You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
pr-pipeline: skip a fix-request thread whose reviewer root comment was edited after the request #8435
threadAuthors (address-feedback.mjs:~184) does not check whether the reviewer bot's root comment was edited after a trusted fix request, so an edit after the request changes what the lane acts on. Skip such a thread (or treat the edit as untrusted text). Low, predates #8433, from its security review.
Closing: duplicate of #8438.#8438 says it extends this issue, and its Fix item 2 covers everything asked here: reject the thread when any non-human comment's lastEditedAt is later than the first fix request's createdAt, and read the body from the same GraphQL query as the edit metadata. The gap is still on main, so the work continues in #8438, which is kept over this older issue because it has a fix plan and a verification section.
Activity
github-actions commentedon Oct 19, 2026
Thanks for the report. Automated triage handed this issue to a maintainer.
Proposed work class: work-class: scoped
Basis: automated intake triage; a maintainer confirms or changes it.
Automated triage. A maintainer reviews it.
kyle-sexton commentedon Oct 29, 2026
Closing: duplicate of #8438. #8438 says it extends this issue, and its Fix item 2 covers everything asked here: reject the thread when any non-human comment's
lastEditedAtis later than the first fix request'screatedAt, and read the body from the same GraphQL query as the edit metadata. The gap is still on main, so the work continues in #8438, which is kept over this older issue because it has a fix plan and a verification section.