fix(providers): restrict comment editing to PAC-owned comments by theakshaypant · Pull Request #2488 · tektoncd/pipelines-as-code

theakshaypant · 2026-02-18T05:43:37Z

📝 Description of the Change

Add check to ensure PAC only edits comments created by its own credentials, preventing accidental modification of comments from other users or bot accounts.

👨🏻‍ Linked Jira

https://issues.redhat.com/browse/SRVKP-10857

🔗 Linked GitHub Issue

N/A
Fixes #

🚀 Type of Change

🧪 Testing Strategy

🤖 AI Assistance

I have not used any AI assistance for this PR.
I have used AI assistance for this PR.

If you have used AI assistance, please provide the following details:

Which LLM was used?

Extent of AI Assistance:

Documentation and research only
Unit tests or E2E tests only
Code generation (parts of the code)
Full code generation (most of the PR)
PR description and comments
Commit message(s)

Important

If the majority of the code in this PR was generated by an AI, please add a Co-authored-by trailer to your commit message.
For example:

Co-authored-by: Gemini gemini@google.com
Co-authored-by: ChatGPT noreply@chatgpt.com
Co-authored-by: Claude noreply@anthropic.com
Co-authored-by: Cursor noreply@cursor.com
Co-authored-by: Copilot Copilot@users.noreply.github.com

**💡You can use the script ./hack/add-llm-coauthor.sh to automatically add
these co-author trailers to your commits.

✅ Submitter Checklist

gemini-code-assist · 2026-02-18T05:43:53Z

Summary of Changes

Hello @theakshaypant, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request enhances the robustness and security of the comment management functionality within the Pipelines-as-Code system. By introducing a mechanism to verify comment ownership before editing, it prevents unintended modifications to comments made by external entities, thereby improving the integrity of communication on pull requests across Gitea and GitLab platforms.

Highlights

Comment Editing Restriction: Implemented a check to ensure that Pipelines-as-Code (PAC) only attempts to edit comments that were originally created by its own credentials. This prevents PAC from inadvertently modifying comments made by other users or bot accounts.
User ID Caching: Introduced a pacUserID field in both Gitea and GitLab provider structs to cache the PAC user's ID, reducing redundant API calls to fetch user information.
Enhanced Test Coverage: Added new unit tests for both Gitea and GitLab providers to specifically verify the behavior of skipping comments not owned by PAC and ensuring new comments are created when appropriate.

Changelog

pkg/provider/gitea/gitea.go
- Added pacUserID field to the Provider struct to store the user ID of the PAC instance.
- Implemented logic to fetch and cache the PAC user's ID during comment creation/update operations.
- Introduced a conditional check to only edit comments where the Poster.ID matches the pacUserID.
pkg/provider/gitea/gitea_test.go
- Updated mock HTTP responses to include user ID information for comments and current user endpoints.
- Added a new test case to verify that comments from different users are skipped during editing attempts.
- Initialized a logger in test setups to better observe debug output.
pkg/provider/gitlab/gitlab.go
- Added pacUserID field to the Provider struct to store the user ID of the PAC instance.
- Implemented logic to fetch and cache the PAC user's ID during comment creation/update operations.
- Introduced a conditional check to only edit comments where the Author.ID matches the pacUserID.
pkg/provider/gitlab/gitlab_test.go
- Updated mock HTTP responses to include author ID information for comments and current user endpoints.
- Added a new test case to verify that comments from different users are skipped during editing attempts.
- Initialized a logger in test setups for TestGitLabCreateComment and TestGitLabCreateCommentPaging.

Activity

The author used AI assistance (Claude) for generating unit/E2E tests and commit messages.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request aims to enhance security by preventing Pipelines-as-Code from editing comments it does not own across Gitea and GitLab providers, correctly verifying comment authorship. However, a high-severity vulnerability exists where both Gitea and GitLab implementations lack a nil check for the comment author object, potentially leading to a nil pointer dereference and controller panic if an author is missing. Additionally, the GitLab implementation has a type mismatch that would prevent compilation.

gemini-code-assist · 2026-02-18T05:47:37Z

pkg/provider/gitea/gitea.go

+				if comment.Poster.ID != v.pacUserID {
+					v.Logger.Debugf("Skipping comment %d: created by user ID %d (%s), PAC user ID is %d",
+						comment.ID, comment.Poster.ID, comment.Poster.UserName, v.pacUserID)
+					continue
+				}


The code accesses comment.Poster.ID and comment.Poster.UserName without checking if comment.Poster is nil. This is a critical vulnerability as comment.Poster can be nil in the Gitea/Forgejo SDK (e.g., for system comments or deleted users), leading to a nil pointer dereference and a controller panic, causing a Denial of Service. A nil check is required before accessing its fields. This is especially important when verifying comment authorship by the app, as outlined in repository guidelines. Additionally, consider adding a unit test to cover scenarios where the comment's author is nil.

References

When a GitHub App needs to find and update a comment it previously posted, it must verify that the comment was authored by the app itself before editing. This nil check is a prerequisite for safely performing such an authorship verification.

Deleted user comments are associated with GhostUserID.
System comments are associated with ActionsUserID.

pkg/provider/gitlab/gitlab.go

theakshaypant · 2026-02-18T08:57:32Z

/review

chmouel

~~It may be worth validating if this doesn't cause any issues with github-webhook provider which use a PAT token~~

chmouel · 2026-02-18T09:13:05Z

pkg/provider/gitea/gitea.go

+			pacUser, _, err := v.Client().GetMyUserInfo()
+			if err != nil {
+				return fmt.Errorf("unable to fetch pipelines-as-code user: %w", err)
+			}


this would not be an accurate logging statement, since it's not he pipelines-as-code user, maybe just use user info (and for other places where this is references)

updated log message in 58cdfb7

pkg/provider/gitea/gitea.go

zakisk · 2026-02-23T06:40:19Z

pkg/provider/gitea/gitea.go

+				// Only edit comments created by this PAC installation's credentials.
+				// Prevents accidentally modifying comments from other users/bots.
+				if comment.Poster.ID != v.pacUserID {
+					v.Logger.Debugf("Skipping comment %d: created by user ID %d, PAC user ID is %d",


Suggested change

v.Logger.Debugf("Skipping comment %d: created by user ID %d, PAC user ID is %d",

v.Logger.Debugf("comment is not created by PaC , skipping editing comment: %d, created by user: %d, PaC user: %d",

this comment has not been created by PAC

Add check to ensure PAC only edits comments created by its own credentials, preventing accidental modification of comments from other users or bot accounts. Jira: https://issues.redhat.com/browse/SRVKP-10857 Signed-off-by: Akshay Pant <akshay.akshaypant@gmail.com> Assisted-by: Claude Sonnet 4.5 (via Claude Code)

chmouel

/lgtm

pipelines-as-code bot added fix gitea providers labels Feb 18, 2026

gemini-code-assist bot reviewed Feb 18, 2026

View reviewed changes

theakshaypant force-pushed the SRKVP-10857-restricted-comment-editing-providers branch from 530ad59 to e4fc636 Compare February 18, 2026 06:28

theakshaypant marked this pull request as ready for review February 18, 2026 08:01

chmouel reviewed Feb 18, 2026

View reviewed changes

theakshaypant force-pushed the SRKVP-10857-restricted-comment-editing-providers branch 2 times, most recently from 58cdfb7 to 87bafae Compare February 19, 2026 06:25

zakisk reviewed Feb 19, 2026

View reviewed changes

pkg/provider/gitea/gitea.go Outdated Show resolved Hide resolved

theakshaypant force-pushed the SRKVP-10857-restricted-comment-editing-providers branch 2 times, most recently from ff84362 to a02074c Compare February 23, 2026 05:49

zakisk reviewed Feb 23, 2026

View reviewed changes

theakshaypant force-pushed the SRKVP-10857-restricted-comment-editing-providers branch from a02074c to 4d6d2a9 Compare February 23, 2026 09:39

chmouel approved these changes Feb 24, 2026

View reviewed changes

theakshaypant merged commit 4d950e7 into tektoncd:main Feb 24, 2026
11 checks passed

theakshaypant deleted the SRKVP-10857-restricted-comment-editing-providers branch February 24, 2026 11:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(providers): restrict comment editing to PAC-owned comments#2488

fix(providers): restrict comment editing to PAC-owned comments#2488
theakshaypant merged 1 commit intotektoncd:mainfrom
theakshaypant:SRKVP-10857-restricted-comment-editing-providers

theakshaypant commented Feb 18, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Feb 18, 2026

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

gemini-code-assist bot Feb 18, 2026

Uh oh!

theakshaypant Feb 18, 2026

Uh oh!

Uh oh!

theakshaypant commented Feb 18, 2026

Uh oh!

chmouel left a comment •

edited

Loading

Uh oh!

chmouel Feb 18, 2026

Uh oh!

theakshaypant Feb 18, 2026

Uh oh!

Uh oh!

zakisk Feb 23, 2026

Uh oh!

chmouel Feb 23, 2026

Uh oh!

chmouel left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	v.Logger.Debugf("Skipping comment %d: created by user ID %d, PAC user ID is %d",
	v.Logger.Debugf("comment is not created by PaC , skipping editing comment: %d, created by user: %d, PaC user: %d",

Conversation

theakshaypant commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Description of the Change

👨🏻‍ Linked Jira

🔗 Linked GitHub Issue

🚀 Type of Change

🧪 Testing Strategy

🤖 AI Assistance

✅ Submitter Checklist

Uh oh!

gemini-code-assist bot commented Feb 18, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

theakshaypant Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

theakshaypant commented Feb 18, 2026

Uh oh!

chmouel left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chmouel Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

theakshaypant Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

zakisk Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

chmouel Feb 23, 2026

Choose a reason for hiding this comment

Uh oh!

chmouel left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

theakshaypant commented Feb 18, 2026 •

edited

Loading

chmouel left a comment •

edited

Loading