From 0947fcbf93ea49caeda804fbe0d08cf99cea6756 Mon Sep 17 00:00:00 2001 From: Zac Farrell Date: Tue, 4 Aug 2026 19:18:03 -0700 Subject: [PATCH] fix(review): remove expression syntax from a run-block comment --- .github/workflows/claude-pr-review.yml | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml index e4a6be4..29668d2 100644 --- a/.github/workflows/claude-pr-review.yml +++ b/.github/workflows/claude-pr-review.yml @@ -257,8 +257,16 @@ jobs: echo "${DELIMITER}" } >> $GITHUB_OUTPUT - # Title and body reach the shell through env, never a ${{ }} interpolation: both - # are attacker-controlled text and would otherwise be spliced into this script. + # Title and body reach the shell through env, never an Actions expression + # interpolation: both are attacker-controlled text and would otherwise be spliced + # into this script. + # + # That expression syntax cannot be written out inside this run block, not even in a + # comment. Actions parses those delimiters in the block's *string value*, comments + # included, and an empty pair is a syntax error that makes the whole workflow + # unparseable -- no jobs, no required check, every PR in the org blocked behind + # "Please close and reopen the PR to trigger this workflow". A YAML comment outside + # a block scalar is safe, because the YAML parser strips it before Actions looks. # First in the file on purpose: the byte cap keeps the head, so anything the # reviewer must not miss has to be above the blocks that can grow. if [ -s "$WARN_FILE" ]; then