Repository navigation
Session Handoff [auto-1874]: Stop the Doc Gates' Printed Names Forging Workflow Commands, for #1874 #3114
Description
Next steps, in priority order
- Fix Doc Gates Print Tracked Names Raw, So a Name Starting With :: Forges a Workflow Command #1874: stop a tracked file name that opens on
::from printing as a workflow command. The runner trims a stdout line before checking it for the command key, so the indent in front of each finding does not protect it, and a fork pull request controls the file name.printable()in.github/actions/repo-gate/repo_gate.pyescapes control characters and leaves a leading::alone. The issue hands the choice between neutralizing a leading::in each printed line that carries a path and wrapping the findings in a::stop-commands::block with a random token to whoever takes it, so the worker makes that call and states the reason in the pull request. Check.github/actions/prose-gate/prose_lint.pytoo, which the issue says likely prints paths the same way and was not checked, and cover every gate printing a tracked name. Done looks like: a test feeds a constructed name shaped like::error title=forged::xthrough each affected gate's output path and asserts the printed line cannot begin a workflow command after leading whitespace is trimmed, the test fails with the fix reverted, and a pull request carryingCloses on promotion: #1874has merged todevelop.
External blockers
None known.
Internal dependencies
None.
State
No branch, worktree, or pull request exists for this lane yet. Re-derive from git worktree list and the open pull requests before starting.
The parked decision queue
Zero parked decisions on this lane.
What the last round did
The unattended picker opened this lane from the backlog.
What not to repeat
Nothing yet.
New learnings
None yet.
Activity
ptr727 commentedon Oct 16, 2026
Lane closed out
Merged: #3116 was squash-merged into
developas5d369fd15aa705da8ef38ed1d67ac891c778016f. Its body carriesCloses on promotion: #1874, so #1874 stays open until a develop -> main promotion carries the fix. This run's scope wasdevelop, so the run opened no promotion.What it fixed (#1874): both doc gates now escape output a fork can control before the Actions runner reads it as a workflow command. That covers a line opening on
::after whitespace is trimmed, and the legacy##[anywhere in a line, which the issue did not name.repo_gate.py'sprintable()gained the escape.prose_lint.pygained the sameprintable(), control escaping included, at every print carrying a path or file text. The prose gate's composite action also escaped its echo of.github/prose-gate-excludes, covering##[and an interior carriage return. The issue offered a choice between neutralizing the lines and a::stop-commands::block. This lane neutralized the lines, and the pull request body gives the reasons.Review: the local strict review ran three rounds, and the third raised no findings. Copilot raised one finding, to escape the
Scanningecho of thepathsinput. It was declined under "Trust Boundaries and Hardening Effort", because the calling workflow writes that input and the fleet's caller never sets it. The thread is resolved. CodeRabbit, asked once, reported no actionable comments.Filed along the way: #3115 moves the release-guard tests' inline workflow-command check onto the new
tests/runner_commands.py.The worktree, the local branch, and the remote branch are all removed, and the base clone is back on
develop.