From 49d721f79c01b60467bceec63ca308c7444176dc Mon Sep 17 00:00:00 2001 From: carlos-alm Date: Fri, 14 Aug 2026 02:05:54 -0600 Subject: [PATCH] fix(ci): verify comment author before updating/deleting impact comment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit codegraph-impact-comment.yml's sticky-comment lookup selected an existing comment to update purely by body.startsWith(marker), with no check that the comment was actually posted by the workflow's own bot account — the same gap Greptile flagged (Confidence 3/5) on PR #2351 for closing-keyword-check.yml's identical pattern. Any PR participant posting a comment starting with the same marker text would have it silently overwritten the next time this workflow runs for that PR. Adds the same c.user.login === 'github-actions[bot]' check #2351's fix already applies to closing-keyword-check.yml. Closes #2352 --- .github/workflows/codegraph-impact-comment.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/codegraph-impact-comment.yml b/.github/workflows/codegraph-impact-comment.yml index 5bc1ce6e7..343b36b53 100644 --- a/.github/workflows/codegraph-impact-comment.yml +++ b/.github/workflows/codegraph-impact-comment.yml @@ -56,7 +56,7 @@ jobs: repo: context.repo.repo, issue_number: prNumber, }); - const existing = comments.find(c => c.body.startsWith('## Codegraph Impact Analysis')); + const existing = comments.find(c => c.body.startsWith('## Codegraph Impact Analysis') && c.user.login === 'github-actions[bot]'); if (existing) { await github.rest.issues.updateComment({ owner: context.repo.owner,