Skip to content

Commit a6d5207

Browse files
mnriemCopilot
mnriem
and
Copilot
committed
fix(workflows): drop sanitized-snapshot input, keep fail-closed detection
The regenerated sanitized snapshot (steps.sanitized.outputs.text) redacts any HTTPS host absent from the workflow's allowed-domains list. These submission workflows record off-allowlist URLs verbatim (extension homepage/documentation/ changelog, bundle required component catalogs, and the proposed catalog-entry JSON), so a snapshot input would corrupt otherwise-valid submissions. Revert Step 1 to reading the triggering issue and keep the separate maintainer PR review as the control for issue edits. The fail-closed threat-detection change (continue-on-error: false) and its regression test are retained. Recompiled the three lock files; action pins and the pin database are unchanged from the base. Assisted-by: GitHub Copilot (model: Claude Opus 4.8, autonomous) Co-authored-by: Copilot App <[email protected]>
1 parent 677009b commit a6d5207

6 files changed

Lines changed: 13 additions & 54 deletions

‎.github/workflows/add-community-bundle.lock.yml‎

Lines changed: 2 additions & 6 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.github/workflows/add-community-bundle.md‎

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -68,18 +68,7 @@ with `[Bundle]:`. If it does not, stop without commenting.
6868

6969
## Step 1 - Read and Parse the Issue
7070

71-
The sanitized snapshot of the triggering issue (title and body, captured from
72-
the event that started this run) is provided below. Treat this snapshot as the
73-
authoritative submission input and parse the issue-form fields from it. Do not
74-
re-fetch the live issue body with the GitHub tools — the issue may change after
75-
the maintainer applies the label, and validating anything other than this
76-
snapshot makes the result impossible to tie back to the triggering submission.
77-
78-
<issue-snapshot>
79-
${{ steps.sanitized.outputs.text }}
80-
</issue-snapshot>
81-
82-
Extract these issue-form fields from the snapshot above:
71+
Read issue #${{ github.event.issue.number }} and extract these issue-form fields:
8372

8473
| Field | Issue Form ID | Required |
8574
|-------|---------------|----------|

‎.github/workflows/add-community-extension.lock.yml‎

Lines changed: 2 additions & 6 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.github/workflows/add-community-extension.md‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -64,18 +64,9 @@ If it does not, stop without commenting.
6464

6565
## Step 1 — Read and Parse the Issue
6666

67-
The sanitized snapshot of the triggering issue (title and body, captured from
68-
the event that started this run) is provided below. Treat this snapshot as the
69-
authoritative submission input. Do not re-fetch the live issue body with the
70-
GitHub tools — the issue may change after the maintainer applies the label, and
71-
validating anything other than this snapshot makes the result impossible to tie
72-
back to the triggering submission.
73-
74-
<issue-snapshot>
75-
${{ steps.sanitized.outputs.text }}
76-
</issue-snapshot>
77-
78-
Extract the following fields from the snapshot above (GitHub issue form
67+
Read issue #${{ github.event.issue.number }}.
68+
69+
Extract the following fields from the structured issue body (GitHub issue form
7970
fields):
8071

8172
| Field | Issue Form ID | Required |

‎.github/workflows/add-community-preset.lock.yml‎

Lines changed: 2 additions & 6 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎.github/workflows/add-community-preset.md‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -64,18 +64,9 @@ If it does not, stop without commenting.
6464

6565
## Step 1 — Read and Parse the Issue
6666

67-
The sanitized snapshot of the triggering issue (title and body, captured from
68-
the event that started this run) is provided below. Treat this snapshot as the
69-
authoritative submission input. Do not re-fetch the live issue body with the
70-
GitHub tools — the issue may change after the maintainer applies the label, and
71-
validating anything other than this snapshot makes the result impossible to tie
72-
back to the triggering submission.
73-
74-
<issue-snapshot>
75-
${{ steps.sanitized.outputs.text }}
76-
</issue-snapshot>
77-
78-
Extract the following fields from the snapshot above (GitHub issue form
67+
Read issue #${{ github.event.issue.number }}.
68+
69+
Extract the following fields from the structured issue body (GitHub issue form
7970
fields):
8071

8172
| Field | Issue Form ID | Required |

0 commit comments

Comments
 (0)