[TGTGamer]

Adds a linksIssue condition. It passes when a pull request's description
closes an issue with one of GitHub's closing keywords (#12, owner/repo#12,
an issue URL or a Linear key), or its head branch or title carries a Linear
key. Optional keys limit Linear keys to the listed teams.

The description, branch and title come from the event, so the condition
costs no API call. Issues linked only from the sidebar are not seen; that
would need a GraphQL lookup per pull request.

Closes SMC-55

---

Note

Medium Risk
New condition logic drives convention and policy outcomes; parsing edge cases are tested but could still surprise repos that omit keys or rely on sidebar-only issue links.

Overview
Adds a new linksIssue pull-request condition so conventions and other rules can require (or forbid) tying a PR to tracked work without extra GitHub API calls.

Evaluation uses only the event payload: closing references in the body (GitHub close/fix/resolve keywords plus #n, cross-repo refs, issue URLs, or Linear keys), with keywords inside fenced or inline code ignored; otherwise a Linear team key in the head branch or title. Optional keys restricts which Linear teams count and tightens title matching to avoid false positives like utf-8. linksIssue is registered in the Effect schema, JSON Schema, docs, and PULL_REQUEST_ONLY handling (issues get “only applies to pull requests”). Reports explain the first match found (description, then branch, then title).

^{Reviewed by Cursor Bugbot for commit f3ecf73. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_cc65c7f1-9572-4b1b-820b-c5bcb1cc74db)

[linear-code]

SMC-55

[qodo-code-review]

PR Summary by Qodo

Add linksIssue condition for pull requests tied to issues

✨ Enhancement 🧪 Tests 📝 Documentation ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Adds linksIssue detection for GitHub closing references and Linear keys.
• Supports optional Linear team filtering without additional GitHub API requests.
• Documents and tests matching, validation, reporting, and pull-request-only behavior.

Diagram

graph TD
  Config["linksIssue config"] --> Eval["Condition evaluator"] --> Body{"Closing reference?"}
  Event["PR event"] --> Eval
  Body -->|Yes| Result["Condition result"]
  Body -->|No| Branch{"Branch key?"} -->|Yes| Result
  Branch -->|No| Title{"Title key?"} --> Result

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Query GitHub linked issues

• ➕ Detects issues linked through the pull-request sidebar
• ➕ Uses GitHub’s canonical relationship instead of textual conventions
• ➖ Requires a GraphQL request for each evaluated pull request
• ➖ Adds latency, rate-limit usage, permissions, caching, and failure handling
• ➖ May increase stale-sweep costs substantially

2. Payload-first hybrid lookup

• ➕ Preserves zero-cost matching for conventional links
• ➕ Can fall back to GitHub for sidebar-only relationships
• ➖ Produces variable evaluation cost and behavior
• ➖ Still requires GraphQL integration and cache policy
• ➖ Needs configuration to control completeness versus API usage

Recommendation: Keep the payload-only implementation as the default because it is deterministic, fast, and requires no new facets or API permissions. Consider an explicit opt-in GraphQL-backed mode only if detecting sidebar-only links becomes a firm completeness requirement.

Files changed (8) +228 / -2

Enhancement (3) +77 / -0

evaluate.tsEvaluate issue links from pull-request event fields +34/-0

Evaluate issue links from pull-request event fields

• Detects GitHub closing references and Linear keys in the description, head branch, or title, respecting optional team filters. Returns prioritized match details and classifies the condition as pull-request-only without requesting facets.

packages/conditions/src/evaluate.ts

index.tsExport the LinksIssue schema +1/-0

Export the LinksIssue schema

• Exposes 'LinksIssue' through the conditions package’s public API.

packages/conditions/src/index.ts

schema.tsDefine the linksIssue condition schema +42/-0

Define the linksIssue condition schema

• Adds the boolean 'linksIssue' condition with an optional non-empty list of validated Linear team keys. Registers it in the leaf condition union and documents its semantics.

packages/conditions/src/schema.ts

Tests (2) +89 / -0

evaluate.spec.tsCover linksIssue evaluation and reporting +85/-0

Cover linksIssue evaluation and reporting

• Tests positive and negative booleans, GitHub reference forms, Linear team filtering, case rules, token boundaries, source precedence, missing branches, issue rejection, and zero-facet evaluation.

tests/conditions/src/evaluate.spec.ts

schema.spec.tsValidate linksIssue schema inputs +4/-0

Validate linksIssue schema inputs

• Adds accepted condition variants and rejects empty key lists or malformed Linear team keys.

tests/conditions/src/schema.spec.ts

Documentation (2) +29 / -2

conditions.mdxDocument linksIssue matching behavior and limitations +16/-1

Document linksIssue matching behavior and limitations

• Adds the condition to the overview and explains supported closing references, Linear key matching, team filtering, stale-sweep behavior, and the sidebar-link limitation. Marks it as pull-request-only and provides YAML configuration.

docs/conditions.mdx

configuration.mdxAdd linksIssue configuration reference +13/-1

Add linksIssue configuration reference

• Adds 'linksIssue' to the condition union reference and documents its required boolean plus optional non-empty Linear team key list.

docs/reference/configuration.mdx

Other (1) +33 / -0

smartcloud.schema.jsonPublish linksIssue in the generated configuration schema +33/-0

Publish linksIssue in the generated configuration schema

• Adds the 'linksIssue' object definition, team-key validation, and condition-union reference for editor and configuration validation.

schema/smartcloud.schema.json

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. Release pull requests falsely pass ✗ Dismissed 🔴 Required 🐞 Bug ≡ Correctness

Description

issueLink accepts every matching closing reference without checking whether subject.baseBranch
is the repository's default branch. On pull requests targeting release or feature branches, GitHub
creates no link from the keyword, but linksIssue: true still passes.

Code

packages/conditions/src/evaluate.ts[R179-182]

+  const closes = [...subject.body.matchAll(CLOSING)]
+    .map((match) => match[1] ?? '')
+    .find((ref) => ref.includes('#') || ref.includes('/') || key.test(ref))
+  if (closes !== undefined) return `closes ${closes}`

Relevance

●●● Strong

Accepted precedent supports correcting missing base-branch handling in evaluate.ts.

PR-#658

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The evaluator scans the body and returns a closing reference without consulting the available base
branch, while the normalized subject has no repository-default-branch field. GitHub's documentation
explicitly says closing keywords are ignored and create no link when the pull request targets a
non-default branch.

packages/conditions/src/evaluate.ts[177-186]
packages/conditions/src/subject.ts[162-184]
packages/engine/src/events.ts[191-202]
🌐 GitHub states that closing keywords are interpreted only for pull requests targeting the default branch; otherwise no links are created.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`linksIssue` treats closing keywords as links for every pull request target, although GitHub only interprets them when the pull request targets the repository's default branch.

## Fix Focus Areas
- packages/conditions/src/evaluate.ts[177-186]
- packages/conditions/src/subject.ts[162-184]
- packages/engine/src/events.ts[191-202]

## Recommended Fix
Carry the repository default branch from the GitHub event into the normalized subject and only accept description closing references when `baseBranch` equals that default branch. Keep Linear-key detection in the branch and title independent of this check, and add a test proving a closing keyword does not pass on a non-default target.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Code snippets satisfy issue linking ✗ Dismissed 🔴 Required 🐞 Bug ≡ Correctness

Description

issueLink applies CLOSING directly to the raw subject.body, so closing-looking text inside
inline code is treated as a live reference. A pull request documenting syntax such as ` Closes
#12  therefore satisfies linksIssue: true` even though GitHub does not parse that code span as a
closing link.

Code

packages/conditions/src/evaluate.ts[R179-181]

+  const closes = [...subject.body.matchAll(CLOSING)]
+    .map((match) => match[1] ?? '')
+    .find((ref) => ref.includes('#') || ref.includes('/') || key.test(ref))

Relevance

●●● Strong

Deterministic parsing bug; team accepts correctness fixes preventing false positives.

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Event normalization preserves the raw pull-request body, and the new evaluator searches it without
parsing or excluding Markdown code. GitHub behavior confirms that closing keywords inside code spans
are not interpreted.

packages/conditions/src/evaluate.ts[162-186]
packages/engine/src/events.ts[119-137]
🌐 This GitHub project change explicitly notes that GitHub does not parse closing keywords inside code spans.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The closing-reference regex scans raw Markdown and counts examples inside code spans as GitHub issue links.

## Fix Focus Areas
- packages/conditions/src/evaluate.ts[162-186]
- tests/conditions/src/evaluate.spec.ts[147-212]

## Recommended Fix
Strip or skip Markdown inline-code and fenced-code regions before applying `CLOSING`, preferably using the project's Markdown parser if one exists rather than another broad regex. Add tests showing that backticked and fenced `Closes #12` examples do not pass while visible closing references still do.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

No findings for this group

No findings for this group

Context sources

✅ Tickets: 🎫 Conditions: linksIssue

✅ Web pages:

  🌐 Linking a pull request to an issue

  🌐 Using keywords in issues and pull requests

  🌐 ci: close issues and PRs linked from merged PR descriptions

  +7 more

✅ Cross-repo context — repo relationships

  Explored: repo: Resnovas/.github (sha: 05f370ce) — View relationship

Review mode: ⚖️ Balanced: This introduces a new public condition with regex-based behavior, schema/API changes, and multiple evaluation paths, so a careful full review is warranted.

Tip of the day

💡 Did you know, you can describe a rule in plain language on the Rules page and Qodo drafts it for you

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 2 advisory finding(s) below merit a look before merge.

---

Graphify review — findings

Adds a linksIssue condition that passes when a pull request ties itself to an issue — a GitHub closing keyword plus #12/owner/repo#12/an issue URL/a Linear key in the description, or a Linear key in the head branch or title — and reports the first link it finds. keys restricts Linear keys to the listed teams; without it any key counts (upper-case only in the title, so branch text like utf-8 also passes), and since the description comes from the event it costs no API call and won't see sidebar-only links. Marks the condition pull-request-only (failing on issues), and in a stale sweep's exempt.when only the description and title are read since no branch is available.

Worth a look

• linearKey uses unescaped user-supplied keys in RegExp, causing ReDoS/invalid-regex from team keys — packages/conditions/src/evaluate.ts:168 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• CLOSING closing-reference alternative can match a bare Linear-like key without # or / — packages/conditions/src/evaluate.ts:178 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 571 functions depend on the 571 functions this change touches.

Health — this change adds coupling hotspots:

• new: evaluateCondition() — 2 callers, 19 callees
• new: enum — 0 callers, 29 callees
• new: enum — 0 callers, 11 callees

Verification — 571 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit d7b4657 (diverged from this PR's base — delta is approximate).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 571 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below; 2 more finding(s) on lines outside this diff (see the check run).

[cursor]

Stale comment

Risk: medium. I approved this PR. Cursor Security Agent completed with no findings that need human review, and Cursor Bugbot was skipped so that signal was not required. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[resnovas-smartcloud]

smartcloud found 0 error(s), 2 warning(s).

Level	Rule	Where	Finding
warning	AI-01		The AI disclosure is missing. Fill in "AI level:" with one of: none, autocomplete, chat, agent, autonomous.
warning	SYNC	.github/workflows/smartcloud-review.yml	.github/workflows/smartcloud-review.yml deletes a synced file. Change it in Resnovas/.github instead.

This comment updates itself when you push a fix.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cursor]

Stale comment

Risk: medium. I approved this PR. Cursor Security Agent completed with no findings that need human review, and Cursor Bugbot was not running so that signal was not required. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.

---

Graphify review — findings

Adds a linksIssue condition that passes when a pull request ties itself to an issue — a GitHub closing keyword plus a reference (#12, owner/repo#12, an issue URL, or a Linear key) in the description, or a Linear key in the head branch or title — and reports the first link it finds. Optional keys restricts Linear keys to the listed teams, matched case-insensitively; without it any key counts, upper-case only in the title, and the description-only read means it costs no API call and sidebar-only links go unseen. Registers it as pull-request-only, so it fails on issues with "only applies to pull requests", and wires it into the schema, exports, and configuration docs.

Worth a look

• Configured Linear keys are interpolated into a regex without escaping — packages/conditions/src/evaluate.ts:174 · Escalate · medium · 2 independent checks
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 571 functions depend on the 571 functions this change touches.

Health — this change adds coupling hotspots:

• new: evaluateCondition() — 2 callers, 19 callees
• new: enum — 0 callers, 29 callees
• new: enum — 0 callers, 11 callees

Verification — 571 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit d7b4657, 3 commit(s) behind this PR's base.

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 571 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below; 2 more finding(s) on lines outside this diff (see the check run).

The merge-base changed after approval.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_4fe67536-224a-42ce-9c26-41b98f42b098)

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 2 advisory finding(s) below merit a look before merge.

---

Graphify review — findings

Adds a linksIssue condition that passes when a pull request ties itself to an issue — a closing keyword plus #12, owner/repo#12, an issue URL or a Linear key in the description, or a Linear key in the head branch or title. Closing keywords inside inline spans and fenced code blocks are ignored, an optional keys list restricts matching to named Linear teams (any key otherwise, upper-case-only in the title), and the report names the first link found. It reads only the event payload so it costs no API call, applies to pull requests only, and in a stale sweep's exempt.when sees just the description and title since no branch is available.

Worth a look

• keys joined into regex without escaping enables regex injection / broken pattern — packages/conditions/src/evaluate.ts · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review
• Inline code stripping misses multi-backtick spans — packages/conditions/src/evaluate.ts:189 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 571 functions depend on the 571 functions this change touches.

Health — this change adds coupling hotspots:

• new: evaluateCondition() — 2 callers, 19 callees
• new: enum — 0 callers, 29 callees
• new: enum — 0 callers, 11 callees

Verification — 571 functions in the blast radius were not formally verified this run (proofs are advisory here).

Health delta baseline: last indexed commit 2d3f454 (diverged from this PR's base — delta is approximate).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 571 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below; 2 more finding(s) on lines outside this diff (see the check run).

[cursor]

Risk: medium. I approved this PR. Cursor Security Agent completed with no findings that need human review, and Cursor Bugbot was skipped so that signal was not required. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

The merge-base changed after approval.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
smartcloud	🟢 Ready	View Preview	Sep 27, 2026, 12:25 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_a850a154-3bb5-4291-adb7-f0b8b48521ac)

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.

---

Graphify review — findings

Adds a linksIssue condition that passes when a pull request is tied to an issue: a closing keyword plus reference (#12, owner/repo#12, an issue URL, or a Linear key) in the description, or a Linear key in the head branch or title. Ignores keywords inside inline and fenced code (an unclosed fence runs to end-of-body), and restricts Linear keys to the teams in the optional keys list — without it any key counts, but only in upper case in the title so branch text like utf-8 still matches. Marks the condition pull-request-only (fails on issues), reads solely from the event payload so it costs no API call, and reports the matched link (e.g. closes SMC-55) or links no issue.

Worth a look

• Unescaped Linear team keys are interpolated into a RegExp — packages/conditions/src/evaluate.ts:168 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 571 functions depend on the 571 functions this change touches.

Health — this change adds coupling hotspots:

• new: evaluateCondition() — 2 callers, 19 callees
• new: enum — 0 callers, 29 callees
• new: enum — 0 callers, 11 callees

Verification — 571 functions in the blast radius were not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 571 function(s) in the blast radius were not formally verified this run

· 1 grounded finding(s) anchored inline below; 2 more finding(s) on lines outside this diff (see the check run).