Skip to content

Neutralize GitHub Actions workflow commands in user-generated log output #15150

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Copilot wants to merge 9 commits into from
Closed

Neutralize GitHub Actions workflow commands in user-generated log output #15150

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
8c2d3b0
Initial plan
Copilot Feb 12, 2026
5111431
Add sanitized logging helpers and update critical files
Copilot Feb 12, 2026
a60d7cc
Batch update all .cjs files to use sanitized logging
Copilot Feb 12, 2026
b1e7195
Fix duplicate import in update_activation_comment.cjs
Copilot Feb 12, 2026
25bdf50
Fix: Only neutralize :: at line start (GitHub Actions requirement)
Copilot Feb 12, 2026
6afdc32
Remove redundant second replace in neutralizeWorkflowCommands
Copilot Feb 12, 2026
1b70c66
Fix additional core.info calls with user-generated content
Copilot Feb 12, 2026
05bf6fd
Fix workflow command injection in display_file_helpers.cjs
Copilot Feb 12, 2026
6c0186e
Merge branch 'main' into copilot/sanitize-github-action-logs
pelikhan Feb 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions actions/setup/js/add_comment.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
/**
* @typedef {import('./types/handler-factory').HandlerFactoryFunction} HandlerFactoryFunction
*/
const { safeInfo, safeDebug, safeWarning, safeError } = require("./sanitized_logging.cjs");

const { generateFooterWithMessages } = require("./messages_footer.cjs");
const { getRepositoryUrl } = require("./get_repository_url.cjs");
Expand Down Expand Up @@ -355,7 +356,7 @@ async function main(config = {}) {
itemNumber = typeof item.item_number === "number" ? item.item_number : parseInt(String(item.item_number), 10);

if (isNaN(itemNumber) || itemNumber <= 0) {
core.warning(`Invalid item_number specified: ${item.item_number}`);
safeWarning(`Invalid item_number specified: ${item.item_number}`);
return {
success: false,
error: `Invalid item_number specified: ${item.item_number}`,
Expand Down Expand Up @@ -401,7 +402,7 @@ async function main(config = {}) {
}

itemNumber = targetResult.number;
core.info(`Resolved target ${targetResult.contextType} #${itemNumber} (target config: ${commentTarget})`);
safeInfo(`Resolved target ${targetResult.contextType} #${itemNumber} (target config: ${commentTarget})`);
}
}

Expand Down Expand Up @@ -564,7 +565,7 @@ async function main(config = {}) {

if (isDiscussion404) {
// Neither issue/PR nor discussion found - truly doesn't exist
core.warning(`Target #${itemNumber} was not found as issue, PR, or discussion (may have been deleted): ${discussionErrorMessage}`);
safeWarning(`Target #${itemNumber} was not found as issue, PR, or discussion (may have been deleted): ${discussionErrorMessage}`);
return {
success: true,
warning: `Target not found: ${discussionErrorMessage}`,
Expand All @@ -573,7 +574,7 @@ async function main(config = {}) {
}

// Other error when trying as discussion
core.error(`Failed to add comment to discussion: ${discussionErrorMessage}`);
safeError(`Failed to add comment to discussion: ${discussionErrorMessage}`);
return {
success: false,
error: discussionErrorMessage,
Expand All @@ -583,7 +584,7 @@ async function main(config = {}) {

if (is404) {
// Treat 404s as warnings - the target was deleted between execution and safe output processing
core.warning(`Target was not found (may have been deleted): ${errorMessage}`);
safeWarning(`Target was not found (may have been deleted): ${errorMessage}`);
return {
success: true,
warning: `Target not found: ${errorMessage}`,
Expand All @@ -592,7 +593,7 @@ async function main(config = {}) {
}

// For non-404 errors, fail as before
core.error(`Failed to add comment: ${errorMessage}`);
safeError(`Failed to add comment: ${errorMessage}`);
return {
success: false,
error: errorMessage,
Expand Down
3 changes: 2 additions & 1 deletion actions/setup/js/add_copilot_reviewer.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ const { getErrorMessage } = require("./error_helpers.cjs");
* Environment variables:
* - PR_NUMBER: The pull request number to add the reviewer to
*/
const { safeInfo, safeDebug, safeWarning, safeError } = require("./sanitized_logging.cjs");

// GitHub Copilot reviewer bot username
const COPILOT_REVIEWER_BOT = "copilot-pull-request-reviewer[bot]";
Expand Down Expand Up @@ -54,7 +55,7 @@ Successfully added Copilot as a reviewer to PR #${prNumber}.`
.write();
} catch (error) {
const errorMessage = getErrorMessage(error);
core.error(`Failed to add Copilot as reviewer: ${errorMessage}`);
safeError(`Failed to add Copilot as reviewer: ${errorMessage}`);
core.setFailed(`Failed to add Copilot as reviewer to PR #${prNumber}: ${errorMessage}`);
}
}
Expand Down
13 changes: 7 additions & 6 deletions actions/setup/js/add_labels.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
/**
* @typedef {import('./types/handler-factory').HandlerFactoryFunction} HandlerFactoryFunction
*/
const { safeInfo, safeDebug, safeWarning, safeError } = require("./sanitized_logging.cjs");

/** @type {string} Safe output type handled by this module */
const HANDLER_TYPE = "add_labels";
Expand All @@ -25,7 +26,7 @@ async function main(config = {}) {

core.info(`Add labels configuration: max=${maxCount}`);
if (allowedLabels.length > 0) {
core.info(`Allowed labels: ${allowedLabels.join(", ")}`);
safeInfo(`Allowed labels: ${allowedLabels.join(", ")}`);
}
core.info(`Default target repo: ${defaultTargetRepo}`);
if (allowedRepos.size > 0) {
Expand Down Expand Up @@ -76,7 +77,7 @@ async function main(config = {}) {

const contextType = context.payload?.pull_request ? "pull request" : "issue";
const requestedLabels = message.labels ?? [];
core.info(`Requested labels: ${JSON.stringify(requestedLabels)}`);
safeInfo(`Requested labels: ${JSON.stringify(requestedLabels)}`);

// If no labels provided, return a helpful message with allowed labels if configured
if (requestedLabels.length === 0) {
Expand All @@ -100,7 +101,7 @@ async function main(config = {}) {
};
}
// For other validation errors, return error
core.warning(`Label validation failed: ${labelsResult.error}`);
safeWarning(`Label validation failed: ${labelsResult.error}`);
return {
success: false,
error: labelsResult.error ?? "Invalid labels",
Expand All @@ -120,7 +121,7 @@ async function main(config = {}) {
};
}

core.info(`Adding ${uniqueLabels.length} labels to ${contextType} #${itemNumber} in ${itemRepo}: ${JSON.stringify(uniqueLabels)}`);
safeInfo(`Adding ${uniqueLabels.length} labels to ${contextType} #${itemNumber} in ${itemRepo}: ${JSON.stringify(uniqueLabels)}`);

try {
await github.rest.issues.addLabels({
Expand All @@ -130,7 +131,7 @@ async function main(config = {}) {
labels: uniqueLabels,
});

core.info(`Successfully added ${uniqueLabels.length} labels to ${contextType} #${itemNumber} in ${itemRepo}`);
safeInfo(`Successfully added ${uniqueLabels.length} labels to ${contextType} #${itemNumber} in ${itemRepo}`);
return {
success: true,
number: itemNumber,
Expand All @@ -139,7 +140,7 @@ async function main(config = {}) {
};
} catch (error) {
const errorMessage = getErrorMessage(error);
core.error(`Failed to add labels: ${errorMessage}`);
safeError(`Failed to add labels: ${errorMessage}`);
return { success: false, error: errorMessage };
}
};
Expand Down
3 changes: 2 additions & 1 deletion actions/setup/js/add_reaction.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ const { getErrorMessage } = require("./error_helpers.cjs");
* This script only adds reactions - it does NOT create comments.
* Use add_reaction_and_edit_comment.cjs in the activation job to create the comment with workflow link.
*/
const { safeInfo, safeDebug, safeWarning, safeError } = require("./sanitized_logging.cjs");
async function main() {
// Read inputs from environment variables
const reaction = process.env.GH_AW_REACTION || "eyes";
Expand Down Expand Up @@ -97,7 +98,7 @@ async function main() {
await addReaction(reactionEndpoint, reaction);
} catch (error) {
const errorMessage = getErrorMessage(error);
core.error(`Failed to add reaction: ${errorMessage}`);
safeError(`Failed to add reaction: ${errorMessage}`);
core.setFailed(`Failed to add reaction: ${errorMessage}`);
}
}
Expand Down
13 changes: 7 additions & 6 deletions actions/setup/js/add_reaction_and_edit_comment.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ const { getRunStartedMessage } = require("./messages_run_status.cjs");
const { getErrorMessage } = require("./error_helpers.cjs");
const { generateWorkflowIdMarker } = require("./generate_footer.cjs");

const { safeInfo, safeDebug, safeWarning, safeError } = require("./sanitized_logging.cjs");
async function main() {
// Read inputs from environment variables
const reaction = process.env.GH_AW_REACTION || "eyes";
Expand All @@ -14,7 +15,7 @@ async function main() {
const runUrl = context.payload.repository ? `${context.payload.repository.html_url}/actions/runs/${runId}` : `${githubServer}/${context.repo.owner}/${context.repo.repo}/actions/runs/${runId}`;

core.info(`Reaction type: ${reaction}`);
core.info(`Command name: ${command || "none"}`);
safeInfo(`Command name: ${command || "none"}`);
core.info(`Run ID: ${runId}`);
core.info(`Run URL: ${runUrl}`);

Expand Down Expand Up @@ -150,11 +151,11 @@ async function main() {
core.info(`Comment endpoint: ${commentUpdateEndpoint}`);
await addCommentWithWorkflowLink(commentUpdateEndpoint, runUrl, eventName);
} else {
core.info(`Skipping comment for event type: ${eventName}`);
safeInfo(`Skipping comment for event type: ${eventName}`);
}
} catch (error) {
const errorMessage = getErrorMessage(error);
core.error(`Failed to process reaction and comment creation: ${errorMessage}`);
safeError(`Failed to process reaction and comment creation: ${errorMessage}`);
core.setFailed(`Failed to process reaction and comment creation: ${errorMessage}`);
}
}
Expand Down Expand Up @@ -391,7 +392,7 @@ async function addCommentWithWorkflowLink(endpoint, runUrl, eventName) {
core.info(`Successfully created discussion comment with workflow link`);
core.info(`Comment ID: ${comment.id}`);
core.info(`Comment URL: ${comment.url}`);
core.info(`Comment Repo: ${context.repo.owner}/${context.repo.repo}`);
safeInfo(`Comment Repo: ${context.repo.owner}/${context.repo.repo}`);
core.setOutput("comment-id", comment.id);
core.setOutput("comment-url", comment.url);
core.setOutput("comment-repo", `${context.repo.owner}/${context.repo.repo}`);
Expand Down Expand Up @@ -435,7 +436,7 @@ async function addCommentWithWorkflowLink(endpoint, runUrl, eventName) {
core.info(`Successfully created discussion comment with workflow link`);
core.info(`Comment ID: ${comment.id}`);
core.info(`Comment URL: ${comment.url}`);
core.info(`Comment Repo: ${context.repo.owner}/${context.repo.repo}`);
safeInfo(`Comment Repo: ${context.repo.owner}/${context.repo.repo}`);
core.setOutput("comment-id", comment.id);
core.setOutput("comment-url", comment.url);
core.setOutput("comment-repo", `${context.repo.owner}/${context.repo.repo}`);
Expand All @@ -453,7 +454,7 @@ async function addCommentWithWorkflowLink(endpoint, runUrl, eventName) {
core.info(`Successfully created comment with workflow link`);
core.info(`Comment ID: ${createResponse.data.id}`);
core.info(`Comment URL: ${createResponse.data.html_url}`);
core.info(`Comment Repo: ${context.repo.owner}/${context.repo.repo}`);
safeInfo(`Comment Repo: ${context.repo.owner}/${context.repo.repo}`);
core.setOutput("comment-id", createResponse.data.id.toString());
core.setOutput("comment-url", createResponse.data.html_url);
core.setOutput("comment-repo", `${context.repo.owner}/${context.repo.repo}`);
Expand Down
3 changes: 2 additions & 1 deletion actions/setup/js/add_reviewer.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
/**
* @typedef {import('./types/handler-factory').HandlerFactoryFunction} HandlerFactoryFunction
*/
const { safeInfo, safeDebug, safeWarning, safeError } = require("./sanitized_logging.cjs");

const { processItems } = require("./safe_output_processor.cjs");
const { getErrorMessage } = require("./error_helpers.cjs");
Expand Down Expand Up @@ -134,7 +135,7 @@ async function main(config = {}) {
};
} catch (error) {
const errorMessage = getErrorMessage(error);
core.error(`Failed to add reviewers: ${errorMessage}`);
safeError(`Failed to add reviewers: ${errorMessage}`);
return {
success: false,
error: errorMessage,
Expand Down
11 changes: 6 additions & 5 deletions actions/setup/js/add_workflow_run_comment.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ const { generateWorkflowIdMarker } = require("./generate_footer.cjs");
* This script ONLY creates comments - it does NOT add reactions.
* Use add_reaction.cjs in the pre-activation job to add reactions first for immediate feedback.
*/
const { safeInfo, safeDebug, safeWarning, safeError } = require("./sanitized_logging.cjs");
async function main() {
const runId = context.runId;
const githubServer = process.env.GITHUB_SERVER_URL || "https://github.com";
Expand Down Expand Up @@ -92,9 +93,9 @@ async function main() {
await addCommentWithWorkflowLink(commentEndpoint, runUrl, eventName);
} catch (error) {
const errorMessage = getErrorMessage(error);
core.error(`Failed to create comment: ${errorMessage}`);
safeError(`Failed to create comment: ${errorMessage}`);
// Don't fail the job - just warn since this is not critical
core.warning(`Failed to create comment with workflow link: ${errorMessage}`);
safeWarning(`Failed to create comment with workflow link: ${errorMessage}`);
}
}

Expand Down Expand Up @@ -203,7 +204,7 @@ async function addCommentWithWorkflowLink(endpoint, runUrl, eventName) {
core.info(`Successfully created discussion comment with workflow link`);
core.info(`Comment ID: ${comment.id}`);
core.info(`Comment URL: ${comment.url}`);
core.info(`Comment Repo: ${context.repo.owner}/${context.repo.repo}`);
safeInfo(`Comment Repo: ${context.repo.owner}/${context.repo.repo}`);
core.setOutput("comment-id", comment.id);
core.setOutput("comment-url", comment.url);
core.setOutput("comment-repo", `${context.repo.owner}/${context.repo.repo}`);
Expand Down Expand Up @@ -247,7 +248,7 @@ async function addCommentWithWorkflowLink(endpoint, runUrl, eventName) {
core.info(`Successfully created discussion comment with workflow link`);
core.info(`Comment ID: ${comment.id}`);
core.info(`Comment URL: ${comment.url}`);
core.info(`Comment Repo: ${context.repo.owner}/${context.repo.repo}`);
safeInfo(`Comment Repo: ${context.repo.owner}/${context.repo.repo}`);
core.setOutput("comment-id", comment.id);
core.setOutput("comment-url", comment.url);
core.setOutput("comment-repo", `${context.repo.owner}/${context.repo.repo}`);
Expand All @@ -265,7 +266,7 @@ async function addCommentWithWorkflowLink(endpoint, runUrl, eventName) {
core.info(`Successfully created comment with workflow link`);
core.info(`Comment ID: ${createResponse.data.id}`);
core.info(`Comment URL: ${createResponse.data.html_url}`);
core.info(`Comment Repo: ${context.repo.owner}/${context.repo.repo}`);
safeInfo(`Comment Repo: ${context.repo.owner}/${context.repo.repo}`);
core.setOutput("comment-id", createResponse.data.id.toString());
core.setOutput("comment-url", createResponse.data.html_url);
core.setOutput("comment-repo", `${context.repo.owner}/${context.repo.repo}`);
Expand Down
Loading
Loading