UNPKG

fastify

Version:

Fast and low overhead web framework, for Node.js

fastify.dev

fastify/fastify

23 lines (16 loc) • 1.14 kB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
## 15:46 UTC — Task ### What went wrong - Interpolated `${{ inputs.package }}` directly into `actions/github-script` JavaScript, allowing malformed input to break or inject code. - Fetched npm metadata with the raw package name instead of URL-encoding it. - Assumed `data.repository.url` always existed and was a GitHub `.git` URL. - Used a brittle repository URL regex that missed scoped/modern GitHub URL formats and failed without a clear error. ### How it was fixed - Pass workflow input through `env.NPM_PACKAGE` and read it from `process.env` inside the script. - Validate the package name with an npm package-name regex before using it. - Use `encodeURIComponent(packageName)` in the npm registry URL. - Check `response.ok` and throw explicit errors for failed registry fetches or unsupported repository URLs. ## 16:04 UTC — Task ### What went wrong - PR title did not satisfy the repository's conventional title check before opening/updating the PR. ### How it was fixed - Renamed PR #6833 to `ci: harden CITGM package workflow input handling` using `gh pr edit`, then watched checks until `pull-request-title-check` passed.