From 33dd1c880e18b5bf5482f26671e7da780c1fb4d8 Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Thu, 30 Jul 2026 09:39:04 +0200 Subject: [PATCH 1/2] fix: tighten check_suite error matching in safe-settings workaround Narrow the error guard from a broad 'check_suite' substring match to the exact upstream error message: "Cannot read properties of undefined (reading 'check_suite')". This prevents accidentally swallowing an unrelated error whose message happens to contain that substring. Addresses review feedback from @gxmiranda on PR #186. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt --- .github/workflows/safe_settings_sync.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/safe_settings_sync.yml b/.github/workflows/safe_settings_sync.yml index c0c41a0..4cb774c 100644 --- a/.github/workflows/safe_settings_sync.yml +++ b/.github/workflows/safe_settings_sync.yml @@ -166,7 +166,7 @@ jobs: // exist outside the webhook flow. The sync completes // and results are logged; only the Check Run reporting // fails. Safe to skip. - if (String(error).includes('check_suite')) { + if (String(error).includes("Cannot read properties of undefined (reading 'check_suite')")) { probot.log.info( 'check_suite reporting skipped (expected in full-sync mode). ' + 'See: github-community-projects/safe-settings#818' From 5702230e363c14550715bb549b28a48f6ef760cd Mon Sep 17 00:00:00 2001 From: Marcus Burghardt Date: Thu, 30 Jul 2026 09:40:26 +0200 Subject: [PATCH 2/2] fix: validate usernames before building grep pattern in drift workflow Add input validation for ENTERPRISE_MEMBERS_IGNORE values before they are used to build a grep -vE pattern. GitHub usernames only allow [a-zA-Z0-9-], so the values are safe for regex without escaping, but this guard fails fast if an invalid value is ever added -- preventing unexpected regex behavior. Addresses review feedback from @gxmiranda on PR #182. Assisted-by: OpenCode (claude-opus-4-6) Signed-off-by: Marcus Burghardt --- .github/workflows/peribolos-drift.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/.github/workflows/peribolos-drift.yml b/.github/workflows/peribolos-drift.yml index 710b4bf..d2413a5 100644 --- a/.github/workflows/peribolos-drift.yml +++ b/.github/workflows/peribolos-drift.yml @@ -106,6 +106,18 @@ jobs: # Filter expected enterprise-member drift FILTERED_COUNT=0 if [ -n "$ENTERPRISE_MEMBERS_IGNORE" ]; then + # Validate usernames before building grep pattern. + # GitHub usernames allow only [a-zA-Z0-9-], so the values + # are safe for grep -vE without regex escaping. This guard + # fails fast if an invalid value is ever added. + for user in $(echo "$ENTERPRISE_MEMBERS_IGNORE" | tr ',' '\n'); do + user=$(echo "$user" | xargs) + [ -z "$user" ] && continue + if ! [[ "$user" =~ ^[a-zA-Z0-9-]+$ ]]; then + echo "::error::Invalid username in ENTERPRISE_MEMBERS_IGNORE: '$user'" + exit 1 + fi + done IGNORE_PATTERN=$(echo "$ENTERPRISE_MEMBERS_IGNORE" | tr ', ' '\n' \ | sed '/^$/d' | paste -sd'|' -) BEFORE=$(wc -l < /tmp/drift-mutations.txt)