `ActionInvocation` → Interceptor stack → `Action` → Result - -Key packages in `org.apache.struts2`: - -- `dispatcher` - Request handling, `Dispatcher`, servlet integration -- `interceptor` - Built-in interceptors (params, validation, fileUpload) -- `components` - UI tag components (form, textfield, submit) -- `action` - Action interfaces (`UploadedFilesAware`, `SessionAware`, etc.) -- `security` - Security utilities and OGNL member access policies - ## Security-Critical Patterns Apache Struts has a history of security vulnerabilities (OGNL injection, temp file exploits). Apply these Struts-specific patterns: @@ -77,8 +52,6 @@ closed as application responsibility or non-default configuration rather than as ## Testing -Run with `mvn test -DskipAssembly`. - **Tests are JUnit 4 — there is no JUnit 5 anywhere in this repo.** `parent/pom.xml` declares `junit:junit:4.13.2`; there are zero `org.junit.jupiter` imports. Two styles coexist:
