Reject malformed issue reference suffixes

[TUPM96]

/claim #228

Bounty: #228

Summary

• Require shorthand, repo-qualified, and full GitHub issue references to stop at a valid issue-number boundary.
• Add regression coverage for malformed suffixes like #3abc and https://github.com/ramimbo/mergework/issues/3abc.

Repro before fix

An accepted PR label payload with a PR body such as Closes #3abc or https://github.com/ramimbo/mergework/issues/3abc could be parsed as issue #3, which could pay the wrong bounty issue.

Validation

• uv run --python 3.12 --extra dev python -m pytest tests/test_webhooks.py -q
• uv run --python 3.12 --extra dev python -m pytest -q
• uv run --python 3.12 --extra dev ruff check app/webhooks/github.py tests/test_webhooks.py
• uv run --python 3.12 --extra dev ruff format --check app/webhooks/github.py tests/test_webhooks.py

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Tightens GitHub PR-body parsing so malformed issue references (e.g., #3abc or /issues/3abc) no longer link to a bounty, and adds regression tests to ensure such cases return missing_issue.

Changes:

• Add a webhook test covering malformed shorthand and URL issue reference suffixes.
• Update issue-reference regexes to require a non-word-ish terminator after the numeric issue id.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
tests/test_webhooks.py	Adds a regression test ensuring malformed issue references do not trigger bounty payouts and are recorded as missing_issue.
app/webhooks/github.py	Tightens regex matching for linked issues / issue URLs to reject trailing alphanumeric/_/- suffixes after the issue number.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[TUPM96]

Addressed the automated review notes in the latest commit:

• Factored the issue-number terminator into ISSUE_NUMBER_BOUNDARY.
• Added _ and - malformed suffix regression cases for shorthand and full URL references.

CI is passing again on the updated head.

[Lucas-FManager]

Review for bounty #219: no blockers from my pass on PR #240.

Evidence checked:

• Inspected app/webhooks/github.py and tests/test_webhooks.py on the PR diff.
• Confirmed the new boundary guard applies to shorthand #3, repo-qualified owner/repo#3, and full GitHub issue URLs without changing normal linked-issue parsing.
• Confirmed the regression covers alpha, underscore, and hyphen suffixes for shorthand and URL references, and verifies no contributor balance is paid plus each delivery records missing_issue.
• Ran uv run --python 3.12 --extra dev python -m pytest tests/test_webhooks.py::test_accepted_pr_label_rejects_malformed_issue_reference_suffixes -q -> 1 passed.
• Ran uv run --python 3.12 --extra dev ruff check app/webhooks/github.py tests/test_webhooks.py -> passed.
• Ran uv run --python 3.12 --extra dev ruff format --check app/webhooks/github.py tests/test_webhooks.py -> 2 files already formatted.
• Ran git diff --check origin/main...HEAD -> clean.
• Hosted CI Quality, readiness, docs, and image checks is green.

No secrets, wallet material, payout details, private deployment values, private vulnerability details, or MRWK price claims were reviewed or disclosed.

[ayskobtw-lil]

No blockers from my review.

Evidence checked:

• Inspected app/webhooks/github.py; the new ISSUE_NUMBER_BOUNDARY is applied to shorthand #<number>, repo-qualified <owner>/<repo>#<number>, and full GitHub issue URLs, preventing suffixes like letters, _, or - from being truncated into a valid bounty issue number.
• Traced _linked_issue_numbers() and confirmed cross-repo filtering and duplicate suppression are unchanged after the regex boundary update.
• Reviewed tests/test_webhooks.py; the new regression covers malformed shorthand and full URL suffixes for abc, _abc, and -abc, while existing tests still cover accepted valid shorthand, repo-qualified, and full GitHub issue URL references.

Validation run on current head 8cf0848:

• python -m pytest tests/test_webhooks.py::test_accepted_pr_label_rejects_malformed_issue_reference_suffixes tests/test_webhooks.py::test_accepted_pr_label_pays_pr_author_for_linked_bounty_issue tests/test_webhooks.py::test_accepted_pr_label_pays_repo_qualified_multi_award_issue tests/test_webhooks.py::test_accepted_pr_label_pays_full_github_issue_url_reference -q -> 4 passed
• python -m ruff check app/webhooks/github.py tests/test_webhooks.py -> All checks passed!
• git diff --check origin/main...HEAD -> clean