Modernization of the Test Scripts screen (lib/testcases/scriptAdd.php, lib/testcases/scriptDelete.php, gui/templates/dashio/include/showScriptsTable.inc.tpl), which links source files from the test project's Code Tracker to a test case version — GitHub issue #1543. Its popup twin (link/unlink right from the Test Case content frame) is the Execution Script Edit popup (#1574).

TestLink's "Test Scripts" story lets a test case version reference the code that automates it. The 1.9.20 implementation was a narrow legacy form that worked reliably only for the Stash code-tracker interface; the native GitHub interface shipped with it had no repository-content browsing at all. This milestone re-implements the screen with full GitHub REST support (the screens' modern twin, Code Tracker Management, configures the tracker; any existing data is preserved).

URL: gui/templates/testcases/tcScripts.html?tproject_id=<id>&tcversion_id=<id> BFF API: api/tcscripts/index.php (GET tracker|list|commits|files, POST link|unlink) Rights: authenticated session required (401 anonymous); mgt_modify_tc on the owning project for link/unlink (403 otherwise) Entry points: "Test Scripts" action in the modern Test Case Viewer toolbar (tcView.html); direct URL.

1. What the screen does
2. REST API Reference
3. Legacy parity notes
4. i18n Keys
5. Security
6. Testing

All routes need a session (401 anonymous) and pass the bffSameOriginGuard (for POST: X-Requested-With: XMLHttpRequest or same-origin Referer). Reads may pass tproject_id explicitly or only tcversion_id (the owning project is resolved through the nodes tree).

GET list 200 payload (truncated):

{ "status":"ok", "scripts":[{
    "script_id":"sebiboga&&testlink-upgraded&&docs/CI-FACTORY.md",
    "project_key":"sebiboga","repository_name":"testlink-upgraded",
    "code_path":"docs/CI-FACTORY.md","branch_name":"sebiboga",
    "commit_id":"","view_url":"https://github.com/sebiboga/testlink-upgraded/blob/sebiboga/docs/CI-FACTORY.md"
}], "can_modify":"yes","tproject_id":12 }

POST link 200:

{ "status":"ok","message":"Test Script link added","link":{
    "script_id":"sebiboga&&testlink-upgraded&&docs/CI-FACTORY.md",
    "project_key":"sebiboga","repository_name":"testlink-upgraded",
    "code_path":"docs/CI-FACTORY.md","branch_name":"sebiboga","commit_id":null,
    "view_url":"https://github.com/sebiboga/testlink-upgraded/blob/sebiboga/docs/CI-FACTORY.md"} }

• Row identity is the 1.9.20 composite: project_key && repository_name && code_path (three PK columns of testcase_script_links) — unlink works with a script_id copied out of that table (legacy scriptDelete.php behaviour).
• Normalisation pipeline (scriptAdd parity): strip the view base (uribase/viewBase) from a pasted URL, then (GitHub) the owner/repo/(blob|tree)/<ref>/ prefix, then any ?at= branch/commit reference; commit refs may come as refs/heads/x / refs/tags/x / raw branch / [0-9a-f]{7,40} hash.
• Interface gap filled: githubrestCodeTrackerInterface has no repo-content browsing (only Stash did). The BFF speaks the GitHub contents API itself (ghContents, ghGet with optional bearer token + proxy) so the file browser and the CTS validation work for GitHub trackers.
• Commits come from the githubrest interface and are PHP arrays (the route maps them onto {sha, full, message, author, date}).
• No code tracker / disabled project: the screen shows a localized banner and hides the Link action; list still renders (empty).
• The screen requires a tcversion_id; the project id can be implicit.

tscs.* (29 keys, all 10 bundles) plus footers.tcScripts and the entry-point key tcview.testScripts. All common.* keys used (refresh, cancel, save, actions) already existed. Romanian is a full translation; the other 8 bundles carry the English value.

• Session auth + 401 on anonymous (verified with curl, no cookie).
• bffSameOriginGuard CSRF proof required on every POST.
• mgt_modify_tc gate on link/unlink → 403 (reads stay open to project viewers).
• Prepared statements via $db->prepare_string() on every user string.
• Output escaping in JS (esc()/escJs()) for paths/labels injected into the GUI (no printf-paste of untracked content); the GitHub view link is built server-side and rendered as a normal <a>.
• No secrets in the repo: the tracker token lives in the code-tracker cfg (server-side), never sent to the client; the fixture reads a token from the environment only.

Executed in the browser (admin/admin, http://localhost:8082, fixture project TS1543 = tproject 12, TC-TS1543 version 1 = tcversion 15, GitHub tracker GH-TS1543):

• List renders (Code Path / Project / Repository / Branch / Commit / Actions).
• Link Script modal: repository prefilled, branch prefilled + hint of all GitHub branches, commit selector, file tree root → drill down docs/ → click docs/CHANGELOG-2.0.1.md fills Code Path.
• Save→alert "Test Script link added", table refreshes (3 rows incl. docs/CI-FACTORY.md), repo name stored not the full URL.
• Duplicate re-link is a no-op (no new row, idempotent).
• Delete → confirm modal shows path → Confirm → alert "The test script link was successfully deleted!", row gone.
• Backend paths via curl + session cookie: tracker/branches, commits (message+author+date), files tree, magic-path normalisation for https://github.com/<o>/<r>/blob/<ref>/<path>, and ?at= (Stash) refs.
• Right path: POST link/unlink without mgt_modify_tc → 403.
• Audit rows land in events with correct labels (CREATE/DELETE, testcase_script_links); Event Viewer shows no new ERROR/WARN.
• Locale switcher present; all 10 *.json bundles pass json.tool.

See tmp/TLU_Test_Cases.md → Suite 1543 for the recorded run.