Skip to content

Fix guided tour false positive in PR size check#51964

Merged
swannysec merged 1 commit intomainfrom
fix/size-check-guided-tour-detection
Mar 19, 2026
Merged

Fix guided tour false positive in PR size check#51964
swannysec merged 1 commit intomainfrom
fix/size-check-guided-tour-detection

Conversation

@swannysec
Copy link
Copy Markdown
Contributor

Context

The size check workflow's guided tour detection matches text inside HTML comment placeholders in the PR template (e.g., <!-- provide a guided tour — numbered list of files/commits to read in order -->), producing false positives like the one on #51957.

Fix: strip <!-- --> comments from the PR body before running the regex.

How to Review

  • Single file: .github/workflows/pr-size-check.yml, lines 148-151
  • The .replace(/<!--[\s\S]*?-->/g, '') runs in actions/github-script JS, not shell

Self-Review Checklist

  • I've reviewed my own diff for quality, security, and reliability
  • Unsafe blocks (if any) have justifying comments
  • The content is consistent with the UI/UX checklist
  • Tests cover the new/changed behavior
  • Performance impact has been considered and is acceptable

Release Notes:

  • N/A

The regex matches "guided tour" and "read in order" in the PR
template's HTML comment placeholders, not actual content from the
author. Strip HTML comments before testing.
@cla-bot cla-bot bot added the cla-signed The user has signed the Contributor License Agreement label Mar 19, 2026
@zed-codeowner-coordinator zed-codeowner-coordinator bot requested a review from a team March 19, 2026 18:25
@zed-community-bot zed-community-bot bot added the staff Pull requests authored by a current member of Zed staff label Mar 19, 2026
@swannysec swannysec merged commit b786872 into main Mar 19, 2026
41 checks passed
@swannysec swannysec deleted the fix/size-check-guided-tour-detection branch March 19, 2026 18:26
swannysec added a commit that referenced this pull request Mar 19, 2026
## Context

Follow-up to #51964. The previous fix (stripping HTML comments) still
had a false positive: the `## How to Review` heading itself matched the
`how to review` alternative in the regex. Every PR using the template
would trigger the "guided tour detected" message.

Replace the regex with structural detection: extract the "How to Review"
section, strip template placeholders, and check if the author actually
wrote content there. Also softens the confirmation message to "appears
to include guidance."

## How to Review

- Single file: `.github/workflows/pr-size-check.yml`, lines 147-154
- The `rawBody.match(...)` extracts content between `## How to Review`
and the next `##` heading
- Confirmed: PR #51957's body returns `false`, a PR with actual content
returns `true`

## Self-Review Checklist

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- N/A
AmaanBilwar pushed a commit to AmaanBilwar/zed that referenced this pull request Mar 20, 2026
## Context

The size check workflow's guided tour detection matches text inside HTML
comment placeholders in the PR template (e.g., `<!-- provide a guided
tour — numbered list of files/commits to read in order -->`), producing
false positives like the one on zed-industries#51957.

Fix: strip `<!-- -->` comments from the PR body before running the
regex.

## How to Review

- Single file: `.github/workflows/pr-size-check.yml`, lines 148-151
- The `.replace(/<!--[\s\S]*?-->/g, '')` runs in `actions/github-script`
JS, not shell

## Self-Review Checklist

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- N/A
AmaanBilwar pushed a commit to AmaanBilwar/zed that referenced this pull request Mar 20, 2026
…#51969)

## Context

Follow-up to zed-industries#51964. The previous fix (stripping HTML comments) still
had a false positive: the `## How to Review` heading itself matched the
`how to review` alternative in the regex. Every PR using the template
would trigger the "guided tour detected" message.

Replace the regex with structural detection: extract the "How to Review"
section, strip template placeholders, and check if the author actually
wrote content there. Also softens the confirmation message to "appears
to include guidance."

## How to Review

- Single file: `.github/workflows/pr-size-check.yml`, lines 147-154
- The `rawBody.match(...)` extracts content between `## How to Review`
and the next `##` heading
- Confirmed: PR zed-industries#51957's body returns `false`, a PR with actual content
returns `true`

## Self-Review Checklist

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- N/A
toshmukhamedov pushed a commit to toshmukhamedov/zed that referenced this pull request Mar 20, 2026
## Context

The size check workflow's guided tour detection matches text inside HTML
comment placeholders in the PR template (e.g., `<!-- provide a guided
tour — numbered list of files/commits to read in order -->`), producing
false positives like the one on zed-industries#51957.

Fix: strip `<!-- -->` comments from the PR body before running the
regex.

## How to Review

- Single file: `.github/workflows/pr-size-check.yml`, lines 148-151
- The `.replace(/<!--[\s\S]*?-->/g, '')` runs in `actions/github-script`
JS, not shell

## Self-Review Checklist

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- N/A
toshmukhamedov pushed a commit to toshmukhamedov/zed that referenced this pull request Mar 20, 2026
…#51969)

## Context

Follow-up to zed-industries#51964. The previous fix (stripping HTML comments) still
had a false positive: the `## How to Review` heading itself matched the
`how to review` alternative in the regex. Every PR using the template
would trigger the "guided tour detected" message.

Replace the regex with structural detection: extract the "How to Review"
section, strip template placeholders, and check if the author actually
wrote content there. Also softens the confirmation message to "appears
to include guidance."

## How to Review

- Single file: `.github/workflows/pr-size-check.yml`, lines 147-154
- The `rawBody.match(...)` extracts content between `## How to Review`
and the next `##` heading
- Confirmed: PR zed-industries#51957's body returns `false`, a PR with actual content
returns `true`

## Self-Review Checklist

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- N/A
AmaanBilwar pushed a commit to AmaanBilwar/zed that referenced this pull request Mar 23, 2026
## Context

The size check workflow's guided tour detection matches text inside HTML
comment placeholders in the PR template (e.g., `<!-- provide a guided
tour — numbered list of files/commits to read in order -->`), producing
false positives like the one on zed-industries#51957.

Fix: strip `<!-- -->` comments from the PR body before running the
regex.

## How to Review

- Single file: `.github/workflows/pr-size-check.yml`, lines 148-151
- The `.replace(/<!--[\s\S]*?-->/g, '')` runs in `actions/github-script`
JS, not shell

## Self-Review Checklist

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- N/A
AmaanBilwar pushed a commit to AmaanBilwar/zed that referenced this pull request Mar 23, 2026
…#51969)

## Context

Follow-up to zed-industries#51964. The previous fix (stripping HTML comments) still
had a false positive: the `## How to Review` heading itself matched the
`how to review` alternative in the regex. Every PR using the template
would trigger the "guided tour detected" message.

Replace the regex with structural detection: extract the "How to Review"
section, strip template placeholders, and check if the author actually
wrote content there. Also softens the confirmation message to "appears
to include guidance."

## How to Review

- Single file: `.github/workflows/pr-size-check.yml`, lines 147-154
- The `rawBody.match(...)` extracts content between `## How to Review`
and the next `##` heading
- Confirmed: PR zed-industries#51957's body returns `false`, a PR with actual content
returns `true`

## Self-Review Checklist

- [x] I've reviewed my own diff for quality, security, and reliability
- [x] Unsafe blocks (if any) have justifying comments
- [x] The content is consistent with the [UI/UX
checklist](https://github.com/zed-industries/zed/blob/main/CONTRIBUTING.md#uiux-checklist)
- [x] Tests cover the new/changed behavior
- [x] Performance impact has been considered and is acceptable

Release Notes:

- N/A
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

cla-signed The user has signed the Contributor License Agreement staff Pull requests authored by a current member of Zed staff

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant