ci: fix security issue on comment.yml#1466
Merged
Marukome0743 merged 1 commit intoOpenUp-LabTakizawa:mainfrom Apr 9, 2026
Merged
ci: fix security issue on comment.yml#1466Marukome0743 merged 1 commit intoOpenUp-LabTakizawa:mainfrom
Marukome0743 merged 1 commit intoOpenUp-LabTakizawa:mainfrom
Conversation
github-actions
bot
added
dependencies
🪄 Deploy Preview for ready!
|
|
@Marukome0743 is attempting to deploy a commit to the OpenUp Lab Takizawa Team on Vercel. A member of the Team first needs to authorize it. |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. Scanned FilesNone |
レビュー担当者向けガイド（小さい PR では折りたたみ）レビュー担当者向けガイドGitHub Actions のコメント用ワークフローをリファクタリングし、環境変数ではなく github-script ステップ内のファイルから PR 番号とコメント本文を直接読み込むようにすることで、安全でない環境変数の補間を排除し、あわせて Bun の lock/prepare-state メタデータを更新します。 更新された PR コメント用 GitHub Actions ワークフローのシーケンス図sequenceDiagram
participant GitHubActions
participant CommentWorkflow
participant GithubScriptStep
participant FileSystem
participant GitHubAPI
GitHubActions->>CommentWorkflow: Trigger on workflow_run
CommentWorkflow->>GithubScriptStep: Run actions/github-script
GithubScriptStep->>FileSystem: readFile pr_number/pr_number.txt
FileSystem-->>GithubScriptStep: prNumber (digits only)
GithubScriptStep->>FileSystem: readFile comment/comment.txt
FileSystem-->>GithubScriptStep: comment body text
GithubScriptStep->>GitHubAPI: issues.listComments(owner, repo, prNumber)
GitHubAPI-->>GithubScriptStep: existing PR comments
GithubScriptStep->>GithubScriptStep: find existing bot comment matching WORKFLOW_NAME
GithubScriptStep->>GithubScriptStep: determine shouldComment using CONCLUSION and oldComment
alt shouldComment is false
GithubScriptStep-->>CommentWorkflow: exit without commenting
else shouldComment is true
alt oldComment exists
GithubScriptStep->>GitHubAPI: issues.updateComment(commentId, new body)
GitHubAPI-->>GithubScriptStep: updated comment
else no oldComment
GithubScriptStep->>GitHubAPI: issues.createComment(prNumber, comment)
GitHubAPI-->>GithubScriptStep: created comment
end
GithubScriptStep-->>CommentWorkflow: finish step
end
CommentWorkflow-->>GitHubActions: job completed
更新された GitHub Actions スクリプト内でのコメント有無の判断ロジックのフローダイアグラムflowchart TD
A[Start github-script step] --> B[Read prNumber from pr_number/pr_number.txt]
B --> C[Strip non digit characters from prNumber]
C --> D[Read comment text from comment/comment.txt]
D --> E[Call GitHub API issues.listComments with prNumber]
E --> F[Find existing bot comment containing WORKFLOW_NAME]
F --> G{oldComment exists
OR CONCLUSION equals failure}
G -->|No| H[Do not comment]
H --> Z[End]
G -->|Yes| I{oldComment exists?}
I -->|Yes| J[Update existing comment with new comment text]
I -->|No| K[Create new PR comment with comment text]
J --> Z
K --> Z
ファイル単位の変更点
Tips とコマンドSourcery とのやり取り
体験をカスタマイズするダッシュボード にアクセスすると、次のことができます:
ヘルプを受ける
Original review guide in EnglishReviewer's guide (collapsed on small PRs)Reviewer's GuideRefactors the GitHub Actions comment workflow to read PR number and comment text directly from files inside the github-script step instead of environment variables, eliminating unsafe env interpolation, and updates Bun lock/prepare-state metadata accordingly. Sequence diagram for updated PR comment GitHub Actions workflowsequenceDiagram
participant GitHubActions
participant CommentWorkflow
participant GithubScriptStep
participant FileSystem
participant GitHubAPI
GitHubActions->>CommentWorkflow: Trigger on workflow_run
CommentWorkflow->>GithubScriptStep: Run actions/github-script
GithubScriptStep->>FileSystem: readFile pr_number/pr_number.txt
FileSystem-->>GithubScriptStep: prNumber (digits only)
GithubScriptStep->>FileSystem: readFile comment/comment.txt
FileSystem-->>GithubScriptStep: comment body text
GithubScriptStep->>GitHubAPI: issues.listComments(owner, repo, prNumber)
GitHubAPI-->>GithubScriptStep: existing PR comments
GithubScriptStep->>GithubScriptStep: find existing bot comment matching WORKFLOW_NAME
GithubScriptStep->>GithubScriptStep: determine shouldComment using CONCLUSION and oldComment
alt shouldComment is false
GithubScriptStep-->>CommentWorkflow: exit without commenting
else shouldComment is true
alt oldComment exists
GithubScriptStep->>GitHubAPI: issues.updateComment(commentId, new body)
GitHubAPI-->>GithubScriptStep: updated comment
else no oldComment
GithubScriptStep->>GitHubAPI: issues.createComment(prNumber, comment)
GitHubAPI-->>GithubScriptStep: created comment
end
GithubScriptStep-->>CommentWorkflow: finish step
end
CommentWorkflow-->>GitHubActions: job completed
Flow diagram for comment decision logic in updated GitHub Actions scriptflowchart TD
A[Start github-script step] --> B[Read prNumber from pr_number/pr_number.txt]
B --> C[Strip non digit characters from prNumber]
C --> D[Read comment text from comment/comment.txt]
D --> E[Call GitHub API issues.listComments with prNumber]
E --> F[Find existing bot comment containing WORKFLOW_NAME]
F --> G{oldComment exists
OR CONCLUSION equals failure}
G -->|No| H[Do not comment]
H --> Z[End]
G -->|Yes| I{oldComment exists?}
I -->|Yes| J[Update existing comment with new comment text]
I -->|No| K[Create new PR comment with comment text]
J --> Z
K --> Z
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - いくつか高レベルなフィードバックを残しました。
pr_number/pr_number.txtをパースする際、ファイルが存在しない場合や、結果として得られたprNumberが空の場合を明示的にハンドリングすることを検討してください。そうすることで、暗黙の失敗や無効な issue 番号にコメントを作成してしまうことを防げます。- ファイルから読み込んだ後の
prNumberとcommentの値に対してtrim()を実行しておくと、想定外の末尾の空白や改行が GitHub API 呼び出しに影響するのを防げるので、より安全かもしれません。
AI エージェント向けプロンプト
Please address the comments from this code review:
## Overall Comments
- When parsing `pr_number/pr_number.txt`, consider explicitly handling the case where the file is missing or the resulting `prNumber` is empty to avoid silently failing or creating comments on an invalid issue number.
- It may be safer to `trim()` the `prNumber` and `comment` values after reading from the files to guard against unexpected trailing whitespace or newline issues affecting the GitHub API calls.もっと役に立てるように手助けしてください！ 各コメントに 👍 または 👎 を付けていただけると、そのフィードバックをもとにレビューを改善していきます。
Original comment in English
Hey - I've left some high level feedback:
- When parsing
pr_number/pr_number.txt, consider explicitly handling the case where the file is missing or the resultingprNumberis empty to avoid silently failing or creating comments on an invalid issue number. - It may be safer to
trim()theprNumberandcommentvalues after reading from the files to guard against unexpected trailing whitespace or newline issues affecting the GitHub API calls.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- When parsing `pr_number/pr_number.txt`, consider explicitly handling the case where the file is missing or the resulting `prNumber` is empty to avoid silently failing or creating comments on an invalid issue number.
- It may be safer to `trim()` the `prNumber` and `comment` values after reading from the files to guard against unexpected trailing whitespace or newline issues affecting the GitHub API calls.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Overview
Labels (3 changes)
-org.opencontainers.image.created=2026-04-09T00:15:19.172Z
+org.opencontainers.image.created=2026-04-09T12:35:27.791Z
org.opencontainers.image.description=Disability Certificate Register System📇
org.opencontainers.image.licenses=Apache-2.0
-org.opencontainers.image.revision=40f746168ba8600ef4ed935427272cb5d6098239
+org.opencontainers.image.revision=7896cea2be21ae15351995e28c09bb5fab9ad0a9
org.opencontainers.image.source=https://github.com/OpenUp-LabTakizawa/dcrs
org.opencontainers.image.title=dcrs
org.opencontainers.image.url=https://github.com/OpenUp-LabTakizawa/dcrs
-org.opencontainers.image.version=canary
+org.opencontainers.image.version=pr-1466Packages and Vulnerabilities (5 package changes and 1 vulnerability changes)
Changes for packages of type
|
| Package | Versionmarukome0743/dcrs:canary |
Versionmarukome0743/dcrs:pr-1466 |
|
|---|---|---|---|
| ➕ | gcc-14 | 14.2.0-19 |
|
| ➕ | glibc | 2.41-12+deb13u2 |
|
| ➕ | libzstd | 1.5.7+dfsg-1 |
|
| ➕ | openssl | 3.5.5-1~deb13u1 |
|
| ➕ | zlib | 1:1.3.dfsg+really1.3.1-1 |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
GitHub Actions のワークフローを改善し、環境変数ではなくチェックアウトされたファイルから直接入力を読み取って PR コメントを投稿するようにするとともに、Bun のロックファイルの状態を更新します。
Bug Fixes:
Build:
mise prepare-stateの設定で追跡しているハッシュを更新。CI:
github-scriptステップ内で PR 番号とコメント本文を計算するように、コメント用ワークフローを更新。Original summary in English
Summary by Sourcery
Improve the GitHub Actions workflow that posts PR comments by reading inputs directly from checked-out files instead of environment variables and refresh the Bun lockfile state.
Bug Fixes:
Build:
CI: