fix(ci): correct the provenance claim in the remediation PR body - #3847
Merged
Conversation
The published body states that Claude authored the change. That is false since the planner took over the manifest. Pull request 3846 carries the false claim now. A security remediation must not misattribute its own authorship. The body also held `\n` inside double quotes. Bash does not read an escape there, so the text reached GitHub as one line with a literal backslash and n. Pull request 3846 shows that too. The body now comes from a quoted heredoc, so the text holds real newlines. Its lines carry the indentation of the run block, which YAML strips, so the shell receives the heredoc at column zero. The new text names the deterministic planner, states that no model authored the change, and lists the checks that ran before the publishing job received a write credential. This is the smaller half of UI-138. The per-alert table with advisory links and resolved versions is still open. Refs UI-138
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description & motivation 💭
The first real
applyrun published draft pull request #3846. Its body holds two faults.It misattributes authorship. The body states that Claude authored the change. #3845 moved that work to the deterministic planner, and no model touches the manifest now. A security remediation must not make a false claim about who wrote it.
The newlines are literal. The body was built as
body="...\n\n..."inside double quotes. Bash reads no escape there, so GitHub received one long line holding a backslash and an n. #3846 shows this.The change
The body now comes from a quoted heredoc, so the text holds real newlines. Its lines carry the indentation of the
runblock, which YAML strips, so the shell receives the heredoc at column zero.The new text names the deterministic planner, states that no model authored the change, and lists the checks that ran before the publishing job received a write credential.
Testing 🧪
How was this tested 👻
The workflow file parses and prettier reports no problem. 77 tests pass, unaffected.
The body was extracted from the parsed workflow and run through bash with
RUN_URLset. The output holds real line breaks, expands the run URL, and contains no literal backslash and n.Steps for others to test: 🚶🏽♂️🚶🏽♀️
After this merges, open Actions, select Weekly On-Call Review, and run it with the mode
applyand the channelC0BPXR260DA. The run updates #3846 in place, so the body should render as paragraphs.Checklists
Merge Checklist
Issue(s) closed
Part of UI-138. The per-alert table with advisory links and resolved versions is still open.
Docs
Any docs updates needed?
No.