A kódbázis kommentek nélkül marad

Kérésre: minden magyarázó komment kikerült a forrásfájlokból — 89 Ruby, 16
TypeScript, 14 Vue, plusz a CSS/JS/CJS. Nem soralapú kereséssel: a Ruby-t a
Ripper tokenizálta, a JS/TS/CSS-t állapotgép járta végig, hogy az URL-ekben,
reguláris kifejezésekben és heredocokban álló // és # jelek helyükön
maradjanak.

Három komment maradt, mert nélkülük nem indul a kód: az entrypoint.sh
shebangja, a vite-env.d.ts hármas perjeles referenciája, és a sanitize
teszt @vitest-environment direktívája (ez utóbbi a magyarázó része nélkül).

Egy helyen kódot is kellett írni: a CommandBlock másolás-hibaágán a komment
volt a catch egyetlen tartalma, és üres blokkot az eslint nem enged — a
copied jelző visszaállítása került a helyére.

A yaml, Dockerfile, Makefile, erb és markdown fájlokat nem érintettem.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

spec/requests/build_configs_controller_spec.rb

@@ -15,7 +15,6 @@ RSpec.describe "Build configs endpoint", type: :request do
     allow(WarpEngine.config).to receive(:ci_extension_public_key).and_return(signing_key.public_to_pem)
   end
 
-  # Woodpecker 3.x-style RFC 9421 signature over @request-target + content-digest.
   def signed_headers(body, path: "/build/config", digest_body: nil)
     digest = "sha-256=:#{Digest::SHA256.base64digest(digest_body || body)}:"
     inner = %{("@request-target" "content-digest");created=#{Time.now.to_i};alg="ed25519"}
@@ -33,7 +32,6 @@ RSpec.describe "Build configs endpoint", type: :request do
     }
   end
 
-  # Legacy draft-cavage signature (single Signature header).
   def cavage_signed_headers(method: "post", path: "/build/config")
     date = Time.now.httpdate
     signing_string = "(request-target): #{method} #{path}\ndate: #{date}"

spec/requests/device_auth_spec.rb

@@ -1,13 +1,8 @@
 require "rails_helper"
 
-# Signing a client in, end to end: the client asks for a code, a person approves it on
-# the host's page, the client's next poll carries the token away, and the token then
-# works as a bearer credential on the read-only API.
 RSpec.describe "Device sign-in", type: :request do
   let(:owner) { create(:test_owner) }
 
-  # The identity seam is off by default. Configuring the subject class is what turns
-  # the whole flow on — including whether it exists at all.
   def configure_identity!(verification: "/devices")
     allow(WarpEngine.config).to receive(:access_token_owner_class).and_return("TestOwner")
     allow(WarpEngine.config).to receive(:identity_verification_url).and_return(verification)
@@ -37,7 +32,7 @@ RSpec.describe "Device sign-in", type: :request do
       expect(response).to have_http_status(:ok)
       json = JSON.parse(response.body)
       expect(json["deviceCode"]).to be_present
-      # Grouped and free of I/O/0/1, because it is typed by hand into a browser.
+
       expect(json["userCode"]).to match(/\A[A-HJ-NP-Z2-9]{4}-[A-HJ-NP-Z2-9]{4}\z/)
       expect(json["verificationUrl"]).to eq("http://www.example.com/devices")
       expect(json["interval"]).to eq(5)
@@ -64,8 +59,6 @@ RSpec.describe "Device sign-in", type: :request do
       expect(body["token"]).to be_present
     end
 
-    # The plain token is never stored, so it cannot be handed out twice. A client that
-    # loses it starts again — which is cheaper than a database full of live secrets.
     it "does not repeat the token on a second poll" do
       post "/api/auth/device", params: { client_name: "laptop" }
       json = JSON.parse(response.body)
@@ -145,8 +138,6 @@ RSpec.describe "Device sign-in", type: :request do
       expect(record.scopes).to eq([ "catalog" ])
     end
 
-    # A publishing token must not become a client token by accident, and vice versa:
-    # the scope is what separates them, and the catalog endpoint requires its own.
     it "is not accepted as a publishing credential" do
       token
 
@@ -197,8 +188,6 @@ RSpec.describe "Device sign-in", type: :request do
     end
   end
 
-  # A browser carries a session, not a bearer token, and the engine has no idea what a
-  # session is. A host that wants its signed-in visitors recognised says how.
   describe "the host's own subject resolver" do
     let(:seen) { [] }
     let(:policy) do

spec/requests/service_controller_spec.rb

@@ -1,8 +1,5 @@
 require "rails_helper"
 
-# The descriptor is how a client stops being built for one particular store: everything
-# it used to have compiled in — is there a sign-in, where does it live, can titles be
-# gated — is answered here instead.
 RSpec.describe "GET /api/service", type: :request do
   after { WarpEngine::AccessPolicy.reset! }
 
@@ -53,8 +50,6 @@ RSpec.describe "GET /api/service", type: :request do
       expect(auth["device"]["interval"]).to eq(5)
     end
 
-    # A host that configured a bare path should not have to know its own hostname; one
-    # that put the approval page on another domain should keep it.
     it "makes a configured path absolute against the request" do
       get "/api/service"
 

spec/requests/version_header_spec.rb

@@ -1,10 +1,6 @@
 require "rails_helper"
 
-# Every response the engine serves carries the version that served it, so a client can
-# branch on the engine's age without asking a separate endpoint for it.
 RSpec.describe "the WarpEngine-Version header", type: :request do
-  # The controller writes the name as a literal so that it cannot depend on a constant a
-  # half-updated deploy might not have. This is what keeps the two in step.
   it "is the name the constant documents" do
     expect(WarpEngine::VERSION_HEADER).to eq("WarpEngine-Version")
   end
@@ -18,9 +14,6 @@ RSpec.describe "the WarpEngine-Version header", type: :request do
     expect(response.headers["WarpEngine-Version"]).to eq(WarpEngine::VERSION)
   end
 
-  # The one a client needs most: something came back wrong, and it wants to know whether
-  # the engine on the other end is old enough to explain it. `rescue_from` never reaches
-  # an after_action, which is why the header is set before the action runs.
   it "is on an error response" do
     get "/api/image/999999"