Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions .github/workflows/claude-pr-review.yml
Original file line number Diff line number Diff line change
Expand Up @@ -257,8 +257,16 @@ jobs:
echo "${DELIMITER}"
} >> $GITHUB_OUTPUT

# Title and body reach the shell through env, never a ${{ }} interpolation: both
# are attacker-controlled text and would otherwise be spliced into this script.
# Title and body reach the shell through env, never an Actions expression
# interpolation: both are attacker-controlled text and would otherwise be spliced
# into this script.
#
# That expression syntax cannot be written out inside this run block, not even in a
# comment. Actions parses those delimiters in the block's *string value*, comments
# included, and an empty pair is a syntax error that makes the whole workflow
# unparseable -- no jobs, no required check, every PR in the org blocked behind
# "Please close and reopen the PR to trigger this workflow". A YAML comment outside
# a block scalar is safe, because the YAML parser strips it before Actions looks.
# First in the file on purpose: the byte cap keeps the head, so anything the
# reviewer must not miss has to be above the blocks that can grow.
if [ -s "$WARN_FILE" ]; then
Expand Down