[WRONG BRANCH] fix(actions): reject spoofed issue-quality state

[luvs01]

Motivation

• Prevent other github-actions[bot] comments (for example translator bot comments) from spoofing the issue-quality hidden state and disabling automated closure via a forged maintainerOverride tag.

Description

• Add a canonical comment validator isCanonicalIssueQualityComment in .github/scripts/issue-quality.cjs that only accepts a github-actions[bot] comment whose body begins with the issue-quality marker and the state tag.
• Export and use the validator from the workflow-run script so the workflow selects persisted bot state only from the canonical issue-quality comment instead of any bot comment containing the marker.
• Update .github/workflows/enforce-issue-quality.yml to import and use the new predicate when choosing which comment to parse for saved state.
• Add regression tests in .github/scripts/issue-quality.test.cjs covering the canonical comment case, a spoofed translator-bot comment, and a matching comment authored by a non-bot user.

Testing

• Ran node --test .github/scripts/issue-quality.test.cjs which executed the suite containing the new tests and reported all tests passing (115 tests passed).
• Ran git diff --check and local checks for whitespace/parse errors which returned clean results.
• Ran the repository pre-push workflow (bun run prepush) partially; repository typecheck, GUI lint, and many tests ran, but the full prepush run encountered unrelated long-running test/timeouts in other suites and was stopped after those failures (these failures are not related to the issue-quality change).

---

Codex Task

Summary by CodeRabbit

• Bug Fixes

  • Improved issue-quality validation to recognize only authentic, correctly marked automated comments.
  • Prevented comments from other workflows or non-automated authors from being treated as valid issue-quality results.

• Tests

  • Added coverage for valid automated comments and rejected spoofed or incorrectly authored comments.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change centralizes canonical issue-quality comment detection, adds tests for accepted and rejected comment authors and markers, and updates workflow validation to use the shared predicate.

Changes

Issue-quality comment canonicalization

Layer / File(s)	Summary
Canonical comment predicate and coverage .github/scripts/issue-quality.cjs, .github/scripts/issue-quality.test.cjs	The helper defines canonical marker constants and exports isCanonicalIssueQualityComment. Tests cover valid GitHub Actions comments, spoofed workflow markers, and non-actions authors.
Workflow validation integration .github/workflows/enforce-issue-quality.yml	The validation job imports the shared predicate and uses it to locate the canonical issue-quality bot comment.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: wibias, ingwannu

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: rejecting spoofed issue-quality state in GitHub Actions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-issue-quality-override-state-spoofing

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev. UI screenshot required.

What to do

• Retarget this PR to dev — all contributions go to dev.
• Add a screenshot of the UI change to the PR description.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/scripts/issue-quality.cjs:
- Line 107: Update the workflow’s comment detection and emission logic near
BOT_MARKER, STATE_RE, and isCanonicalIssueQualityComment to reuse the canonical
marker and state-prefix definitions owned by the exported predicate. Export the
shared constants or provide parse/format helpers, then remove the duplicate
workflow-local values so persisted state and maintainerOverride handling stay
consistent.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6d7803fd-c17f-4175-b508-fd0dbb736a73

📥 Commits

Reviewing files that changed from the base of the PR and between 121f1ad and 8f5c971.

📒 Files selected for processing (3)

• .github/scripts/issue-quality.cjs
• .github/scripts/issue-quality.test.cjs
• .github/workflows/enforce-issue-quality.yml

[coderabbitai]

🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Single-source the canonical comment format.

The exported predicate owns the marker and state-prefix constants, but the workflow still declares independent BOT_MARKER and STATE_RE values at Line 888 and Line 889. If the definitions diverge, the workflow can ignore its own persisted state, create duplicate comments, or miss maintainerOverride. Export the shared values or expose shared parse and format helpers for detection, parsing, and emission.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/scripts/issue-quality.cjs at line 107, Update the workflow’s comment
detection and emission logic near BOT_MARKER, STATE_RE, and
isCanonicalIssueQualityComment to reuse the canonical marker and state-prefix
definitions owned by the exported predicate. Export the shared constants or
provide parse/format helpers, then remove the duplicate workflow-local values so
persisted state and maintainerOverride handling stay consistent.