Skip to content

test coderabbit #362

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
suzuki-shunsuke wants to merge 1 commit into
base: main
Choose a base branch
from
Open

test coderabbit #362

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 2 additions & 10 deletions .github/workflows/test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,20 +1,12 @@
---
name: test
on:
pull_request:
types: [closed]
pull_request_review:
types: [submitted]
on: pull_request
jobs:
test:
if: |
endsWith(github.event.pull_request.user.login, '[bot]') &&
((github.event_name == 'pull_request_review' && github.event.review.state == 'approved') ||
github.event_name == 'pull_request')
runs-on: ubuntu-24.04
timeout-minutes: 15
permissions:
pull-requests: write
contents: read
steps:
- uses: suzuki-shunsuke/notify-bot-pr-event-action@pr/1
- run: echo "${{github.event.pull_request}}"
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Feb 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Use toJson() and avoid direct expression interpolation in shell commands.

Two issues:

  1. github.event.pull_request is an object—without toJson(), this won't output meaningful JSON.
  2. Direct ${{ }} interpolation in run: commands with double quotes is vulnerable to script injection if the payload contains shell metacharacters.
🔒 Proposed fix using environment variable 
     steps:
-      - run: echo "${{github.event.pull_request}}"
+      - run: echo "$PR_PAYLOAD"
+        env:
+          PR_PAYLOAD: ${{ toJson(github.event.pull_request) }}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- run: echo "${{github.event.pull_request}}"
- run: echo "$PR_PAYLOAD"
env:
PR_PAYLOAD: ${{ toJson(github.event.pull_request) }}
🤖 Prompt for AI Agents 
In @.github/workflows/test.yaml at line 12, The current run step echoes
github.event.pull_request directly which both loses structure and risks shell
injection; change the workflow to convert the PR object to JSON using toJson
(use toJson(github.event.pull_request)) and pass it via an environment variable
instead of direct ${{ }} interpolation, then update the run command (the echo
invocation) to read that env var (e.g., echo "$PR_PAYLOAD") so the payload is
preserved and not injected into the shell.