fix(pr-unblock): hidden fix requests and post-request bot edits pass address-feedback #8438

Refs: #8426, #8433, #8435

Summary

isFixRequest in .github/scripts/pr-unblock/address-feedback.mjs decides whether a trusted human's comment turns a reviewer-bot thread into direction for the push-holding address-feedback lane. A request can be hidden so it doesn't show in the rendered comment:

• The fence check /^ {0,3}(```|~~~)/ flips fenced on either marker, so a ~~~ fence that contains a ``` line ends up "unfenced" inside it. A request line inside ~~~ … ``` … ~~~ matches (probe at head abdfa88).
• HTML comments are not stripped, so <!-- + newline + PR-fix lane: please fix this finding + newline + --> matches. GitHub renders nothing for it.

Precondition: the comment must still come from a trusted human with write access, which today means anything posting with the owner's token. So this matters when the owner, or an agent posting as the owner, quotes attacker-supplied text.

A second gap extends #8435. In threadAuthors (:180-198), a reviewer-bot comment edited after the fix request is still accepted. The body (REST) and the edit metadata (GraphQL) are read in separate concurrent requests (:293-300), so an edit landing between them passes as unedited.

Fix

1. Close a fence only on the same character with at least the opening length (CommonMark), and strip <!-- … --> spans before matching. Add stay-quiet tests for both bypasses. They must fail before the fix (hook-precision convention).
2. Reject the thread when any non-human comment's lastEditedAt is later than the first fix request's createdAt. Read body from the same GraphQL query as the edit metadata.

Verification

New tests in address-feedback.test.mjs fail on main and pass with the fix. Existing tests stay green.

Related

• feat(pr-pipeline): let a trusted fix request start address-feedback without an escalation #8426 (introduced fix requests)
• fix(pr-pipeline): let a fix request work a thread from an earlier review #8433 (widens them to any head)
• pr-pipeline: show a thread's review commit and outdated state in address-feedback list output #8434
• pr-pipeline: skip a fix-request thread whose reviewer root comment was edited after the request #8435

🤖 Generated with Claude Code