This is an automated email from the ASF dual-hosted git repository.
lukaszlenart pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/struts.git
The following commit(s) were added to refs/heads/main by this push:
new 3e428e438 docs: drop derivable layout and architecture sections from
CLAUDE.md (#1977)
3e428e438 is described below
commit 3e428e43879548af39293dd74a92e2e5ccfbef56
Author: Lukasz Lenart <[email protected]>
AuthorDate: Fri Sep 25 10:53:00 2026 +0200
docs: drop derivable layout and architecture sections from CLAUDE.md (#1977)
CLAUDE.md is loaded into every Claude Code session. The Project Structure
tree and the Core Architecture tour restate what `ls` and the source already
show, and the Testing section repeated the build command listed above it.
Keep what a session cannot derive: the version gotcha, the non-standard
build flags, security patterns and pointers, the JUnit 3/4 trap, PR rules.
The Copilot code-review skill described CLAUDE.md by the removed sections;
point it at what the file still covers.
Co-authored-by: Claude Opus 5.5 <[email protected]>
---
.github/skills/code-review/SKILL.md | 2 +-
CLAUDE.md | 27 ---------------------------
2 files changed, 1 insertion(+), 28 deletions(-)
diff --git a/.github/skills/code-review/SKILL.md
b/.github/skills/code-review/SKILL.md
index 0d8680a50..8bf698e6d 100644
--- a/.github/skills/code-review/SKILL.md
+++ b/.github/skills/code-review/SKILL.md
@@ -14,7 +14,7 @@ tend to go wrong in this codebase.
Deeper references, when a review needs them:
-- [`CLAUDE.md`](../../../CLAUDE.md) — build commands, module layout, request
lifecycle
+- [`CLAUDE.md`](../../../CLAUDE.md) — build commands, test style (JUnit 3 vs
4), PR conventions
- [`SECURITY.md`](../../../SECURITY.md) — the vulnerability reporting process
(source of truth)
- [`THREAT_MODEL.md`](../../../THREAT_MODEL.md) — scope, trust boundaries,
known non-findings
- [`AGENTS.md`](../../../AGENTS.md) — rules for AI agents working on security
findings
diff --git a/CLAUDE.md b/CLAUDE.md
index 5f4bf19bb..2419ff6ff 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -23,31 +23,6 @@ mvn test -DskipAssembly -pl core
-Dtest=MyClassTest#testMethodName
mvn clean install -Pjakartaee11
```
-### Project Structure
-
-```
-struts/
-├── core/ # struts2-core - main framework
-├── plugins/ # Plugin modules (json, rest, spring, tiles, velocity,
etc.)
-├── apps/ # Sample applications (showcase, rest-showcase)
-├── assembly/ # Distribution packaging
-├── bom/ # Bill of Materials for dependency management
-├── parent/ # Parent POM with shared configuration
-└── jakarta/ # Jakarta EE compatibility modules
-```
-
-### Core Architecture
-
-**Request Lifecycle**: `Dispatcher` → `ActionProxy` → `ActionInvocation` →
Interceptor stack → `Action` → Result
-
-Key packages in `org.apache.struts2`:
-
-- `dispatcher` - Request handling, `Dispatcher`, servlet integration
-- `interceptor` - Built-in interceptors (params, validation, fileUpload)
-- `components` - UI tag components (form, textfield, submit)
-- `action` - Action interfaces (`UploadedFilesAware`, `SessionAware`, etc.)
-- `security` - Security utilities and OGNL member access policies
-
## Security-Critical Patterns
Apache Struts has a history of security vulnerabilities (OGNL injection, temp
file exploits). Apply these Struts-specific patterns:
@@ -77,8 +52,6 @@ closed as application responsibility or non-default
configuration rather than as
## Testing
-Run with `mvn test -DskipAssembly`.
-
**Tests are JUnit 4 — there is no JUnit 5 anywhere in this repo.**
`parent/pom.xml` declares
`junit:junit:4.13.2`; there are zero `org.junit.jupiter` imports. Two styles
coexist:
