Skip to content

harden PR→issue linking gate against shell injection and missed refs #35794

@nollymar

Description

@nollymar

Description

The PR-to-issue linking gate (.github/workflows/issue_open-pr.ymlissue_comp_link-issue-to-pr.yml) has three bugs that let PRs slip through unchecked or stay broken after a fix:

  1. Shell injection in the Debug step. inputs.pr_body / inputs.pr_title were template-interpolated by GitHub Actions directly into the Debug workflow inputs bash script. PRs whose body contained backticks, $var(...), or unbalanced parens (observed on PR feat(tiptap): convert Story Block content to Markdown (#35727) #35728's $markdownTool.blockToMarkdown(json)) caused a bash syntax error → the whole job exited with code 2 → Add failure comment to PR was skipped (its if: requires failure_detected=true, which never got set) → no PR-visible signal.

  2. Missed markdown-linked refs. The body-keyword regex (close[ds]?|fix(e[ds])?|resolve[ds]?)(:)?\s+#([0-9]+) requires a literal # immediately after the keyword and misses GitHub's other valid form fixes [#123](url) (observed on PR feat(dotAI): Dot AI LangChain4J - Amazon Bedrock #35242's fixes [#35183](url)).

  3. Stale-on-open. The workflow only triggered on pull_request: [opened], so editing the PR body or pushing new commits never re-evaluated the gate. A once-broken PR stayed broken even after the author fixed the link.

Acceptance Criteria

  • PR body / title values containing bash metacharacters do not crash the workflow.
  • Markdown-linked refs like fixes [#123](url) are recognized as a valid issue link (via closingIssuesReferences GraphQL fallback).
  • The gate re-evaluates on edited, synchronize, and reopened — not just opened.
  • The ❌ Issue Linking Required comment is not duplicated on subsequent re-runs of the same PR.
  • Fork-sourced PRs are skipped (read-only token would 403 on PATCH/POST/DELETE).
  • GraphQL fallback failures surface via ::warning:: instead of being silently swallowed.

Additional Context

Fix tracked in PR #35761. Quick draft — created primarily as a tracking link for that PR.

Metadata

Metadata

Assignees

Type

No fields configured for Task.

Projects

Status

In Review

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions