Repository navigation
fix(repo-health): decode Git-quoted leakage paths - #2101
Merged
bradygaster merged 2 commits intoSep 28, 2026
Merged
Conversation
Closes #1800 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 2 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | No source files changed — changeset not required |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ❌ | Copilot threads resolved | 3 unresolved Copilot thread(s) — fix and resolve before merging |
| ✅ | CI passing | All checks passing |
Files Changed (8 files, +382 −39)
| File | +/− |
|---|---|
.github/REPO_HEALTH_RUNBOOK.md |
+4 −1 |
.github/workflows/squad-repo-health-shadow.yml |
+2 −0 |
.github/workflows/squad-repo-health.yml |
+1 −1 |
scripts/check-squad-leakage.mjs |
+25 −27 |
scripts/git-path-decoder.mjs |
+102 −0 |
scripts/repo-health-comment.mjs |
+20 −7 |
test/scripts/check-squad-leakage.test.ts |
+124 −0 |
test/scripts/repo-health-comment-transport.test.ts |
+104 −3 |
Total: +382 −39
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
Contributor
🟡 Impact Analysis — PR #2101Risk tier: 🟡 MEDIUM 📊 Summary
🎯 Risk Factors
📦 Modules Affectedci-workflows (3 files)
scripts (3 files)
tests (2 files)
This report is generated automatically for every PR. See #733 for details. |
Contributor
🏗️ Architectural Review
Automated architectural review — informational only. |
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Out-of-range octal escapes are silently transformed, and several malformed-output tests can pass through the mocked deletion failure.
Review effort: Balanced
Findings: 1
Open (3)
What changed in this PR
Hardens the repo-health leakage pipeline by decoding Git-quoted paths exactly and validating scanner/comment transport.
Changes:
- Adds strict byte-first Git path decoding and scanner validation.
- Strengthens reporter ownership and malformed-output handling.
- Adds integration tests, shadow coverage, and canary verification.
| File | Description |
|---|---|
scripts/git-path-decoder.mjs |
Adds Git path decoding and validation. |
scripts/check-squad-leakage.mjs |
Uses decoder and fails closed. |
scripts/repo-health-comment.mjs |
Validates output and exact markers. |
.github/workflows/squad-repo-health.yml |
Separates scanner JSON from diagnostics. |
.github/workflows/squad-repo-health-shadow.yml |
Expands shadow workflow coverage. |
.github/REPO_HEALTH_RUNBOOK.md |
Verifies the exact canary path. |
test/scripts/check-squad-leakage.test.ts |
Tests decoding and scanner behavior. |
test/scripts/repo-health-comment-transport.test.ts |
Tests workflow/report transport. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+57
to
+65
| if (/[0-7]/.test(escaped)) { | ||
| const octal = `${escaped}${inner[index + 1] ?? ''}${inner[index + 2] ?? ''}`; | ||
| if (!/^[0-7]{3}$/.test(octal)) { | ||
| throw new Error('incomplete octal escape in Git C-quoted path'); | ||
| } | ||
| bytes.push(Number.parseInt(octal, 8)); | ||
| index += 2; | ||
| continue; | ||
| } |
Comment on lines
+384
to
+388
| await expect(runWorkflowScript( | ||
| step, | ||
| { 'steps.leakage.outputs.result': output }, | ||
| { comments: [{ id: 42, body: `${marker}\nold` }], fail: 'deleteComment' }, | ||
| )).rejects.toThrow(); |
Comment on lines
+50
to
+53
| } catch (err) { | ||
| const errorMessage = err instanceof Error ? err.message : String(err); | ||
| console.error(`Squad leakage scan failed: ${errorMessage}`); | ||
| process.exitCode = 1; |
bradygaster
deleted the
bradygaster-issue-1800-repo-health-path-decoding
branch
October 3, 2026 00:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--name-onlyC-quoted paths byte-first into exact raw UTF-8 before scanner JSON and comment transportpull_request_targettrust boundary; PR-head code remains confined to the read-only shadow workflowWorking as agentic-workflows-dev (Agentic Workflows Engineer).
Closes #1800
Validation
npx --no-install vitest run test/scripts/check-squad-leakage.test.ts test/scripts/repo-health-comment-transport.test.ts— 49 tests passednpx --no-install eslint scripts/check-squad-leakage.mjs scripts/git-path-decoder.mjs scripts/repo-health-comment.mjs test/scripts/check-squad-leakage.test.ts test/scripts/repo-health-comment-transport.test.ts— passedactionlint .github/workflows/squad-repo-health.yml .github/workflows/squad-repo-health-shadow.yml— passedscripts/check-squad-leakage.mjs— clean JSON and fail-closed behavior verifiedCI=true npm run build— passed for SDK and CLIcore.quotePath=trueandfalsegithub-scriptbody and reporter fake-Octokit contractSecurity review
Focused final-diff security review initially found cross-job marker injection through substring comment ownership. The revision now requires the managed marker as the exact first line and includes a regression test. Focused rereview verdict: APPROVE — no security vulnerabilities found.
No dependencies were added. The existing
pull_request_targetworkflow never checks out or executes PR-head code.Post-merge authoritative canary
After this reaches
dev, follow.github/REPO_HEALTH_RUNBOOK.mdto:.squad/canary-paired-${-apostrophe-'-"double quote".mdRepo Healthrun URLs on Runbook gotcha: any fix to squad-repo-health.yml is unverifiable in CI until it merges #1800, then close/delete the canary branch without merging