Update development plan based on comprehensive code review

[yukifoo]

Summary

This PR updates the development plan based on the comprehensive code review findings, shifting from a feature-first to a security-first approach with staged development phases.

Key Changes

• Security-first approach: Prioritizes immediate fixes for critical security issues
• Staged development phases: Implements quality-focused development with clear dependencies
• Realistic success metrics: Adjusts targets based on current codebase maturity
• Technical debt resolution: Includes specific plan for addressing identified issues

Immediate Actions Required

1. Security fixes (CRITICAL priority):

   • pkg/config/config.go:77 - Secure file permissions (0600)
   • pkg/api/client.go:17 - HTTP client timeout configuration
   • pkg/format/table.go:40,45 - Error handling improvements

2. CI/CD optimization:

   • Re-enable GitHub Actions caching
   • Optimize build performance

Development Phase Overview

• Phase 1 (Week 1): Foundation security and CI/CD optimization
• Phase 2 (Week 2): Secure authentication system implementation
• Phase 3 (Week 3): Issue management MVP with proper error handling
• Phase 4 (Week 4+): Feature expansion with comprehensive testing

Success Metrics (Revised)

• Security issues: Zero tolerance
• Test coverage: 60%+ (Phase 1-2), 80%+ (Phase 3-4)
• CI/CD performance: 50% improvement
• MVP completion: Week 3 target

Risk Mitigation

• Regular security reviews
• Staged implementation with quality gates
• Continuous monitoring and testing

🤖 Generated with Claude Code

[Copilot]

Pull Request Overview

This PR revises the Backlog CLI development plan to a security-first, staged approach and makes preliminary code and CI/CD updates to align with that plan.

• Updates plan.md with new security-focused phases, success metrics, and immediate action items
• Adjusts TableFormatter to use the updated tablewriter API and adds basic unit tests
• Modifies config directory permissions and adds CI/CD workflow configurations

Reviewed Changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
plan.md	Revised development plan with security-first phases and metrics
pkg/format/table.go	Updated TableFormatter to new tablewriter API and simplified defaults
pkg/format/table_test.go	Added basic tests for TableFormatter
pkg/config/config.go	Changed config directory creation to 0o750 permissions
pkg/api/client.go	Added package comment but missing HTTP client timeout setup
cmd/bl/main.go	Introduces the root bl command for the CLI
.github/workflows/ci.yml	Commented-out caching steps (temporarily disabled)
.github/workflows/release.yml	Enabled Go module caching for faster releases
.golangci.yml	Comprehensive linting rules including security linters
.github/dependabot.yml	Configured weekly dependency updates
CLAUDE.md	Updated status of CI/CD and next tasks

Comments suppressed due to low confidence (5)

pkg/api/client.go:4

• Timeout for the HTTP client is not configured. As noted in the plan, you should instantiate an http.Client with a Timeout field (e.g., &http.Client{Timeout: 30 * time.Second}) to avoid hanging requests.

import (

plan.md:137

• The plan indicates replacing viper.WriteConfigAs with os.WriteFile to enforce 0600 permissions, but the implementation in pkg/config/config.go hasn't been updated accordingly. Please sync the code to reflect this change or update the plan.

// 修正後: os.WriteFile(configPath, data, 0600)

plan.md:142

• The plan shows setting an HTTP client timeout, but pkg/api/client.go lacks this implementation. Please update the code to match the plan.

httpClient := &http.Client{

pkg/config/config.go:73

• The Save method now sets directory permissions to 0o750 but still uses viper.WriteConfigAs for file writes, which defaults to 0644. Consider writing the config file with os.WriteFile and 0600 permissions to secure sensitive information as intended.

	if err := os.MkdirAll(configDir, 0o750); err != nil {

.github/workflows/ci.yml:31

• Caching Go modules is commented out in CI; re-enable these steps to improve build performance as outlined in the development plan.

      # - name: Cache Go modules

[Copilot]

[nitpick] The error returned by t.table.Append is ignored. Consider handling or logging this error so any failures in appending rows can be detected.

Suggested change

	_ = t.table.Append(rowAny...)
	if err := t.table.Append(rowAny...); err != nil {
	log.Printf("failed to append row: %v", err)
	}

[Copilot]

[nitpick] The error returned by t.table.Render is ignored. It may be beneficial to return or log errors for better debugging if rendering fails.