/5-validate

Step 5: Validate (Test & Verify)

> **Navigation**: [← Step 4: Fix](4-fix.md) | [Main Workflow](../workflow-steps.md) | [Step 6: Complete →](6-complete.md)

**Purpose**: Ensure all fixes are correct and quality gates pass.

**Skip when**: Already validated manually.

5.1 Version Validation (MANDATORY IF APPLICABLE)

**CRITICAL: If `/pr-review` flagged any version issues (B-VERSION), you MUST verify they were fixed.**

Before proceeding to test plan execution, re-run version validation to confirm all version files are now consistent.

**Check for Version Issues in Review:**

# Check if version validation issues were flagged in the review
# Look for B-VERSION tags in review comments or test plan
gh api repos/OWNER/REPO/issues/PR_NUMBER/comments \
  --jq '.[] | select(.body | contains("B-VERSION")) | .body'

**Re-run Version Validation (if version issues existed):**

    # Detect project type
    PROJECT_TYPE=""
    if [[ -f ".claude-plugin/marketplace.json" ]]; then
      PROJECT_TYPE="claude-marketplace"
    elif [[ -f "pyproject.toml" ]]; then
      PROJECT_TYPE="python"
    elif [[ -f "package.json" ]]; then
      PROJECT_TYPE="node"
    elif [[ -f "Cargo.toml" ]]; then
      PROJECT_TYPE="rust"
    fi

    # Re-validate based on project type
    case $PROJECT_TYPE in
      claude-marketplace)
        # Verify marketplace.json matches all plugin.json files
        ECOSYSTEM_VERSION=$(jq -r '.metadata.version' .claude-plugin/marketplace.json)
        echo "Ecosystem version: $ECOSYSTEM_VERSION"

        MISMATCHES=0
        jq -r '.plugins[] | "\(.name):\(.version)"' .claude-plugin/marketplace.json | while IFS=: read -r name version; do
          if [[ -f "plugins/$name/.claude-plugin/plugin.json" ]]; then
            ACTUAL=$(jq -r '.version' "plugins/$name/.claude-plugin/plugin.json")
            if [[ "$version" != "$ACTUAL" ]]; then
              echo "❌ STILL MISMATCHED: $name (marketplace=$version, actual=$ACTUAL)"
              MISMATCHES=$((MISMATCHES + 1))
            else
              echo "✓ $name: $version"
            fi
          fi
        done

        # Check CHANGELOG entry exists
        if [[ -f "CHANGELOG.md" ]] && ! grep -q "\[$ECOSYSTEM_VERSION\]" CHANGELOG.md; then
          echo "❌ CHANGELOG.md still missing entry for $ECOSYSTEM_VERSION"
          MISMATCHES=$((MISMATCHES + 1))
        fi
        ;;

      python)
        # Verify pyproject.toml matches __version__ in code
        TOML_VERSION=$(grep "^version" pyproject.toml | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
        if [[ -d "src" ]]; then
          VERSION_PY=$(find src -name "__init__.py" -exec grep -l "__version__" {} \; | head -1)
          if [[ -n "$VERSION_PY" ]]; then
            CODE_VERSION=$(grep "__version__" "$VERSION_PY" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
            if [[ "$TOML_VERSION" != "$CODE_VERSION" ]]; then
              echo "❌ STILL MISMATCHED: pyproject.toml=$TOML_VERSION, $VERSION_PY=$CODE_VERSION"
            else
              echo "✓ Python versions consistent: $TOML_VERSION"
            fi
          fi
        fi
        ;;

      node)
        # Verify package.json matches package-lock.json
        PKG_VERSION=$(jq -r '.version' package.json)
        if [[ -f "package-lock.json" ]]; then
          LOCK_VERSION=$(jq -r '.version' package-lock.json)
          if [[ "$PKG_VERSION" != "$LOCK_VERSION" ]]; then
            echo "❌ STILL MISMATCHED: package.json=$PKG_VERSION, package-lock.json=$LOCK_VERSION"
          else
            echo "✓ Node versions consistent: $PKG_VERSION"
          fi
        fi
        ;;

      rust)
        # Verify Cargo.toml version
        CARGO_VERSION=$(grep "^version" Cargo.toml | head -1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
        echo "✓ Cargo.toml version: $CARGO_VERSION"
        # Check Cargo.lock is updated (regenerated)
        if [[ -f "Cargo.lock" ]]; then
          echo "ℹ️ Verify Cargo.lock was regenerated after version update"
        fi
        ;;
    esac

**Version Validation Must Pass**

**If any version mismatches remain, DO NOT proceed. Fix them first.**

| Version Issue Type | Fix Required | |-------------------|--------------| | marketplace.json vs plugin.json mismatch | Update marketplace.json OR plugin.json to match | | pyproject.toml vs __version__ mismatch | Sync both to same version | | package.json vs package-lock.json mismatch | Run `npm install` to regenerate lock | | Missing CHANGELOG entry | Add entry for new version |

5.2 Execute Test Plan

After applying fixes and version validation, execute the test plan generated by `/pr-review`.

**Locate Test Plan:**

   # Option 1: Check if test plan was saved to file
   ls .pr-review/test-plan-*.md 2>/dev/null

   # Option 2: Search PR comments for test plan (generated by /pr-review)
   # Look for comments with "## Test Plan for PR #"
   gh api repos/OWNER/REPO/issues/PR_NUMBER/comments \
     --jq '.[] | select(.body | contains("## Test Plan for PR")) | {id: .id, created_at: .created_at, body: .body}'

**Test Plan Discovery Rules:**

• Check for local file first (`.pr-review/test-plan-*.md`)
• If not found, search PR comments for "## Test Plan for PR #N"
• The test plan comment contains:
• Prerequisites checklist
• Verification steps for each issue (numbered: B1, B2, S1, S2, etc.)
• Quality gate commands
• Summary checklist table
• Parse the test plan and create TodoWrite items for each verification step

5.3 Execute Verification Steps

For each issue in the test plan, run the verification steps:

    ### Test Plan Execution

    #### B1: Missing token validation
    - [x] Review the fix at `middleware/auth.py:45`
    - [x] Run: `pytest tests/test_auth.py -k "token_validation" -v` → PASSED
    - [x] Manual check: Invalid token returns 401 [DONE]
    - [x] Error response verified [DONE]

    #### B2: SQL injection vulnerability
    - [x] Review the fix at `models/user.