Skip to content

Fix NPM package URL template in cli-version-checker to prevent backtick injection#3359

Merged
pelikhan merged 2 commits intomainfrom
copilot/fix-npm-package-url-template
Nov 6, 2025
Merged

Fix NPM package URL template in cli-version-checker to prevent backtick injection#3359
pelikhan merged 2 commits intomainfrom
copilot/fix-npm-package-url-template

Conversation

Copy link
Copy Markdown
Contributor

Copilot AI commented Nov 6, 2025

The CLI version checker workflow was generating malformed NPM package URLs with backticks inside the URL path, producing broken links like https://www.npmjs.com/package/@anthropic-ai/claude-code`` instead of https://www.npmjs.com/package/@anthropic-ai/claude-code.

Changes

Added explicit URL formatting constraints to .github/workflows/cli-version-checker.md:

  • Issue Format section: Changed "Changelog Links" description from generic "NPM/GitHub release notes" to "Use plain URLs without backticks"
  • New URL Formatting Rules section: Added three explicit rules to prevent backtick injection in URLs:
    • Use plain URLs format
    • Do NOT use backticks in URLs
    • Package names in URLs should not be wrapped in backticks

The template structure already showed the correct format (https://www.npmjs.com/package/@package-name), but the AI agent required explicit negative constraints to avoid wrapping the package name in backticks.

Fixes #3356

Original prompt

This section details on the original issue you should resolve

<issue_title>[q] Fix NPM package URL template in cli-version-checker</issue_title>
<issue_description># Q Workflow Optimization Report

Issue Analysis

Issue #3356: NPM Package URL Format Error

Triggering Comment: "/q fix template for npm packages URLs (extra ')"

Problem Identified:
The CLI version checker workflow was generating issue descriptions with malformed NPM package URLs containing extra backticks:

❌ INCORRECT: (redacted)
✅ CORRECT:   (redacted)

This occurred in issue #3356 at line 123 of the generated issue body:

- **NPM Package**: (redacted)

The extra backtick after package/ created a broken URL format.

Root Cause

The workflow instructions in cli-version-checker.md did not provide explicit guidance on URL formatting in the issue template. The AI agent generating the issue description was inadvertently adding backticks to package names within URLs.

Changes Made

.github/workflows/cli-version-checker.md

Added explicit URL formatting instructions in the "Issue Format" section:

  1. Clarified changelog links: Changed from generic "NPM/GitHub release notes" to specify "use plain URLs without backticks"
  2. Added URL formatting rules:
    • Use plain URLs: `(redacted)
    • Do NOT use backticks in URLs
    • Package names in URLs should not be wrapped in backticks

Example Before/After

Before:

## Issue Format
- **Changelog Links**: NPM/GitHub release notes

After:

## Issue Format
- **Changelog Links**: NPM/GitHub release notes (use plain URLs without backticks)

**IMPORTANT**: When including NPM package URLs in the issue:
- Use plain URLs without markdown backticks: (redacted)
- Do NOT use backticks in URLs: ~~(redacted)
- Package names in URLs should not be wrapped in backticks

Expected Improvements

  • ✅ Future issues will have properly formatted NPM package URLs
  • ✅ No more broken links due to backtick escaping
  • ✅ Clearer instructions prevent recurring formatting errors
  • ✅ Workflow generates more professional, properly formatted issue descriptions

Validation

Workflow compiled successfully:

✓ .github/workflows/cli-version-checker.md (230.1 KB)
✓ Compiled 1 workflow(s): 0 error(s), 0 warning(s)

References


This is a targeted fix that addresses the specific template formatting issue identified in issue #3356. The change is minimal and surgical, focusing only on clarifying URL formatting rules to prevent future occurrences of this problem.

AI generated by Q


[!NOTE]
This was originally intended as a pull request, but the git push operation failed.

Workflow Run: View run details and download patch artifact

The patch file is available as an artifact (aw.patch) in the workflow run linked above.
To apply the patch locally:

# Download the artifact from the workflow run https://github.com/githubnext/gh-aw/actions/runs/19140224868
# (Use GitHub MCP tools if gh CLI is not available)
gh run download 19140224868 -n aw.patch
# Apply the patch
git am aw.patch
Show patch preview (72 of 72 lines)
From f2a9deba2587650bd2c1ac28c6a05a3a711e34eb Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 6 Nov 2025 15:13:27 +0000
Subject: [PATCH] fix: remove extra backtick from NPM package URLs in
 cli-version-checker

Fixes issue githubnext/gh-aw#3356 where NPM package URLs were malformed with extra backticks.

Added explicit instructions to prevent backticks in NPM package URLs:
- Use plain URLs: https://www.npmjs.com/package/@scope/package-name
- Do NOT use backticks in URLs

This ensures properly formatted URLs in generated issue descriptions.
---
 .github/workflows/cli-version-checker.lock.yml | 7 ++++++-
 .github/workflows/cli-version-checker.md       | 7 ++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml
index d5788f4..9f65cf5 100644
--- a/.github/workflows/cli-version-checker.lock.yml
+++ b/.github/workflows/cli-version-checker.lock.yml
@@ -1294,7 +1294,7 @@ jobs:
           - **Release Timeline**: dates and intervals
           - **Changes**: Categorized as Breaking/Features/Fixes/Security/Performance
           - **Impact Assessment**: Risk level, affected features, migration notes
-          - **Changelog Links**: NPM/GitHub release notes
+          - **Changelog Links**: NPM/GitHub release notes (use plain URLs without b...

</details>

- Fixes githubnext/gh-aw#3358

<!-- START COPILOT CODING AGENT TIPS -->
---

✨ Let Copilot coding agent [set things up for you](https://github.com/githubnext/gh-aw/issues/new?title=✨+Set+up+Copilot+instructions&body=Configure%20instructions%20for%20this%20repository%20as%20documented%20in%20%5BBest%20practices%20for%20Copilot%20coding%20agent%20in%20your%20repository%5D%28https://gh.io/copilot-coding-agent-tips%29%2E%0A%0A%3COnboard%20this%20repo%3E&assignees=copilot) — coding agent works faster and does higher quality work when set up for your repo.

Add explicit URL formatting rules to prevent AI from adding backticks to package names within URLs. This fixes the issue where URLs like https://www.npmjs.com/package/@anthropic-ai/claude-code were being generated with extra backticks as https://www.npmjs.com/package/`@anthropic-ai/claude-code`.

Changes:
- Updated "Changelog Links" description from "NPM/GitHub release notes" to "Use plain URLs without backticks"
- Added new "URL Formatting Rules" section with explicit instructions:
  - Use plain URLs without backticks
  - Do NOT use backticks in URLs
  - Package names in URLs should not be wrapped in backticks

Fixes #3356

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
@pelikhan pelikhan marked this pull request as ready for review November 6, 2025 15:44
Copilot AI review requested due to automatic review settings November 6, 2025 15:44
@pelikhan pelikhan merged commit f11dafe into main Nov 6, 2025
4 checks passed
@pelikhan pelikhan deleted the copilot/fix-npm-package-url-template branch November 6, 2025 15:44
Copilot AI restored the copilot/fix-npm-package-url-template branch November 6, 2025 15:45
Copilot AI changed the title [WIP] Fix NPM package URL template in cli version checker Fix NPM package URL template in cli-version-checker to prevent backtick injection Nov 6, 2025
Copilot AI requested a review from pelikhan November 6, 2025 15:45
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates the documentation for the CLI version checker workflow to clarify URL formatting rules in issue creation. The change explicitly instructs the AI agent to use plain URLs without backticks when creating changelog links in issues.

Key Changes:

  • Updated instruction for "Changelog Links" to specify plain URLs without backticks
  • Added a new "URL Formatting Rules" section with explicit examples and prohibitions

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File Description
.github/workflows/cli-version-checker.md Updated documentation to clarify URL formatting rules for issue creation
.github/workflows/cli-version-checker.lock.yml Compiled workflow file with the same documentation updates

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- **CLI Changes**: New commands, flags, or removed features discovered via help

**URL Formatting Rules**:
- Use plain URLs: `https://www.npmjs.com/package/@package-name`
Copy link

Copilot AI Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The example URL uses backticks around the URL, which contradicts the instruction 'Do NOT use backticks in URLs' on line 102. This should show the URL without any backticks to be consistent with the formatting rules being described.

Suggested change
- Use plain URLs: `https://www.npmjs.com/package/@package-name`
- Use plain URLs: https://www.npmjs.com/package/@package-name

Copilot uses AI. Check for mistakes.
- **CLI Changes**: New commands, flags, or removed features discovered via help

**URL Formatting Rules**:
- Use plain URLs: `https://www.npmjs.com/package/@package-name`
Copy link

Copilot AI Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The example URL uses backticks around the URL, which contradicts the instruction 'Do NOT use backticks in URLs' on line 1302. This should show the URL without any backticks to be consistent with the formatting rules being described.

Suggested change
- Use plain URLs: `https://www.npmjs.com/package/@package-name`
- Use plain URLs: https://www.npmjs.com/package/@package-name

Copilot uses AI. Check for mistakes.
@pelikhan pelikhan deleted the copilot/fix-npm-package-url-template branch November 12, 2025 06:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[ca] Update Claude Code CLI to version 2.0.34

3 participants