Skip to content

pr-pipeline: skip a fix-request thread whose reviewer root comment was edited after the request #8435

Closed as duplicate

Description

@kyle-sexton

Refs: #8433

threadAuthors (address-feedback.mjs:~184) does not check whether the reviewer bot's root comment was edited after a trusted fix request, so an edit after the request changes what the lane acts on. Skip such a thread (or treat the edit as untrusted text). Low, predates #8433, from its security review.

🤖 Generated with Claude Code

Activity

  1. added
    needs-triageNot yet classified. Floor until a type and one priority tier are set.
    on Oct 19, 2026
  2. github-actions commented on Oct 19, 2026

    @github-actions
    Contributor

    Thanks for the report. Automated triage handed this issue to a maintainer.

    Proposed work class: work-class: scoped
    Basis: automated intake triage; a maintainer confirms or changes it.

    Automated triage. A maintainer reviews it.

  3. added
    needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.
    on Oct 19, 2026
  4. removed
    needs-triageNot yet classified. Floor until a type and one priority tier are set.
    on Oct 19, 2026
  5. added
    status: confirmedA maintainer confirmed the item is real and in scope; ready to be worked.
    and removed
    needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.
    on Oct 19, 2026
  6. kyle-sexton commented on Oct 29, 2026

    @kyle-sexton
    MemberAuthor

    Closing: duplicate of #8438. #8438 says it extends this issue, and its Fix item 2 covers everything asked here: reject the thread when any non-human comment's lastEditedAt is later than the first fix request's createdAt, and read the body from the same GraphQL query as the edit metadata. The gap is still on main, so the work continues in #8438, which is kept over this older issue because it has a fix plan and a verification section.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    status: confirmedA maintainer confirmed the item is real and in scope; ready to be worked.

    Type

    Fields

    No fields configured for Bug.

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions