Apply strict matching to slash commands (startsWith + exact equality) #14702

Copilot · 2026-02-10T00:30:02Z

Slash commands previously matched anywhere in issue/PR/comment bodies using contains(), causing false positives when commands appeared in documentation or quoted text.

Changes

pkg/workflow/command.go: Modified buildMultiCommandCheck to generate strict matching conditions:
- startsWith(body, '/command ') for commands with arguments
- body == '/command' for exact match
- Combined with OR: (startsWith(...) || body == '...')
Test updates: Updated expectations in command_precision_test.go, command_test.go, compiler_events_test.go, and permission_restriction_test.go
Workflow recompilation: All 148 workflows regenerated with new pattern

Example

Before (false positives):

if: contains(github.event.issue.body, '/q')
# Matches "Please use /q to query" ❌

After (strict):

if: |
  (startsWith(github.event.issue.body, '/q ') || 
   github.event.issue.body == '/q')
# Only matches commands at start of text ✓

This matches the pattern used in secure GitHub Actions slash command implementations.

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Changeset

Type: patch
Description: Prevent slash command matching from triggering when the command occurs mid-sentence by ensuring the compiler uses strict start-of-line checks.

Generated by Changeset Generator

…ality Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-02-10T00:46:36Z

🧪 Smoke Project is now testing project operations...

github-actions · 2026-02-10T00:46:39Z

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

github-actions · 2026-02-10T00:46:39Z

✅ Changeset Generator completed successfully!

github-actions · 2026-02-10T00:46:40Z

🎬 THE END — Smoke Claude MISSION: ACCOMPLISHED! The hero saves the day! ✨

github-actions · 2026-02-10T00:46:52Z

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

github-actions · 2026-02-10T00:50:07Z

✅ Smoke Project completed successfully. All project operations validated.

github-actions · 2026-02-10T00:50:14Z

Agent Container Tool Check ✅

All required development tools are available in the agent container:

Tool	Status	Version
bash	✅	5.2.21
sh	✅	available
git	✅	2.52.0
jq	✅	1.7
yq	✅	4.52.2
curl	✅	8.5.0
gh	✅	2.86.0
node	✅	20.20.0
python3	✅	3.12.3
go	✅	1.24.12
java	✅	21.0.10
dotnet	✅	10.0.102 SDK

Result: 12/12 tools available ✅

All common development tools (shell, VCS, JSON/YAML processing, HTTP, GitHub CLI, and programming runtimes) are properly installed and accessible in the container environment.

AI generated by Agent Container Smoke Test

github-actions · 2026-02-10T00:51:31Z

🤖 Beep boop! The smoke test agent was here! 🚀

Just finished testing all the systems and wanted to leave a fun note in your awesome static analysis discussion. Keep up the great work catching those security issues! 🔒✨

May your workflows always compile and your tests always pass! 🎉

AI generated by Smoke Copilot

github-actions · 2026-02-10T00:51:31Z

PRs: Fix detection job checkout failure from missing contents permission; chore: create workflow video with voice over
GitHub MCP: ✅
Serena MCP: ✅
Playwright: ✅
File write+cat: ✅
Build: ✅
Overall: PASS

AI generated by Smoke Codex

github-actions · 2026-02-10T00:51:31Z

🎭 The Smoke Test Agent drops by 🎭

Hey there! Just ran through the smoke tests for PR #14702 and wanted to share the results:

Test Results:

✅ GitHub MCP: Reviewed last 2 merged PRs (Fix detection job checkout failure from missing contents permission #14698, chore: create workflow video with voice over #14697)
✅ Safe Inputs GH CLI: Queried 2 PRs successfully
❌ Serena MCP: Project activated but symbol search returned 0 results (expected 3+)
✅ Playwright: Navigated to github.com, verified title contains "GitHub"
✅ File Writing: Created test file successfully
✅ Bash Tool: Verified file creation
✅ Build gh-aw: Compiled successfully with GOCACHE/GOMODCACHE set to /tmp
✅ Workflow Dispatch: Triggered haiku-printer workflow

Overall Status: PARTIAL PASS ⚠️

cc @pelikhan @Copilot

AI generated by Smoke Copilot

github-actions · 2026-02-10T00:51:49Z

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

Copilot

Pull request overview

This PR updates how slash commands are detected in generated GitHub Actions expressions to avoid false positives when a command appears mid-text, and regenerates affected compiled workflows and tests accordingly.

Changes:

Updated command condition generation to use startsWith(..., '/cmd ') || body == '/cmd' instead of contains(...).
Adjusted multiple Go tests to expect strict matching patterns.
Recompiled committed .lock.yml workflows to reflect the new command-matching expressions.

Reviewed changes

Copilot reviewed 21 out of 21 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pkg/workflow/command.go	Implements strict command matching using `startsWith` + exact equality.
pkg/workflow/compiler_events_test.go	Updates expected `if` condition substrings for command-triggered workflows.
pkg/workflow/command_test.go	Updates assertions to accept strict matching patterns and avoid `contains(...)`.
pkg/workflow/command_precision_test.go	Updates precision expectations to verify strict matching terms appear for each event body accessor.
pkg/workflow/permission_restriction_test.go	Updates permission-check test to accept strict matching patterns.
.github/workflows/unbloat-docs.lock.yml	Regenerated compiled workflow with strict command matching.
.github/workflows/tidy.lock.yml	Regenerated compiled workflow with strict command matching.
.github/workflows/security-review.lock.yml	Regenerated compiled workflow with strict command matching.
.github/workflows/scout.lock.yml	Regenerated compiled workflow with strict command matching across multiple event bodies.
.github/workflows/q.lock.yml	Regenerated compiled workflow with strict command matching across multiple event bodies.
.github/workflows/pr-nitpick-reviewer.lock.yml	Regenerated compiled workflow with strict command matching across multiple event bodies.
.github/workflows/poem-bot.lock.yml	Regenerated compiled workflow with strict command matching for issues body.
.github/workflows/plan.lock.yml	Regenerated compiled workflow with strict command matching for comment bodies.
.github/workflows/pdf-summary.lock.yml	Regenerated compiled workflow with strict command matching for issues + issue_comment bodies.
.github/workflows/mergefest.lock.yml	Regenerated compiled workflow with strict command matching for PR comment bodies.
.github/workflows/grumpy-reviewer.lock.yml	Regenerated compiled workflow with strict command matching for issue_comment and review_comment bodies.
.github/workflows/craft.lock.yml	Regenerated compiled workflow with strict command matching for issues body.
.github/workflows/cloclo.lock.yml	Regenerated compiled workflow with strict command matching across multiple event bodies.
.github/workflows/brave.lock.yml	Regenerated compiled workflow with strict command matching for issue_comment bodies.
.github/workflows/archie.lock.yml	Regenerated compiled workflow with strict command matching for issues/issue_comment/pull_request bodies.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-10T00:52:01Z

pkg/workflow/command.go

 			commandText := fmt.Sprintf("/%s", commandName)
-			commandOrChecks = append(commandOrChecks, BuildContains(
+			commandWithSpace := fmt.Sprintf("/%s ", commandName)
+
+			// Check for exact match (command without arguments)
+			exactMatch := BuildEquals(
 				BuildPropertyAccess(bodyAccessor),
 				BuildStringLiteral(commandText),
-			))
+			)
+
+			// Check for command with arguments (starts with "/<command> ")
+			startsWithMatch := BuildFunctionCall("startsWith",
+				BuildPropertyAccess(bodyAccessor),
+				BuildStringLiteral(commandWithSpace),
+			)
+
+			// Combine: exact match OR starts with pattern
+			commandCheck := &OrNode{
+				Left:  startsWithMatch,
+				Right: exactMatch,
+			}
+
+			commandOrChecks = append(commandOrChecks, commandCheck)


The new strict match only triggers on an exact "/" or when the body starts with "/ " (a literal space). This will not match commands preceded by leading whitespace/newlines (e.g. "\n /cmd ...") or commands followed by other whitespace (e.g. "/cmd\narg"), but the runtime command parser in actions/setup/js/check_command_position.cjs trims and splits on \s+ (and its tests explicitly expect leading whitespace to still pass). This mismatch can cause valid commands to be skipped before check_command_position ever runs. Consider aligning the workflow if generation with the parser’s whitespace handling (or tightening the parser/tests to match the new definition) so command triggering is consistent.

github-actions · 2026-02-10T00:53:44Z

🔍 PR Triage Results

Category: test | Risk: low | Priority: 41/100

Scores Breakdown

Impact: 25/50 - Test improvements enhance command matching reliability
Urgency: 8/30 - Recent PR (0.3 hours old), normal priority
Quality: 8/20 - CI pending, draft with detailed checklist, includes test updates

📋 Recommended Action: BATCH_REVIEW

✅ Batched with PR #14682 as batch-test-001 - Test workflow additions that can be reviewed together for efficiency.

Changes: Updates slash command matching to use strict regex (startsWith/exact match) preventing false positives. Includes comprehensive test updates across 20 files (360 lines).

Batch Context: Part of test infrastructure improvements. Both PRs in this batch focus on test coverage and validation paths.

Next Steps:

Review alongside PR Add test workflow for project-related safe output token failure paths #14682 in coordinated batch review
Verify all 148 recompiled workflows use strict matching
Confirm test expectations align with new behavior
Batch merge after approval

Triaged by PR Triage Agent on 2026-02-10 00:45 UTC

AI generated by PR Triage Agent

Initial plan

b008766

Copilot AI assigned Copilot and pelikhan Feb 10, 2026

Copilot started work on behalf of pelikhan February 10, 2026 00:30 View session

Copilot AI and others added 2 commits February 10, 2026 00:39

Implement strict slash command matching with startsWith and exact equ…

3dd75b3

…ality Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Fix permission_restriction_test to expect strict matching patterns

063adc4

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan added the smoke label Feb 10, 2026

pelikhan marked this pull request as ready for review February 10, 2026 00:46

Copilot AI review requested due to automatic review settings February 10, 2026 00:46

Copilot AI changed the title ~~[WIP] Add strict regex matching to slash commands~~ Apply strict matching to slash commands (startsWith + exact equality) Feb 10, 2026

Copilot started reviewing on behalf of pelikhan February 10, 2026 00:47 View session

Copilot AI requested a review from pelikhan February 10, 2026 00:47

Copilot finished work on behalf of pelikhan February 10, 2026 00:47

Add changeset [skip-ci]

a7d1f51

github-actions bot added smoke-codex smoke-copilot and removed smoke labels Feb 10, 2026

github-actions bot mentioned this pull request Feb 10, 2026

Smoke Test: Copilot - 21846940876 #14703

Closed

Copilot AI reviewed Feb 10, 2026

View reviewed changes

github-actions bot mentioned this pull request Feb 10, 2026

Smoke Test: Claude - 21846940889 #14705

Closed

pelikhan merged commit 6e7b93a into main Feb 10, 2026
1 check passed

pelikhan deleted the copilot/add-strict-regex-to-commands branch February 10, 2026 00:53

github-actions bot added pr-action:batch-review pr-agent:manual pr-batch:batch-test-001 pr-priority:medium pr-risk:low pr-type:test labels Feb 10, 2026

Apply strict matching to slash commands (startsWith + exact equality) #14702

Apply strict matching to slash commands (startsWith + exact equality) #14702

Conversation

Copilot AI commented Feb 10, 2026 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Example

Changeset

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Agent Container Tool Check ✅

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

github-actions bot commented Feb 10, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Feb 10, 2026

🔍 PR Triage Results

Scores Breakdown

📋 Recommended Action: BATCH_REVIEW

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Feb 10, 2026 •

edited by github-actions bot

Loading

github-actions bot commented Feb 10, 2026 •

edited

Loading

github-actions bot commented Feb 10, 2026 •

edited

Loading

github-actions bot commented Feb 10, 2026 •

edited

Loading