tillerhand 3.28.3 → 3.28.4

package/.claude/hooks/commit-gate.mjs

@@ -49,11 +49,22 @@ const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 // git aliases that run commit ([alias] ci = commit, cm = !git commit), from git config and from an inline -c alias.x=commit
 export function commitPattern(command) {
   if (!/\bgit/.test(command)) return COMMIT; // this hook runs on every Bash call: git config only when git is named
+  // An alias defined in the same command (git -c alias.x=…, git config alias.x …, GIT_CONFIG_* env) cannot be read beforehand:
+  // every git subcommand then counts as a commit (inline), and the chain check, which only knows plain commit, stops the command.
+  if (/GIT_CONFIG_|\balias\.[\w-]+=|\bconfig\b[^;&|\n]*\balias\./i.test(command)) return Object.assign(commitRe(['\\S+']), { inline: true });
   let config = '';
   try { config = git('config --get-regexp ^alias\\.'); } catch { /* no alias or no repo */ }
-  const names = [...config.matchAll(/^alias\.(\S+)\s+(.*)$/gm), ...command.matchAll(/alias\.([\w-]+)=["']?([^"'\s][^"'\n]*)/g)]
-    .filter(([, , value]) => /^(!\s*git\s+)?commit\b/.test(value.trim())).map(([, name]) => escapeRe(name));
-  return names.length ? commitRe(['commit', ...names]) : COMMIT;
+  // Aliases are case-insensitive; one whose value names commit anywhere (a !shell alias too) or calls such an alias is a commit
+  const aliases = [...config.matchAll(/^alias\.(\S+)\s+(.*)$/gm)].map(([, name, value]) => [name.toLowerCase(), value]);
+  const names = new Set();
+  for (let grew = true; grew;) {
+    grew = false;
+    for (const [name, value] of aliases) {
+      const words = value.toLowerCase().split(/[^\w.-]+/);
+      if (!names.has(name) && (words.includes('commit') || words.some((w) => names.has(w)))) { names.add(name); grew = true; }
+    }
+  }
+  return names.size ? new RegExp(commitRe(['commit', ...[...names].map(escapeRe)]).source, 'i') : COMMIT;
 }
 
 // The hook sees the command before it runs: anything that can change files before the commit defeats the review.
@@ -171,7 +182,7 @@ async function hook() {
   }
   if (!commit.test(command) && !commit.test(open)) process.exit(0);
   if (!hasBoard() || reviewOff()) process.exit(0);
-  const chain = chainIssue(command, commit);
+  const chain = chainIssue(command, commit.inline ? COMMIT : commit);
   if (chain) {
     process.stderr.write(`Commit durduruldu: ${chain}. Kapı komut çalışmadan önceki değişiklikleri denetler; commit'i tek başına ` +
       '(veya yalnızca "git add … && git commit" ile) çalıştır. Push ve diğer komutları ayrı çalıştır.\n');

package/.github/workflows/kit-tests.yml

@@ -12,8 +12,8 @@ jobs:
     # kit.mjs install bu dosyayı projeye taşımaz.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       - name: Testler

package/.github/workflows/npm-publish.yml

@@ -1,7 +1,7 @@
 # Kitin npm paketini (tillerhand) yayınlar: v* tag'i push edilince. Projelere kopyalanmaz (kit/kit.mjs → KIT_ONLY).
 # Token yok: npm Trusted Publishing (OIDC). npmjs.com → tillerhand → Settings → Trusted Publisher: GitHub Actions,
 # burakdogrul / TillerHand / npm-publish.yml / environment: npm. Kaynak: docs.npmjs.com/trusted-publishers (2026-10-06).
-# Action'lar commit SHA'sına sabit (v4.4.0); yeni sürüme geçerken SHA'yı github.com/actions/<ad>/releases'tan al.
+# Action'lar commit SHA'sına sabit (checkout v7.0.1, setup-node v7.1.0); yeni sürüme geçerken SHA'yı github.com/actions/<ad>/releases'tan al.
 name: npm-publish
 
 on:
@@ -16,12 +16,13 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
+          package-manager-cache: false # no cache in a release workflow (cache poisoning)
       - name: Tag main'deki bir commit'i mi gösteriyor
         run: git merge-base --is-ancestor "$GITHUB_SHA" origin/main || { echo "Tag main dalında değil, yayın durdu."; exit 1; }
       - name: Sürümler aynı mı (tag, package.json, kit/VERSION)
@@ -42,10 +43,11 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
+          package-manager-cache: false # no cache in a release workflow (cache poisoning)
           registry-url: https://registry.npmjs.org
       - name: npm sürümü (Trusted Publishing 11.5.1+ ister)
         run: node -e "const [a,b,c]=process.argv[1].split('.').map(Number); process.exit(a>11||(a===11&&(b>5||(b===5&&c>=1)))?0:1)" "$(npm --version)"

package/README.en.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.28.3-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.28.4-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-ready-d97757?style=flat-square">
   <img alt="Also Codex and Antigravity" src="https://img.shields.io/badge/also-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">

package/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.28.3-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.28.4-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="Lisans: MIT" src="https://img.shields.io/badge/lisans-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-haz%C4%B1r-d97757?style=flat-square">
   <img alt="Codex ve Antigravity" src="https://img.shields.io/badge/ayr%C4%B1ca-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">

package/kit/CHANGELOG.md

@@ -3,6 +3,15 @@
 Kit sürümü `kit/VERSION` dosyasında. Bir projeyi güncellemek: projede `/kit-update`.
 "Elle uyarla" notu olan maddeler projeye ait dosyalardadır; güncelleme bunlara dokunmaz.
 
+## [3.28.4] - 2026-10-26
+
+### Değişen
+- **GitHub Actions sürümleri Node 24'e geçti** (GitHub, Node 20 ile çalışan action'ları zorla Node 24'te çalıştırıyordu ve uyarı veriyordu): `actions/checkout` v7, `actions/setup-node` v7, `gitleaks/gitleaks-action` v3, `astral-sh/setup-uv` v10. Şablonlardaki CI, bakım, canlı izleme ve ödeme webhook iş akışları güncellendi. Kitin npm yayın iş akışı commit SHA'sına sabit kalıyor ve paket önbelleğini kapatıyor (önbellek zehirlenmesine karşı).
+  - Elle uyarla: Projedeki iş akışını kendin değiştirdiysen `/kit-update` yeni sürümü `.kit-new` olarak bırakır; sürüm satırlarını oradan al.
+
+### Düzeltilen
+- **Commit alias'ı tespiti genişledi:** büyük/küçük harf duyarsız; başka bir alias'ı çağıran ya da değerinde `commit` geçen `!` kabuk alias'ları da commit sayılıyor. Aynı komutta tanımlanan alias (`git -c alias.x=…`, `git config alias.x …`, `GIT_CONFIG_*`) önceden okunamadığı için komut durduruluyor.
+
 ## [3.28.3] - 2026-10-26
 
 ### Düzeltilen

package/kit/VERSION

@@ -1 +1 @@
-3.28.3
+3.28.4

package/kit/guide.html

@@ -287,7 +287,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.28.3</b> Claude Code için başlangıç kiti · MIT</span>
+      <span class="pill"><b>v3.28.4</b> Claude Code için başlangıç kiti · MIT</span>
       <h1>Kodu AI yazar.<br><em>Dümen sende.</em></h1>
       <p class="sub">TillerHand, Claude Code ile bir ürünü fikirden canlıya ve bakıma kadar götürür. Her önemli kararda AI sana seçenekleri, önerisini ve her seçeneğin bedelini sunar. Bir uzman kurulu işi denetler, korumalar hatayı daha olmadan durdurur.</p>
       <div class="install"><span id="cmd">npx tillerhand init</span><button class="copy" type="button" data-copy="cmd">Kopyala</button></div>

package/kit/templates/addons/tr/types/web-saas/.github/workflows/payment-webhook.yml

@@ -14,8 +14,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       # Node 22.18+ .ts modülünü doğrudan çalıştırır; bağımlılık kurulumu gerekmez

package/kit/templates/backend/.github/workflows/ci.yml

@@ -27,8 +27,8 @@ jobs:
       ENV: test
       DATABASE_URL: postgresql+psycopg://app:app@localhost:5432/app_test
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10
       - run: uv sync --locked
       - run: uv run ruff check .
       - run: uv run ruff format --check .
@@ -43,14 +43,14 @@ jobs:
   structure:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Klasör yapısı (.claude/structure.json)
         run: node .claude/hooks/structure-guard.mjs --check
 
   karmasiklik:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # base commit'iyle karşılaştırmak için
       - name: Karmaşıklık bütçesi (değişen dosyalar; fonksiyon karmaşıklığı 15, fonksiyon 80, dosya 400 satır)
@@ -63,14 +63,14 @@ jobs:
     container:
       image: semgrep/semgrep
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Statik güvenlik analizi (yüksek önemli bulgular CI'ı durdurur)
         run: semgrep scan --config p/default --config p/owasp-top-ten --severity ERROR --error
 
   kopya-kod:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Kopya kod oranı (eşik %5)
         run: npx --yes jscpd@4 --threshold 5 --silent --ignore "**/node_modules/**,**/.next/**,**/dist/**,**/build/**,**/.venv/**,**/coverage/**,**/.expo/**" .
 
@@ -81,11 +81,11 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # tüm geçmiş taranır
       # Kişisel hesapta ücretsiz; organizasyon deposunda GITLEAKS_LICENSE sırrı gerekir
-      - uses: gitleaks/gitleaks-action@v2
+      - uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Token salt okunur: PR yorumu kapalı, sızıntı işi kırmızı yapar

package/kit/templates/backend/.github/workflows/claude-ci-fix.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
       - name: Başarısız adımların kaydı

package/kit/templates/backend/.github/workflows/claude-maintenance.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 50
       - uses: anthropics/claude-code-action@v1

package/kit/templates/backend/.github/workflows/live-monitoring.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Sağlık ve yanıt süresi
         run: |
           t=$(curl -fsS -o /dev/null --max-time 10 -w '%{time_total}' "${{ vars.LIVE_URL }}/health")
@@ -31,7 +31,7 @@ jobs:
           awk -v t="$t" -v max="$MAX" 'BEGIN { exit (t > max) }'
         env:
           MAX: ${{ vars.LIVE_MAX_SECONDS || '2' }}
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v10
         if: hashFiles('tests/live/**') != ''
       - name: Kritik uçlar (canlı)
         if: hashFiles('tests/live/**') != ''

package/kit/templates/mobile/.github/workflows/ci.yml

@@ -14,8 +14,8 @@ jobs:
   kontrol:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -31,14 +31,14 @@ jobs:
   structure:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Klasör yapısı (.claude/structure.json)
         run: node .claude/hooks/structure-guard.mjs --check
 
   karmasiklik:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # base commit'iyle karşılaştırmak için
       - name: Karmaşıklık bütçesi (değişen dosyalar; fonksiyon karmaşıklığı 15, fonksiyon 80, dosya 400 satır)
@@ -51,8 +51,8 @@ jobs:
   rls:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         if: hashFiles('supabase/config.toml') != ''
         with:
           node-version: 22
@@ -75,14 +75,14 @@ jobs:
     container:
       image: semgrep/semgrep
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Statik güvenlik analizi (yüksek önemli bulgular CI'ı durdurur)
         run: semgrep scan --config p/default --config p/owasp-top-ten --severity ERROR --error
 
   kopya-kod:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Kopya kod oranı (eşik %5)
         run: npx --yes jscpd@4 --threshold 5 --silent --ignore "**/node_modules/**,**/.next/**,**/dist/**,**/build/**,**/.venv/**,**/coverage/**,**/.expo/**" .
 
@@ -93,11 +93,11 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # tüm geçmiş taranır
       # Kişisel hesapta ücretsiz; organizasyon deposunda GITLEAKS_LICENSE sırrı gerekir
-      - uses: gitleaks/gitleaks-action@v2
+      - uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Token salt okunur: PR yorumu kapalı, sızıntı işi kırmızı yapar

package/kit/templates/mobile/.github/workflows/claude-ci-fix.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
       - name: Başarısız adımların kaydı

package/kit/templates/mobile/.github/workflows/claude-maintenance.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 50
       - uses: anthropics/claude-code-action@v1

package/kit/templates/web-saas/.github/workflows/ci.yml

@@ -15,8 +15,8 @@ jobs:
   kontrol:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -37,8 +37,8 @@ jobs:
   # e2e:
   #   runs-on: ubuntu-latest
   #   steps:
-  #     - uses: actions/checkout@v4
-  #     - uses: actions/setup-node@v4
+  #     - uses: actions/checkout@v7
+  #     - uses: actions/setup-node@v7
   #       with: { node-version: 22, cache: npm }
   #     - run: npm ci
   #     - run: npx playwright install --with-deps chromium
@@ -47,14 +47,14 @@ jobs:
   structure:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Klasör yapısı (.claude/structure.json)
         run: node .claude/hooks/structure-guard.mjs --check
 
   karmasiklik:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # base commit'iyle karşılaştırmak için
       - name: Karmaşıklık bütçesi (değişen dosyalar; fonksiyon karmaşıklığı 15, fonksiyon 80, dosya 400 satır)
@@ -67,8 +67,8 @@ jobs:
   rls:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         if: hashFiles('supabase/config.toml') != ''
         with:
           node-version: 22
@@ -91,14 +91,14 @@ jobs:
     container:
       image: semgrep/semgrep
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Statik güvenlik analizi (yüksek önemli bulgular CI'ı durdurur)
         run: semgrep scan --config p/default --config p/owasp-top-ten --severity ERROR --error
 
   kopya-kod:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Kopya kod oranı (eşik %5)
         run: npx --yes jscpd@4 --threshold 5 --silent --ignore "**/node_modules/**,**/.next/**,**/dist/**,**/build/**,**/.venv/**,**/coverage/**,**/.expo/**" .
 
@@ -109,11 +109,11 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # tüm geçmiş taranır
       # Kişisel hesapta ücretsiz; organizasyon deposunda GITLEAKS_LICENSE sırrı gerekir
-      - uses: gitleaks/gitleaks-action@v2
+      - uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Token salt okunur: PR yorumu kapalı, sızıntı işi kırmızı yapar

package/kit/templates/web-saas/.github/workflows/claude-ci-fix.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
       - name: Başarısız adımların kaydı

package/kit/templates/web-saas/.github/workflows/claude-maintenance.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 50
       - uses: anthropics/claude-code-action@v1

package/kit/templates/web-saas/.github/workflows/live-monitoring.yml

@@ -23,8 +23,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tillerhand",
-  "version": "3.28.3",
+  "version": "3.28.4",
   "description": "Claude Code, Codex ve Antigravity için Türkçe vibe coding kiti: kurallar, komutlar, korumalar ve proje şablonları.",
   "license": "MIT",
   "type": "module",