lukaszlenart opened a new pull request, #1884:
URL: https://github.com/apache/struts/pull/1884
Removes the nine `.claude/agents/` definitions and six `.claude/commands/`
definitions. They were added in two 2025 dumps — `39014961a` (2025-09-24) and
`1518c1666` (2025-09-29) — and never maintained afterwards, so they had drifted
away from the codebase they describe.
## Why
**Wrong package names.** Struts 7 renamed `com.opensymphony.xwork2` to
`org.apache.struts2`; there are zero `.java` files under `com/opensymphony`
outside `target/`. `codebase-analyzer` still sent agents to
`/core/src/main/java/com/opensymphony/xwork2/DefaultActionInvocation.java`,
`com.opensymphony.xwork2.{Action,interceptor.Interceptor,Result}` and
`com.opensymphony.xwork2.ognl.OgnlUtil`, plus
`/core/src/main/resources/default.properties` (the real path is
`core/src/main/resources/org/apache/struts2/default.properties`).
`codebase-locator` carried the same `com/opensymphony/xwork2/` pointer.
**Advice that silently does nothing.** `config-validator` recommended
`struts.ognl.allowStaticMethodAccess=false` under a "SECURE: Restrict OGNL
evaluation" heading. That property was removed from the framework — it survives
in this repo only inside OGNL attack strings in test fixtures — so setting it
is a no-op that reads like a hardening step.
**Build commands that do not work here.** `code-quality-checker` and
`quality_check` ran `mvn spotless:check`, `mvn spotbugs:check` and `mvn
checkstyle:check`. No pom declares any of those plugins. `mvn jacoco:check` was
also suggested, but jacoco lives only in the `coverage` profile and binds
`prepare-agent`/`report` with no check rules.
**A security workflow that skipped disclosure.** `security-analyzer` (237
lines) and `security_scan` generated security reports with CVE references and
risk ratings, and instructed the agent to "notify stakeholders", without
mentioning `SECURITY.md`, `[email protected]` or private triage
anywhere. Their CVE vocabulary stopped at 2014/2017/2018.
**A dangling reference.** `config_analyze` dispatched
`jakarta-migration-helper`, an agent deleted in `d616ea9af` ("Clean up obsolete
Claude Code configurations", #1433). That cleanup removed the agent but not its
caller.
**An abandoned workflow.** The `thoughts-*` agents and the `create_plan` /
`research_codebase` / `validate_plan` commands drove the `thoughts/` workflow,
which is no longer used. `thoughts/` itself is kept — it documents past
decisions.
## What replaces them
`.claude/skills/` keeps the six Struts-specific procedures (release,
security bulletins, version notes, dependabot, triage), which are maintained
and have no codebase paths to rot. The generic research, review and security
passes are covered by built-in agents and commands. `CLAUDE.md` now points at
`.claude/skills/` only.
No code, build or test changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
