Skip to content

ci(final-check): neutralise mentions and references before the bot posts #383

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Seungpyo1007 merged 1 commit into from
Nov 1, 2026
Merged

ci(final-check): neutralise mentions and references before the bot posts #383

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 16 additions & 7 deletions .github/workflows/final-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,11 @@ name: final-check
# comment with the verdict; adding the label again edits that comment. This is
# the only place the TechEngineBot account is used.
#
# The check job runs PR code, so it gets no secrets and a read-only token.
# Only the comment job sees TECHENGINEBOT_TOKEN, which must be a fine-grained
# token of TechEngineBot for this repository with Pull requests: read and write
# and nothing else; the job refuses any other kind of token or account. Fork
# PRs never get a comment.
# The check job runs PR code, so it gets no secrets and a read-only token, and
# the comment job doesn't trust its report. Only the comment job sees
# TECHENGINEBOT_TOKEN, which must be a fine-grained token of TechEngineBot with
# Pull requests: read and write and nothing else; the job refuses any other
# kind of token or account. Fork PRs never get a comment.
on:
pull_request:
types: [labeled]
Expand Down Expand Up @@ -190,7 +190,7 @@ jobs:
fi
case "$TOKEN" in
github_pat_*) echo "ok=true" >> "$GITHUB_OUTPUT" ;;
*) echo "::error::TECHENGINEBOT_TOKEN must be a fine-grained token (github_pat_...) of TechEngineBot, for this repository only, with Pull requests: read and write."
*) echo "::error::TECHENGINEBOT_TOKEN must be a fine-grained token (github_pat_...) of TechEngineBot with Pull requests: read and write."
exit 1 ;;
esac

Expand All @@ -203,7 +203,16 @@ jobs:
github-token: ${{ secrets.TECHENGINEBOT_TOKEN }}
script: |
const marker = '<!-- techapi-final-check -->';
const body = process.env.BODY || '';
// The check job ran the PR's code, so its report is untrusted here:
// drop every @ and break issue references and issue/PR links, so the
// comment can neither mention anyone nor cross-reference anything.
const zw = String.fromCharCode(0x200b); // zero-width space
const body = (process.env.BODY || '')
.replace(/@/g, '')
.replace(/(?<!&)#(?=\d+\b)/g, `#${zw}`)
.replace(/\bgh-(?=\d+\b)/gi, `$&${zw}`)
.replace(/\/(issues|pull|discussions)\/(?=\d)/g, `/$1/${zw}`)
.slice(0, 65000);
if (!body.startsWith(marker)) {
core.setFailed('The check job produced no report; nothing posted.');
return;
Expand Down
3 changes: 2 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,8 @@ For an important PR, a maintainer adds the `final-check` label.
[`final-check.yml`](.github/workflows/final-check.yml) then builds everything
`pages.yml` would publish from the PR and runs TechEngine's Tier 0-3
verification of the changed records. TechEngineBot posts one comment with the
verdict; adding the label again updates that comment.
verdict; adding the label again updates that comment. The comment can't mention
anyone or reference other issues: `@` is dropped and `#123` links are broken.

New and refreshed records come from
[`collect.yml`](.github/workflows/collect.yml), which a maintainer runs by hand
Expand Down