Skip to content

Commit 0947fcb

Browse files
committed
fix(review): remove expression syntax from a run-block comment
1 parent 036744e commit 0947fcb

1 file changed

Lines changed: 10 additions & 2 deletions

File tree

.github/workflows/claude-pr-review.yml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -257,8 +257,16 @@ jobs:
257257
echo "${DELIMITER}"
258258
} >> $GITHUB_OUTPUT
259259
260-
# Title and body reach the shell through env, never a ${{ }} interpolation: both
261-
# are attacker-controlled text and would otherwise be spliced into this script.
260+
# Title and body reach the shell through env, never an Actions expression
261+
# interpolation: both are attacker-controlled text and would otherwise be spliced
262+
# into this script.
263+
#
264+
# That expression syntax cannot be written out inside this run block, not even in a
265+
# comment. Actions parses those delimiters in the block's *string value*, comments
266+
# included, and an empty pair is a syntax error that makes the whole workflow
267+
# unparseable -- no jobs, no required check, every PR in the org blocked behind
268+
# "Please close and reopen the PR to trigger this workflow". A YAML comment outside
269+
# a block scalar is safe, because the YAML parser strips it before Actions looks.
262270
# First in the file on purpose: the byte cap keeps the head, so anything the
263271
# reviewer must not miss has to be above the blocks that can grow.
264272
if [ -s "$WARN_FILE" ]; then

0 commit comments

Comments
 (0)