TEST: testing code coverage failure for forked PRs / external contributors#374
Closed
gargsaumya wants to merge 4 commits intomainfrom
Closed
TEST: testing code coverage failure for forked PRs / external contributors#374gargsaumya wants to merge 4 commits intomainfrom
gargsaumya wants to merge 4 commits intomainfrom
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request is a test change designed to verify code coverage reporting functionality for forked PRs and external contributors. It adds two informational print statements to the main.py sample script without affecting any functional behavior of the mssql-python library.
- Adds print statements after logging setup to indicate the test nature of the change
- No changes to library code, tests, or documentation
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+29
to
+62
| run: | | ||
| if [[ ! -f pr-info.json ]]; then | ||
| echo "❌ pr-info.json not found" | ||
| exit 1 | ||
| fi | ||
|
|
||
| cat pr-info.json | ||
|
|
||
| # Extract values from JSON | ||
| PR_NUMBER=$(jq -r '.pr_number' pr-info.json) | ||
| COVERAGE_PCT=$(jq -r '.coverage_percentage' pr-info.json) | ||
| COVERED_LINES=$(jq -r '.covered_lines' pr-info.json) | ||
| TOTAL_LINES=$(jq -r '.total_lines' pr-info.json) | ||
| PATCH_PCT=$(jq -r '.patch_coverage_pct' pr-info.json) | ||
| LOW_COV_FILES=$(jq -r '.low_coverage_files' pr-info.json) | ||
| PATCH_SUMMARY=$(jq -r '.patch_coverage_summary' pr-info.json) | ||
| ADO_URL=$(jq -r '.ado_url' pr-info.json) | ||
|
|
||
| # Export to env for next step | ||
| echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV | ||
| echo "COVERAGE_PERCENTAGE=$COVERAGE_PCT" >> $GITHUB_ENV | ||
| echo "COVERED_LINES=$COVERED_LINES" >> $GITHUB_ENV | ||
| echo "TOTAL_LINES=$TOTAL_LINES" >> $GITHUB_ENV | ||
| echo "PATCH_COVERAGE_PCT=$PATCH_PCT" >> $GITHUB_ENV | ||
| echo "ADO_URL=$ADO_URL" >> $GITHUB_ENV | ||
|
|
||
| # Handle multiline values | ||
| echo "LOW_COVERAGE_FILES<<EOF" >> $GITHUB_ENV | ||
| echo "$LOW_COV_FILES" >> $GITHUB_ENV | ||
| echo "EOF" >> $GITHUB_ENV | ||
|
|
||
| echo "PATCH_COVERAGE_SUMMARY<<EOF" >> $GITHUB_ENV | ||
| echo "$PATCH_SUMMARY" >> $GITHUB_ENV | ||
| echo "EOF" >> $GITHUB_ENV |
Check failure
Code scanning / CodeQL
Environment variable built from user-controlled sources Critical
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 2 months ago
In general:
Scrub and validate all inputs taken from untrusted sources before writing them as environment variables via $GITHUB_ENV. This involves:
- For single-line variables: Strip newlines and, optionally, enforce an allowlist pattern.
- For multi-line values: Generate a unique delimiter to reduce the chance of injection, and if possible, also validate or escape user-provided values to prevent them containing the delimiter.
Detailed fix for this code:
- For single-line variables (PR_NUMBER, COVERAGE_PCT, etc.), sanitize the values to remove any newlines or dangerous characters. Use
tr -d '\n'or similar to strip newlines. - For multi-line environment variables (
LOW_COV_FILES,PATCH_SUMMARY), use a random, unique delimiter for the heredoc (e.g.,EOF_<uuid>or derived fromuuidgen). Ensure that the delimiter is unique and unlikely to appear in the injected data. This prevents attackers from prematurely closing the heredoc via injected newlines. - Optional: For critical integer fields (PR_NUMBER and line counts), consider restricting to only digits via pattern matching.
- The changes are all in the "Read coverage data" run block in the YAML. No new packages are needed.
- Minimal posix utilities (e.g., tr, uuidgen) are available in ubuntu-latest runners.
Suggested changeset
1
.github/workflows/post-coverage-comment.yml
| @@ -35,16 +35,16 @@ | ||
| cat pr-info.json | ||
|
|
||
| # Extract values from JSON | ||
| PR_NUMBER=$(jq -r '.pr_number' pr-info.json) | ||
| COVERAGE_PCT=$(jq -r '.coverage_percentage' pr-info.json) | ||
| COVERED_LINES=$(jq -r '.covered_lines' pr-info.json) | ||
| TOTAL_LINES=$(jq -r '.total_lines' pr-info.json) | ||
| PATCH_PCT=$(jq -r '.patch_coverage_pct' pr-info.json) | ||
| PR_NUMBER=$(jq -r '.pr_number' pr-info.json | tr -d '\n\r') | ||
| COVERAGE_PCT=$(jq -r '.coverage_percentage' pr-info.json | tr -d '\n\r') | ||
| COVERED_LINES=$(jq -r '.covered_lines' pr-info.json | tr -d '\n\r') | ||
| TOTAL_LINES=$(jq -r '.total_lines' pr-info.json | tr -d '\n\r') | ||
| PATCH_PCT=$(jq -r '.patch_coverage_pct' pr-info.json | tr -d '\n\r') | ||
| LOW_COV_FILES=$(jq -r '.low_coverage_files' pr-info.json) | ||
| PATCH_SUMMARY=$(jq -r '.patch_coverage_summary' pr-info.json) | ||
| ADO_URL=$(jq -r '.ado_url' pr-info.json) | ||
| ADO_URL=$(jq -r '.ado_url' pr-info.json | tr -d '\n\r') | ||
|
|
||
| # Export to env for next step | ||
| # Export to env for next step (sanitize values to avoid env var injection) | ||
| echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV | ||
| echo "COVERAGE_PERCENTAGE=$COVERAGE_PCT" >> $GITHUB_ENV | ||
| echo "COVERED_LINES=$COVERED_LINES" >> $GITHUB_ENV | ||
| @@ -52,14 +49,16 @@ | ||
| echo "PATCH_COVERAGE_PCT=$PATCH_PCT" >> $GITHUB_ENV | ||
| echo "ADO_URL=$ADO_URL" >> $GITHUB_ENV | ||
|
|
||
| # Handle multiline values | ||
| echo "LOW_COVERAGE_FILES<<EOF" >> $GITHUB_ENV | ||
| # Handle multiline values SAFELY using unique delimiter | ||
| EOFF=$(uuidgen) | ||
| echo "LOW_COVERAGE_FILES<<EOF_$EOFF" >> $GITHUB_ENV | ||
| echo "$LOW_COV_FILES" >> $GITHUB_ENV | ||
| echo "EOF" >> $GITHUB_ENV | ||
| echo "EOF_$EOFF" >> $GITHUB_ENV | ||
|
|
||
| echo "PATCH_COVERAGE_SUMMARY<<EOF" >> $GITHUB_ENV | ||
| EOFS=$(uuidgen) | ||
| echo "PATCH_COVERAGE_SUMMARY<<EOF_$EOFS" >> $GITHUB_ENV | ||
| echo "$PATCH_SUMMARY" >> $GITHUB_ENV | ||
| echo "EOF" >> $GITHUB_ENV | ||
| echo "EOF_$EOFS" >> $GITHUB_ENV | ||
|
|
||
| - name: Comment coverage summary on PR | ||
| uses: marocchino/sticky-pull-request-comment@v2 |
Copilot is powered by AI and may make mistakes. Always verify output.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Work Item / Issue Reference
Summary
This pull request introduces a simple test message to verify the setup in
main.py. It does not make any functional changes to the application logic.