fix(ci): bound PR issue reference fetching

[JSONbored]

Motivation

• Prevent unbounded, attacker-controlled processing of closing references in PR bodies that can exhaust the workflow's GitHub API quota and runtime.
• Avoid failing the workflow when a PR body contains invalid issue references (e.g., 404s).
• Avoid performing any authenticated issue lookups for pull requests that are not unlabeled feature PR candidates.

Description

• Add MAX_CLOSING_ISSUE_REFERENCES and cap parsing in extractClosingIssueNumbers to stop extracting more than a safe number of references.
• Add a maxReferences option to fetchReferencedIssues and pass the capped list into the per-issue authenticated fetch loop.
• Treat 404 results when fetching referenced issues as ignorable (skip that reference) and preserve throwing on other unexpected response codes.
• Add shouldFetchReferencedIssues to early-skip referenced-issue fetching unless the pull_request_target payload looks like an unlabeled feature PR candidate.
• Update the declaration file scripts/github-type-label.d.mts and add regression unit tests in test/unit/github-type-label.test.ts covering capped fetches, 404 handling, and non-feature PR early skipping.

Testing

• Ran the unit tests with npx vitest run test/unit/github-type-label.test.ts and all tests passed (27 tests, all green).
• Ran TypeScript type checking with npm run typecheck (tsc --noEmit) and it succeeded.
• Added targeted unit tests for capped extraction, 404-ignore behavior, and the early-skip path which passed under the test runner.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	61b8add	Commit Preview URL Branch Preview URL	Jun 06 2026, 09:57 AM

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#435 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.