feat: add OUTPUT_FILENAME to customize markdown output

[vchrombie]

Fixes #18

Expose OUTPUT_FILENAME env var with default contributors.md, wire into markdown output, and document/test it.

Pull Request

Proposed Changes

Readiness Checklist

Author/Contributor

• If documentation is needed for this change, has that been included in this pull request
• run make lint and fix any issues that you have introduced
• run make test and ensure you have test coverage for the lines you are introducing
• If publishing new data to the public (scorecards, security scan results, code quality results, live dashboards, etc.), please request review from @jeffrey-luszcz

Reviewer

• Label as either bug, documentation, enhancement, infrastructure, maintenance or breaking

[Copilot]

Pull request overview

Adds support for customizing the generated markdown report filename via a new OUTPUT_FILENAME environment variable (defaulting to contributors.md).

Changes:

• Added OUTPUT_FILENAME parsing (with default) to env.get_env_vars().
• Wired the configured output filename into contributors.py when writing the markdown report.
• Updated tests and README to cover/document the new environment variable.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
env.py	Adds OUTPUT_FILENAME env var handling and returns it from get_env_vars().
contributors.py	Uses the returned output_filename when calling markdown.write_to_markdown().
test_env.py	Extends env parsing tests to assert default and custom OUTPUT_FILENAME behavior.
README.md	Documents OUTPUT_FILENAME and updates job summary wording to be filename-agnostic.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[zkoppert]

@vchrombie this looks great. I've got one documentation suggestion to help folks understand the default exists. Thanks for your PR!!

[vchrombie]

Thanks @zkoppert for the suggestion.

[vchrombie]

I rebased the branch with the latest changes

@zkoppert, could you please approve it to kick the ci checks?

[vchrombie]

I can rebase the latest changes

[vchrombie]

I rebased this too, let's take one pr at a time. I can rebase the other ones as needed.
@zkoppert

[zkoppert]

Pushed a fix for the CI failure and an additional test robustness improvement:

1. test_get_env_vars_valid_date_range (CI failure) — added the missing _output_filename to the tuple unpacking to match the new 13th return value from get_env_vars().
2. test_get_env_vars_missing_org_or_repo (pre-existing) — added clear=True to @patch.dict and test=True to get_env_vars() so that a local .env file doesn't leak REPOSITORY into the test and suppress the expected ValueError.

Will watch CI for any further failures to help get this moving through. 👀

[zkoppert]

Merged main to pick up the new tests from 0eb49a0, then fixed the 3 newly failing tests in test_contributors.py:

• test_main_runs_under_main_guard, test_main_sets_new_contributor_flag, test_main_fetches_sponsor_info_when_enabled — all had mocked get_env_vars return tuples with 12 values instead of the expected 13. Added the missing "contributors.md" (output_filename) to each.

All 52 tests pass locally with 100% coverage. Watching CI for this run. 👀

[zkoppert]

Added input validation for OUTPUT_FILENAME to address security concerns found during review:

Problem: The filename was accepted as-is after stripping whitespace, which meant path traversal (../../../etc/passwd), absolute paths (/tmp/output.md), directory paths (reports/output.md), and shell metacharacters (file;rm -rf /.md) were all accepted — potentially allowing writes outside the intended directory.

Fix: Added a regex check (^[a-zA-Z0-9_\-\.]+$) and a os.path.basename() guard in env.py. Only simple filenames with alphanumeric characters, hyphens, underscores, and dots are now allowed. Four security tests added to cover path traversal, absolute paths, directory separators, and special characters.

[zkoppert]

Thanks for coming along the wild ride to get that in @vchrombie ! Appreciate your contributions! 🚀

[zkoppert]

This is ready to go now. I just need to figure out why codeql hasn't reported like it should. Hang in there... I'll investigate