@trac3er/oh-my-god 2.2.3 → 2.2.5

package/docs/install/github-app-required-checks.md

@@ -0,0 +1,103 @@
+# GitHub App Required Checks
+
+## Required Check Context Name
+
+The OMG PR Reviewer creates a check-run with a deterministic name:
+
+```
+OMG PR Reviewer
+```
+
+This name is the **context** string used for required status checks in branch protection rules.
+
+## Pinning Required Checks to `app_id`
+
+GitHub allows any integration or workflow to create a check-run with any name. To prevent spoofing of the `OMG PR Reviewer` check, pin the required check to the OMG GitHub App's `app_id` in your branch protection settings.
+
+### REST API (branch protection)
+
+```json
+PUT /repos/{owner}/{repo}/branches/{branch}/protection
+{
+  "required_status_checks": {
+    "strict": true,
+    "contexts": [],
+    "checks": [
+      {
+        "context": "OMG PR Reviewer",
+        "app_id": YOUR_OMG_APP_ID
+      }
+    ]
+  }
+}
+```
+
+When `app_id` is set, only check-runs created by that specific GitHub App are considered authoritative. A workflow or third-party App posting a check-run with the same name but a different `app_id` will not satisfy the requirement.
+
+### Repository Settings UI
+
+1. Go to **Settings > Branches > Branch protection rules**.
+2. Edit the rule for your default branch.
+3. Under **Require status checks to pass before merging**, search for `OMG PR Reviewer`.
+4. Select the entry that shows the OMG App icon (not the GitHub Actions icon).
+
+## Merge-Readiness Evaluation via `isRequired` GraphQL Field
+
+Do **not** rely on the raw `mergeable` field from the REST API to determine merge readiness. The `mergeable` field conflates merge conflict status with required-check status and can produce false positives.
+
+Instead, use the GraphQL `statusCheckRollup` with the `isRequired` field to query whether each required check has passed:
+
+```graphql
+query MergeReadiness($owner: String!, $repo: String!, $pr: Int!) {
+  repository(owner: $owner, name: $repo) {
+    pullRequest(number: $pr) {
+      commits(last: 1) {
+        nodes {
+          commit {
+            statusCheckRollup {
+              contexts(first: 50) {
+                nodes {
+                  ... on CheckRun {
+                    name
+                    conclusion
+                    isRequired(pullRequestNumber: $pr)
+                  }
+                  ... on StatusContext {
+                    context
+                    state
+                    isRequired(pullRequestNumber: $pr)
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}
+```
+
+The `isRequired` field returns `true` only for checks that are configured as required for the target branch. A PR is merge-ready when every context where `isRequired: true` also has `conclusion: "SUCCESS"` (for check-runs) or `state: "SUCCESS"` (for status contexts).
+
+## Split-Lane Security Model
+
+The OMG CI pipeline uses a split-lane model to isolate untrusted analysis from trusted posting:
+
+| Job | Permissions | Checkout | Purpose |
+|---|---|---|---|
+| `pr-analyze` | `contents: read` | PR head (default) | Runs analysis on PR code, produces review artifacts |
+| `post-review` | `contents: read`, `pull-requests: write`, `checks: write` | **Base SHA** (`github.event.pull_request.base.sha`) | Posts review and check-run using App credentials |
+
+The `post-review` job checks out the **base branch SHA**, not the PR head. This ensures the posting code is from the trusted base branch and cannot be tampered with by the PR author. App credentials (`OMG_APP_ID`, `OMG_APP_PRIVATE_KEY`, `OMG_APP_INSTALLATION_ID`) are only available in the trusted posting job.
+
+## Check-Run Conclusions
+
+The OMG PR Reviewer maps verdict statuses to GitHub check-run conclusions:
+
+| Verdict Status | GitHub Conclusion | PR UI Effect |
+|---|---|---|
+| `pass` | `success` | Green checkmark |
+| `fail` | `failure` | Red X |
+| `action_required` | `action_required` | "Take action" button |
+| `pending` | `neutral` | Grey dash |

package/docs/install/github-app.md

@@ -27,9 +27,9 @@ The bot requires three configuration variables.
 
 | Variable | Type | Description |
 | :--- | :--- | :--- |
-| `GITHUB_APP_ID` | Config Variable | The App ID from your GitHub App settings. |
-| `GITHUB_APP_PRIVATE_KEY` | Secret | The full content of the downloaded `.pem` file. |
-| `GITHUB_INSTALLATION_ID` | Config Variable | The ID from the installation URL. |
+| `OMG_APP_ID` | Config Variable | The App ID from your GitHub App settings. |
+| `OMG_APP_PRIVATE_KEY` | Secret | The full content of the downloaded `.pem` file. |
+| `OMG_APP_INSTALLATION_ID` | Config Variable | The ID from the installation URL. |
 
 #### Local Development
 Store the private key in a file and load it:
@@ -40,12 +40,13 @@ export GITHUB_APP_PRIVATE_KEY="$(cat path/to/your-app.private-key.pem)"
 ```
 
 #### GitHub Actions
-Add the App ID and Installation ID as **Variables** and the Private Key as a **Secret**:
+Add the App ID and Installation ID as **Variables** and the Private Key as a **Secret**.
+GitHub Actions forbids secret names starting with `GITHUB_`, so we use the `OMG_` prefix for stored values and map them to the `GITHUB_`-prefixed env vars the runtime expects:
 ```yaml
 env:
-  GITHUB_APP_ID: ${{ vars.GITHUB_APP_ID }}
-  GITHUB_INSTALLATION_ID: ${{ vars.GITHUB_INSTALLATION_ID }}
-  GITHUB_APP_PRIVATE_KEY: ${{ secrets.GITHUB_APP_PRIVATE_KEY }}
+  GITHUB_APP_ID: ${{ vars.OMG_APP_ID }}
+  GITHUB_INSTALLATION_ID: ${{ vars.OMG_APP_INSTALLATION_ID }}
+  GITHUB_APP_PRIVATE_KEY: ${{ secrets.OMG_APP_PRIVATE_KEY }}
 ```
 
 ## Security Hardening

package/hooks/_common.py

@@ -220,36 +220,59 @@ def log_hook_error(hook_name, error, context=None):
         pass
 
 
+_O_NOFOLLOW_HOOKS: int = getattr(os, "O_NOFOLLOW", 0)
+
+
+def _fsync_dir_hooks(dirpath):
+    fd = os.open(dirpath, os.O_RDONLY)
+    try:
+        os.fsync(fd)
+    finally:
+        os.close(fd)
+
+
 def atomic_json_write(path, data):
-    """Atomically write JSON data to a file using temp + rename.
-    
-    Args:
-        path: Target file path
-        data: Data to write as JSON
-    
-    Creates parent directories if needed. Silently fails on error.
-    """
     try:
-        # Create parent dirs
         parent = os.path.dirname(path)
         if parent:
             os.makedirs(parent, exist_ok=True)
-        
-        # Write to temp file
+
+        if os.path.islink(path):
+            raise OSError(f"Symlink target rejected: {path}")
+
         tmp_path = path + ".tmp"
-        with open(tmp_path, "w", encoding="utf-8") as f:
-            json.dump(data, f, separators=(",", ":"))
-        
-        # Atomic rename
-        os.rename(tmp_path, path)
+        if os.path.islink(tmp_path):
+            raise OSError(f"Symlink tmp path rejected: {tmp_path}")
+        if os.path.exists(tmp_path):
+            os.unlink(tmp_path)
+
+        content = json.dumps(data, separators=(",", ":")).encode("utf-8")
+        open_flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC | _O_NOFOLLOW_HOOKS
+        fd = os.open(tmp_path, open_flags, 0o600)
+        try:
+            written = 0
+            while written < len(content):
+                written += os.write(fd, content[written:])
+            os.fsync(fd)
+        except BaseException:
+            os.close(fd)
+            try:
+                os.unlink(tmp_path)
+            except OSError:
+                pass
+            raise
+        else:
+            os.close(fd)
+
+        os.replace(tmp_path, path)
+        _fsync_dir_hooks(parent or ".")
     except Exception as e:
         print(f"[OMG] _common.py: {type(e).__name__}: {e}", file=sys.stderr)
-        pass
 
 
 # Feature flags cache — read settings.json once per hook invocation
 _FEATURE_CACHE = {}
-_SETTINGS_PRESET = None
+_settings_preset = None
 _MANAGED_PRESET_FLAGS = {
     "SETUP",
     "SETUP_WIZARD",
@@ -262,6 +285,12 @@ _MANAGED_PRESET_FLAGS = {
     "TEST_GENERATION",
     "DEP_HEALTH",
     "CODEBASE_VIZ",
+    "DATA_ENFORCEMENT",
+    "WEB_ENFORCEMENT",
+    "TERMS_ENFORCEMENT",
+    "COUNCIL_ROUTING",
+    "FORGE_ALL_DOMAINS",
+    "NOTEBOOKLM",
 }
 _PRESET_FEATURES = {
     "safe": {flag: False for flag in _MANAGED_PRESET_FLAGS},
@@ -303,7 +332,15 @@ _PRESET_FEATURES = {
         "TEST_GENERATION": True,
         "DEP_HEALTH": True,
         "CODEBASE_VIZ": True,
+        "DATA_ENFORCEMENT": False,
+        "WEB_ENFORCEMENT": False,
+        "TERMS_ENFORCEMENT": False,
+        "COUNCIL_ROUTING": False,
+        "FORGE_ALL_DOMAINS": False,
+        "NOTEBOOKLM": False,
     },
+    "buffet": {flag: True for flag in _MANAGED_PRESET_FLAGS},
+    "production": {flag: True for flag in _MANAGED_PRESET_FLAGS},
 }
 _FEATURE_ALIASES = {
     "SETUP": ("SETUP", "SETUP_WIZARD"),
@@ -313,10 +350,10 @@ _FEATURE_ALIASES = {
 
 def _load_feature_settings():
     """Populate feature cache from settings.json and return the configured preset."""
-    global _SETTINGS_PRESET
+    global _settings_preset
 
     _FEATURE_CACHE.clear()
-    _SETTINGS_PRESET = None
+    _settings_preset = None
     try:
         settings_path = os.path.join(get_project_dir(), "settings.json")
         if os.path.exists(settings_path):
@@ -329,7 +366,7 @@ def _load_feature_settings():
                     _FEATURE_CACHE.update(features)
                 preset = omg.get("preset")
                 if isinstance(preset, str) and preset in _PRESET_FEATURES:
-                    _SETTINGS_PRESET = preset
+                    _settings_preset = preset
     except Exception:
         pass
 
@@ -367,10 +404,10 @@ def get_feature_flag(flag_name, default=True):
         if name in _FEATURE_CACHE:
             return _FEATURE_CACHE[name]
 
-    if _SETTINGS_PRESET in _PRESET_FEATURES:
+    if _settings_preset in _PRESET_FEATURES:
         for name in lookup_names:
             if name in _MANAGED_PRESET_FLAGS:
-                return _PRESET_FEATURES[_SETTINGS_PRESET].get(name, default)
+                return _PRESET_FEATURES[_settings_preset].get(name, default)
 
     return default
 

package/hooks/budget_governor.py

@@ -50,10 +50,37 @@ def _safe_float(value, default: float) -> float:
         return default
 
 
-def _read_budget_config(project_dir: str) -> tuple[float, float, float]:
+def _read_budget_config(project_dir: str) -> tuple[float, float, float, dict[str, Any]]:
     session_limit = DEFAULT_SESSION_LIMIT_USD
     input_per_mtok = DEFAULT_INPUT_PER_MTOK
     output_per_mtok = DEFAULT_OUTPUT_PER_MTOK
+    tier_info: dict[str, Any] = {
+        "tier": "free",
+        "tier_limit_usd": DEFAULT_SESSION_LIMIT_USD,
+        "tier_provenance": "default",
+    }
+
+    try:
+        parent = os.path.dirname(HOOKS_DIR)
+        if parent not in sys.path:
+            sys.path.insert(0, parent)
+        from runtime.subscription_tiers import detect_tier
+
+        provider = os.environ.get("OMG_PROVIDER", "claude")
+        tier_result = detect_tier(provider, project_dir=project_dir)
+        session_limit = _safe_float(
+            tier_result.get("budget_usd_per_session"),
+            DEFAULT_SESSION_LIMIT_USD,
+        )
+        tier_info = {
+            "tier": tier_result.get("tier", "free"),
+            "tier_limit_usd": float(
+                tier_result.get("budget_usd_per_session", DEFAULT_SESSION_LIMIT_USD)
+            ),
+            "tier_provenance": tier_result.get("provenance", "default"),
+        }
+    except Exception:
+        pass
 
     settings_path = os.path.join(project_dir, "settings.json")
     try:
@@ -61,13 +88,13 @@ def _read_budget_config(project_dir: str) -> tuple[float, float, float]:
             settings = json.load(f)
         budget_cfg = settings.get("_omg", {}).get("cost_budget", {})
         pricing = budget_cfg.get("pricing", {})
-        session_limit = _safe_float(budget_cfg.get("session_limit_usd"), DEFAULT_SESSION_LIMIT_USD)
+        session_limit = _safe_float(budget_cfg.get("session_limit_usd"), session_limit)
         input_per_mtok = _safe_float(pricing.get("input_per_mtok"), DEFAULT_INPUT_PER_MTOK)
         output_per_mtok = _safe_float(pricing.get("output_per_mtok"), DEFAULT_OUTPUT_PER_MTOK)
     except Exception:
         pass
 
-    return session_limit, input_per_mtok, output_per_mtok
+    return session_limit, input_per_mtok, output_per_mtok, tier_info
 
 
 def _to_text(value) -> str:
@@ -218,7 +245,7 @@ def main() -> None:
         sys.exit(0)
 
     project_dir = get_project_dir()
-    session_limit_usd, input_per_mtok, output_per_mtok = _read_budget_config(project_dir)
+    session_limit_usd, input_per_mtok, output_per_mtok, tier_info = _read_budget_config(project_dir)
     summary = read_cost_summary(project_dir)
 
     estimated_current_cost = _estimate_call_cost(
@@ -228,8 +255,19 @@ def main() -> None:
         output_per_mtok,
     )
 
-    used_cost_usd = float(summary.get("total_cost_usd", 0.0)) + estimated_current_cost
-    used_calls = int(summary.get("entry_count", 0)) + 1
+    session_id = os.environ.get("CLAUDE_SESSION_ID", "")
+    by_session = summary.get("by_session", {})
+
+    if session_id and session_id in by_session:
+        session_data = by_session[session_id]
+        used_cost_usd = float(session_data.get("cost_usd", 0.0)) + estimated_current_cost
+        used_calls = int(session_data.get("count", 0)) + 1
+        provenance = "session"
+    else:
+        used_cost_usd = float(summary.get("total_cost_usd", 0.0)) + estimated_current_cost
+        used_calls = int(summary.get("entry_count", 0)) + 1
+        provenance = "default"
+
     projected_calls = _project_total_calls(used_cost_usd, used_calls, session_limit_usd)
 
     context = _build_context(
@@ -240,7 +278,6 @@ def main() -> None:
     )
 
     used_pct = (used_cost_usd / session_limit_usd * 100) if session_limit_usd > 0 else 0.0
-    session_id = os.environ.get("CLAUDE_SESSION_ID", "")
     threshold_alerts = _check_thresholds(used_pct, project_dir, session_id)
     if threshold_alerts:
         context += "\n" + "\n".join(threshold_alerts)
@@ -249,7 +286,39 @@ def main() -> None:
     if envelope_context:
         context += "\n" + envelope_context
 
-    json.dump({"additionalContext": context}, sys.stdout)
+    tier_limit_usd = tier_info["tier_limit_usd"]
+    near_limit = used_cost_usd > (0.80 * tier_limit_usd)
+    limit_reached = used_cost_usd >= tier_limit_usd
+
+    throttle_reason: str | None = None
+    if near_limit or limit_reached:
+        throttle_reason = (
+            f"tier={tier_info['tier']} limit={tier_limit_usd:.2f} "
+            f"used={used_cost_usd:.2f} provenance={tier_info['tier_provenance']}"
+        )
+
+    if limit_reached:
+        context += f"\n@tier-limit-reached: {throttle_reason}"
+    elif near_limit:
+        context += f"\n@tier-near-limit: {throttle_reason}"
+
+    output: dict[str, Any] = {
+        "additionalContext": context,
+        "provenance": provenance,
+        "tier": tier_info["tier"],
+        "tier_limit_usd": tier_limit_usd,
+        "near_limit": near_limit,
+        "limit_reached": limit_reached,
+        "throttle_reason": throttle_reason,
+    }
+
+    if tier_info["tier_provenance"] in ("cache", "default"):
+        output["tier_provenance_fallback"] = (
+            f"tier data from {tier_info['tier_provenance']} source "
+            "— may not reflect current subscription"
+        )
+
+    json.dump(output, sys.stdout)
     sys.exit(0)
 
 

package/hooks/secret-guard.py

@@ -23,7 +23,7 @@ bootstrap_runtime_paths(__file__)
 setup_crash_handler("secret-guard", fail_closed=True)
 
 try:
-    from policy_engine import evaluate_file_access, to_pretool_hook_output
+    from policy_engine import evaluate_file_access, load_allowlist, to_pretool_hook_output
     from secret_audit import log_secret_access
     from runtime.mutation_gate import check_mutation_allowed
 except Exception as _import_err:
@@ -72,7 +72,8 @@ if tool in ("Write", "Edit", "MultiEdit"):
         deny_decision(deny_reason)
         sys.exit(0)
 
-decision = evaluate_file_access(tool, file_path)
+allowlist = load_allowlist(get_project_dir())
+decision = evaluate_file_access(tool, file_path, allowlist=allowlist)
 
 # Audit log: record every secret access decision
 try:

package/hooks/setup_wizard.py

@@ -5,6 +5,7 @@ Feature-gated: requires OMG_SETUP_ENABLED=1 (default off).
 from __future__ import annotations
 
 import json
+import importlib
 import logging
 import os
 import re
@@ -27,16 +28,6 @@ from hooks._common import bootstrap_runtime_paths, get_feature_flag
 bootstrap_runtime_paths(__file__)
 
 from runtime.cli_provider import get_provider, list_available_providers  # noqa: E402
-from runtime.mcp_config_writers import (  # noqa: E402
-    write_claude_mcp_config,
-    write_claude_mcp_stdio_config,
-    write_codex_mcp_config,
-    write_codex_mcp_stdio_config,
-    write_gemini_mcp_config,
-    write_gemini_mcp_stdio_config,
-    write_kimi_mcp_config,
-    write_kimi_mcp_stdio_config,
-)
 
 # Trigger provider auto-registration on import
 import runtime.providers.codex_provider  # noqa: E402, F401
@@ -485,8 +476,6 @@ def check_auth() -> dict[str, Any]:
     return {"status": "pending", "results": {}}
 
 
-_HTTP_MEMORY_MIN_LEVEL: int = _PRESET_LEVEL["interop"]
-
 _PROFILE_ARCH_REQUEST_MAX = 8
 _PROFILE_TAG_MAX = 12
 _PROFILE_SUMMARY_MAX_CHARS = 240
@@ -541,100 +530,39 @@ def configure_mcp(
         - configured: List of CLI names that were successfully configured
         - errors: Dict of CLI name → error message for failures
     """
-    configured: list[str] = []
-    errors: dict[str, str] = {}
     resolved_control_args = list(control_args or OMG_CONTROL_ARGS)
-    http_memory_allowed = _PRESET_LEVEL.get(preset, 0) >= _HTTP_MEMORY_MIN_LEVEL
     selected_config = select_mcps(selected_ids=selected_ids, preset=preset)
     selected_servers = cast(
         dict[str, dict[str, Any]],
         selected_config.get("mcpServers", {}),
     )
+    install_planner = importlib.import_module("runtime.install_planner")
+    plan = install_planner.compute_install_plan(
+        project_dir=project_dir,
+        detected_clis=detected_clis,
+        preset=preset,
+        mode="focused",
+        selected_ids=selected_ids,
+        server_url=server_url,
+        server_name=server_name,
+        control_command=control_command,
+        control_args=resolved_control_args,
+        control_server_name=control_server_name,
+        selected_servers=selected_servers,
+        source_root=_PROJECT_ROOT,
+    )
+    install_result = cast(dict[str, Any], install_planner.execute_plan(plan))
 
-    try:
-        config_path = os.path.join(project_dir, ".mcp.json")
-        if os.path.exists(config_path):
-            with open(config_path, "r", encoding="utf-8") as f:
-                claude_config = json.load(f)
-            if not isinstance(claude_config, dict):
-                claude_config = {}
+    configured = [action.host for action in plan.actions if action.host != "claude"]
+    errors: dict[str, str] = {}
+    if install_result["errors"]:
+        joined = "; ".join(install_result["errors"])
+        if not configured:
+            errors["claude"] = joined
         else:
-            claude_config = {}
-
-        existing_servers = claude_config.get("mcpServers")
-        if not isinstance(existing_servers, dict):
-            existing_servers = {}
-
-        managed_server_ids = {cast(str, m["id"]) for m in MCP_CATALOG}
-        for managed_server_id in managed_server_ids:
-            existing_servers.pop(managed_server_id, None)
-        existing_servers.pop(server_name, None)
-        existing_servers.pop(control_server_name, None)
-
-        for selected_server_name, payload in selected_servers.items():
-            if selected_server_name == "omg-memory":
-                if not http_memory_allowed:
-                    continue
-                target_name = server_name
-                payload = {"type": "http", "url": server_url}
-            elif selected_server_name == OMG_CONTROL_SERVER_NAME:
-                target_name = control_server_name
-                payload = {
-                    "command": control_command,
-                    "args": resolved_control_args,
-                }
-            else:
-                target_name = selected_server_name
-            existing_servers[target_name] = payload
-
-        claude_config["mcpServers"] = existing_servers
-        with open(config_path, "w", encoding="utf-8") as f:
-            json.dump(claude_config, f, indent=2, ensure_ascii=True)
-            f.write("\n")
-    except Exception as exc:
-        _logger.warning("Failed to write Claude MCP config: %s", exc)
-        errors["claude"] = str(exc)
-
-    cli_writers = {
-        "codex": (write_codex_mcp_config, write_codex_mcp_stdio_config),
-        "gemini": (write_gemini_mcp_config, write_gemini_mcp_stdio_config),
-        "kimi": (write_kimi_mcp_config, write_kimi_mcp_stdio_config),
-    }
-
-    for cli_name, (http_writer, stdio_writer) in cli_writers.items():
-        cli_info = detected_clis.get(cli_name, {})
-        if not cli_info.get("detected", False):
-            continue
-
-        try:
-            for selected_server_name, payload in selected_servers.items():
-                if selected_server_name == "omg-memory":
-                    if not http_memory_allowed:
-                        continue
-                    http_writer(server_url, server_name)
-                    continue
-
-                if selected_server_name == OMG_CONTROL_SERVER_NAME:
-                    stdio_writer(
-                        command=control_command,
-                        args=resolved_control_args,
-                        server_name=control_server_name,
-                    )
-                    continue
-
-                if payload.get("type") == "http":
-                    http_writer(cast(str, payload["url"]), selected_server_name)
-                    continue
-
-                stdio_writer(
-                    command=cast(str, payload["command"]),
-                    args=[str(arg) for arg in cast(list[Any], payload.get("args", []))],
-                    server_name=selected_server_name,
-                )
-            configured.append(cli_name)
-        except Exception as exc:
-            _logger.warning("Failed to write %s MCP config: %s", cli_name, exc)
-            errors[cli_name] = str(exc)
+            for host in configured:
+                errors[host] = joined
+        configured = []
 
     return {
         "status": "ok",

package/hooks/stop_dispatcher.py

@@ -428,6 +428,25 @@ def check_recent_failures(data, project_dir):
     return blocks
 
 
+_TEST_DIR_NAMES = frozenset({"tests", "test", "__tests__"})
+_SKIP_DIR_SEGMENTS = frozenset({"build", "dist", "node_modules", ".git"})
+
+
+def _is_test_file_path(rel_path):
+    parts = rel_path.replace("\\", "/").split("/")
+    if any(seg in _SKIP_DIR_SEGMENTS for seg in parts[:-1]):
+        return False
+    basename = parts[-1].lower() if parts else ""
+    if any(p in basename for p in (".test.", ".spec.", "_test.", ".tests.")):
+        return True
+    if "__tests__" in rel_path:
+        return True
+    if basename.startswith("test_"):
+        parent_dirs = {p.lower() for p in parts[:-1]}
+        return not parent_dirs or bool(parent_dirs & _TEST_DIR_NAMES)
+    return False
+
+
 def check_test_execution(data, project_dir):
     if not get_feature_flag("test_execution", True):
         return []
@@ -444,8 +463,7 @@ def check_test_execution(data, project_dir):
         test_files_modified = False
         try:
             for file_path in changed_files:
-                fl = file_path.lower()
-                if any(p in fl for p in ["test", "spec", "__tests__", ".test.", ".spec.", "_test."]):
+                if _is_test_file_path(file_path):
                     test_files_modified = True
                     break
         except Exception as e:  # security: test execution check