fix(scripts): apply CI output escaping to infrastructure scripts by WilliamBerryiii · Pull Request #369 · microsoft/hve-core

WilliamBerryiii · 2026-01-30T21:44:10Z

fix(scripts): apply CI output escaping to infrastructure scripts

Description

Applied GitHub Actions workflow command escaping to infrastructure scripts and workflows to prevent potential command injection vulnerabilities. All error and warning outputs now escape special characters (%, \r, \n, ::) before writing to workflow commands.

dependency-pinning-scan.yml: Added inline ConvertTo-GHAEscaped function with full property escaping for file paths and message content in violation warnings
Generate-PrReference.ps1: Added escaping to error handler output
Package-Extension.ps1: Added escaping to error handler output
Prepare-Extension.ps1: Added escaping to error handler output
Get-VerifiedDownload.ps1: Added escaping to error handler output

Related Issue(s)

Closes #366

Type of Change

Select all that apply:

Code & Documentation:

Bug fix (non-breaking change fixing an issue)
New feature (non-breaking change adding functionality)
Breaking change (fix or feature causing existing functionality to change)
Documentation update

Infrastructure & Configuration:

AI Artifacts:

Reviewed contribution with prompt-builder agent and addressed all feedback
Copilot instructions (.github/instructions/*.instructions.md)
Copilot prompt (.github/prompts/*.prompt.md)
Copilot agent (.github/agents/*.agent.md)

Note for AI Artifact Contributors:

Agents: Research, indexing/referencing other project (using standard VS Code GitHub Copilot/MCP tools), planning, and general implementation agents likely already exist. Review .github/agents/ before creating new ones.

Model Versions: Only contributions targeting the latest Anthropic and OpenAI models will be accepted. Older model versions (e.g., GPT-3.5, Claude 3) will be rejected.

See Agents Not Accepted and Model Version Requirements.

Other:

Script/automation (.ps1, .sh, .py)
Other (please describe):

Sample Prompts (for AI Artifact Contributions)

N/A - This PR modifies infrastructure scripts and workflows, not AI artifacts.

Testing

Verified escaping pattern matches GitHub's official @actions/core implementation. Changes are localized to error/warning output paths and do not affect script logic.

Checklist

Required Checks

Documentation is updated (if applicable)
Files follow existing naming conventions
Changes are backwards compatible (if applicable)
Tests added for new functionality (if applicable)

AI Artifact Contributions

N/A

Required Automated Checks

The following validation commands must pass before merging:

Markdown linting: npm run lint:md
Spell checking: npm run spell-check
Frontmatter validation: npm run lint:frontmatter
Link validation: npm run lint:md-links
PowerShell analysis: npm run lint:ps

Security Considerations

This PR does not contain any sensitive or NDA information
Any new dependencies have been reviewed for security issues
Security-related scripts follow the principle of least privilege

Additional Notes

Escaping pattern follows GitHub's official @actions/core implementation:

% → %25 (must be first)
\r → %0D
\n → %0A
:: → %3A%3A

Property values (file paths) additionally escape : → %3A and , → %2C.

🔒 - Generated by Copilot

github-actions · 2026-01-30T21:44:28Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

codecov-commenter · 2026-01-30T21:46:10Z

Codecov Report

❌ Patch coverage is 50.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 52.41%. Comparing base (1237c9a) to head (312f322).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
scripts/dev-tools/Generate-PrReference.ps1	50.00%	1 Missing ⚠️
scripts/extension/Package-Extension.ps1	50.00%	1 Missing ⚠️
scripts/extension/Prepare-Extension.ps1	50.00%	1 Missing ⚠️
scripts/lib/Get-VerifiedDownload.ps1	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #369      +/-   ##
==========================================
+ Coverage   52.31%   52.41%   +0.09%     
==========================================
  Files          17       17              
  Lines        3110     3110              
==========================================
+ Hits         1627     1630       +3     
+ Misses       1483     1480       -3

Flag	Coverage Δ
pester	`52.41% <50.00%> (+0.09%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
scripts/dev-tools/Generate-PrReference.ps1	`93.96% <50.00%> (ø)`
scripts/extension/Package-Extension.ps1	`84.37% <50.00%> (+0.52%)`	⬆️
scripts/extension/Prepare-Extension.ps1	`83.33% <50.00%> (+0.47%)`	⬆️
scripts/lib/Get-VerifiedDownload.ps1	`79.01% <50.00%> (+1.23%)`	⬆️

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot

Pull request overview

This PR applies GitHub Actions workflow command escaping to infrastructure scripts and workflows to prevent potential command injection vulnerabilities. The changes ensure that error and warning outputs escape special characters before writing to workflow commands.

Changes:

Added inline escaping function to dependency-pinning-scan.yml workflow with full property escaping
Added escaping to error handler outputs in four PowerShell scripts (Generate-PrReference.ps1, Package-Extension.ps1, Prepare-Extension.ps1, Get-VerifiedDownload.ps1)

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
.github/workflows/dependency-pinning-scan.yml	Added ConvertTo-GHAEscaped inline function to escape workflow command patterns in dependency violation warnings
scripts/dev-tools/Generate-PrReference.ps1	Added escaping to error handler for GitHub Actions workflow commands
scripts/extension/Package-Extension.ps1	Added escaping to error handler for GitHub Actions workflow commands
scripts/extension/Prepare-Extension.ps1	Added escaping to error handler for GitHub Actions workflow commands
scripts/lib/Get-VerifiedDownload.ps1	Added escaping to error handler for GitHub Actions workflow commands

scripts/dev-tools/Generate-PrReference.ps1

.github/workflows/dependency-pinning-scan.yml

scripts/lib/Get-VerifiedDownload.ps1

scripts/extension/Prepare-Extension.ps1

scripts/extension/Package-Extension.ps1

auyidi1

same as my prior comment...wondering if there's a way to make the escape logic as a global scoped helper or a PowerShell module wrapper on Write-Output (e.g. Write-Output-Escaped).

Apply ConvertTo-GitHubActionsEscaped to prevent workflow command injection. Closes #366 🔒 - Generated by Copilot

- replace backslash escapes with PowerShell backtick escapes - fix Generate-PrReference.ps1, Get-VerifiedDownload.ps1 - fix Prepare-Extension.ps1, Package-Extension.ps1 🔧 - Generated by Copilot

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

scripts/lib/Get-VerifiedDownload.ps1

scripts/extension/Prepare-Extension.ps1

scripts/extension/Package-Extension.ps1

scripts/dev-tools/Generate-PrReference.ps1

- import CIHelpers.psm1 in infrastructure scripts - replace inline escaping with Write-CIAnnotation - remove redundant platform detection boilerplate 🔧 - Generated by Copilot

🤖 I have created a release *beep* *boop* --- ## [2.1.0](hve-core-v2.0.1...hve-core-v2.1.0) (2026-02-04) ### ✨ Features * add PowerShell script to validate copyright headers ([#370](#370)) ([92fce72](92fce72)) * **docs:** Replace deprecated chat.modeFilesLocations with chat.agentFilesLocations ([#413](#413)) ([67fb2ab](67fb2ab)) * **scripts:** add CIHelpers module for CI platform abstraction ([#348](#348)) ([23e7a7e](23e7a7e)) * **scripts:** add SecurityHelpers and CIHelpers modules ([#354](#354)) ([b93d990](b93d990)) * **workflow:** add copilot-setup-steps.yml for Coding Agent environment ([#398](#398)) ([085a38b](085a38b)) ### 🐛 Bug Fixes * **build:** increase release-please search depths to prevent 250-commit window issue ([#342](#342)) ([4bb857d](4bb857d)) * **build:** patch @isaacs/brace-expansion critical vulnerability ([#404](#404)) ([292ef51](292ef51)) * **ci:** disable errexit during spell check exit code capture ([#356](#356)) ([ed6ed46](ed6ed46)) * **ci:** exclude extension/README.md from frontmatter validation ([#362](#362)) ([e0d7378](e0d7378)) * exclude test fixtures from markdown link checker ([#345](#345)) ([58147f9](58147f9)) * **extension:** resolve path resolution issues in Windows/WSL environments ([#407](#407)) ([8529725](8529725)) * **linting:** use Write-Error instead of Write-Host for error output ([#377](#377)) ([2ca766b](2ca766b)) * **scripts:** apply CI output escaping to infrastructure scripts ([#369](#369)) ([251021e](251021e)) * **scripts:** apply CI output escaping to linting scripts ([#367](#367)) ([fdd75ed](fdd75ed)) * **scripts:** apply CI output escaping to security scripts ([#368](#368)) ([1237c9a](1237c9a)) * **scripts:** ensure reliable array count operations in linting and security scripts ([#395](#395)) ([de43e73](de43e73)) * **scripts:** standardize PowerShell requirements header block ([#385](#385)) ([6e26282](6e26282)) ### 📚 Documentation * add doc-ops agent to CUSTOM-AGENTS reference ([#358](#358)) ([15f7185](15f7185)) * add memory agent to CUSTOM-AGENTS.md ([#359](#359)) ([d92c4e1](d92c4e1)) * add missing agents to extension README ([#357](#357)) ([d58541c](d58541c)) * add task-reviewer agent to CUSTOM-AGENTS.md ([#363](#363)) ([0efb722](0efb722)) * **contributing:** add copyright header guidelines ([#382](#382)) ([881a567](881a567)) * **scripts:** update README.md with missing directory sections ([#355](#355)) ([ac2966f](ac2966f)) ### ♻️ Refactoring * **scripts:** align linting and tests with CIHelpers ([#401](#401)) ([3587e6a](3587e6a)) * **scripts:** extract Invoke-PackageExtension for testability ([#343](#343)) ([858a1be](858a1be)) * **scripts:** extract orchestration function for Prepare-Extension testability ([#344](#344)) ([9fd4bd1](9fd4bd1)) * **scripts:** replace raw GITHUB_OUTPUT with Set-CIOutput in Package-Extension ([#391](#391)) ([74a30bb](74a30bb)) * **security:** move DependencyViolation and ComplianceReport to shared module ([#378](#378)) ([1dd31ad](1dd31ad)) ### 🔧 Maintenance * add copyright headers to PowerShell scripts ([#381](#381)) ([d19c9b3](d19c9b3)) * add copyright headers to shell scripts ([#380](#380)) ([284b456](284b456)) * **deps-dev:** bump cspell from 9.6.1 to 9.6.2 in the npm-dependencies group ([#387](#387)) ([23c2b9f](23c2b9f)) * **workflows:** simplify Copilot setup steps workflow triggers ([#414](#414)) ([492a7b1](492a7b1)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: hve-core-release-please[bot] <254602402+hve-core-release-please[bot]@users.noreply.github.com> Co-authored-by: Bill Berry <wberry@microsoft.com>

WilliamBerryiii requested a review from a team as a code owner January 30, 2026 21:44

Copilot AI review requested due to automatic review settings January 30, 2026 21:44

Copilot started reviewing on behalf of WilliamBerryiii January 30, 2026 21:44 View session

Copilot AI reviewed Jan 30, 2026

View reviewed changes

auyidi1 approved these changes Jan 30, 2026

View reviewed changes

WilliamBerryiii added 2 commits January 30, 2026 21:19

fix(scripts): apply CI output escaping to infrastructure scripts

2892b11

Apply ConvertTo-GitHubActionsEscaped to prevent workflow command injection. Closes #366 🔒 - Generated by Copilot

fix(scripts): correct escape sequences in CI output escaping

7676022

- replace backslash escapes with PowerShell backtick escapes - fix Generate-PrReference.ps1, Get-VerifiedDownload.ps1 - fix Prepare-Extension.ps1, Package-Extension.ps1 🔧 - Generated by Copilot

Copilot AI review requested due to automatic review settings January 31, 2026 05:19

WilliamBerryiii force-pushed the fix/ci-escaping-infra-366 branch from 1e8f168 to 7676022 Compare January 31, 2026 05:19

Copilot started reviewing on behalf of WilliamBerryiii January 31, 2026 05:20 View session

Copilot AI reviewed Jan 31, 2026

View reviewed changes

refactor(scripts): use CIHelpers module for CI annotations

312f322

- import CIHelpers.psm1 in infrastructure scripts - replace inline escaping with Write-CIAnnotation - remove redundant platform detection boilerplate 🔧 - Generated by Copilot

WilliamBerryiii merged commit 251021e into main Jan 31, 2026
16 checks passed

hve-core-release-please bot mentioned this pull request Jan 31, 2026

chore(main): release hve-core 2.1.0 #347

Merged

This was referenced Feb 4, 2026

chore(main): release hve-core 3.0.0 #417

Closed

chore(main): release hve-core 3.0.0 #441

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(scripts): apply CI output escaping to infrastructure scripts#369

fix(scripts): apply CI output escaping to infrastructure scripts#369
WilliamBerryiii merged 3 commits intomainfrom
fix/ci-escaping-infra-366

WilliamBerryiii commented Jan 30, 2026

Uh oh!

github-actions bot commented Jan 30, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Jan 30, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

auyidi1 left a comment •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

WilliamBerryiii commented Jan 30, 2026

fix(scripts): apply CI output escaping to infrastructure scripts

Description

Related Issue(s)

Type of Change

Sample Prompts (for AI Artifact Contributions)

Testing

Checklist

Required Checks

AI Artifact Contributions

Required Automated Checks

Security Considerations

Additional Notes

Uh oh!

github-actions bot commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

codecov-commenter commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

auyidi1 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions bot commented Jan 30, 2026 •

edited

Loading

codecov-commenter commented Jan 30, 2026 •

edited

Loading

auyidi1 left a comment •

edited

Loading