feat: Phase 2 - Planner Agent GitHub API Integration #634
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -105,7 +105,6 @@ jobs: | |||||
| github.event.inputs.report_channel == 'discussions' | ||||||
| ) | ||||||
| runs-on: ubuntu-latest | ||||||
| steps: | ||||||
| - name: Checkout repository | ||||||
| uses: actions/checkout@v4 | ||||||
|
|
@@ -136,19 +135,16 @@ jobs: | |||||
| github-token: ${{ secrets.GITHUB_TOKEN }} | ||||||
| script: | | ||||||
| const title = `Weekly Metrics Summary — ${new Date().toISOString().split('T')[0]}`; | ||||||
| const reportUrl = `${{ github.server_url }}/${{ github.repository }}/tree/develop/.github/reports/metrics/`; | ||||||
| const body = `${{ steps.read_report.outputs.content }}\n\n---\n\n*Generated by metrics-summary workflow. [View full reports](${reportUrl})*`; | ||||||
|
|
||||||
| try { | ||||||
| const { data } = await github.rest.discussions.createDiscussion({ | ||||||
| owner: context.repo.owner, | ||||||
| repo: context.repo.repo, | ||||||
| title, | ||||||
| body, | ||||||
| category_id: 'general', | ||||||
|
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🌐 Web query:
💡 Result: In GitHub’s REST API for creating a discussion (octokit / GitHub REST endpoint Citations:
Fix discussions At ✅ Suggested direction- category_id: 'general',
+ category_id: process.env.DISCUSSION_CATEGORY_ID,Set 📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||
| }); | ||||||
| console.log(`Posted discussion: ${data.html_url}`); | ||||||
| } catch (err) { | ||||||
|
|
||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| 22 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
🌐 Web query:
In GitHub Actions, is using ${{ ... }} interpolation directly inside actions/github-scriptscript:considered a template/code injection risk, and is passing data viaenvthe recommended mitigation?💡 Result:
Yes, using
${{ ... }}interpolation directly inside the actions/github-script script: parameter is considered a significant security risk and is strongly discouraged [1][2]. Because GitHub Actions evaluates${{ ... }}expressions before passing the resulting string to the script, any untrusted input—such as PR titles, issue bodies, or commit messages—can be manipulated to inject malicious JavaScript code [1][3][2]. This can lead to unauthorized code execution or syntax errors when the injected string is not valid JavaScript [1][2]. The recommended mitigation is to pass data via environment variables instead of direct interpolation [1][4][5]. By storing untrusted input in an env block, you can safely access the values within your script using process.env, which treats the data as a standard variable rather than executable code [2][4][6]. Example of the insecure pattern: - uses: actions/github-script@v8 with: script: console.log("${{ github.event.issue.title }}") # DANGEROUS: Injection risk Example of the recommended, secure pattern: - uses: actions/github-script@v8 env: ISSUE_TITLE: ${{ github.event.issue.title }} with: script: console.log(process.env.ISSUE_TITLE) # SAFE: Treated as a variable Official documentation and the actions/github-script maintainers advise this defensive programming posture to prevent script injection vulnerabilities, similar to how you would protect any other privileged application [3][2][4].Citations:
scriptactions/github-script#603🏁 Script executed:
Repository: lightspeedwp/.github
Length of output: 175
🌐 Web query:
GitHub REST API discussions.createDiscussion category_id expects numeric ID or category slug name?💡 Result:
GitHub REST API endpoint discussions.createDiscussion expects category_id to be the category’s numeric ID (not the category slug name). [1] Evidence: GitHub’s GraphQL API uses categoryId as an opaque ID type (Node IDs) when creating discussions. [2] However, for REST usage the category identifier you pass as category_id is the numeric category ID; slugs are used for discussion category forms/templates (they map to filenames and a “slug”, not an API parameter for createDiscussion). [3] So, pass a numeric category id value for category_id, not the slug string.
Citations:
🏁 Script executed:
Repository: lightspeedwp/.github
Length of output: 1858
🌐 Web query:
https://docs.github.com REST API create a discussion category_id parameter type numeric ID or string slug?💡 Result:
There is no GitHub REST API endpoint for creating repository-level discussions [1]. Repository discussions are managed exclusively through the GitHub GraphQL API [2][3]. In the GraphQL API, the
createDiscussionmutation uses acategoryIdparameter which is defined as anID!type (a string in GraphQL) [2]. This ID refers to the unique, system-generated node ID of theDiscussionCategory(e.g., "DIC_kwDO..."), not a numeric ID or a human-readable string slug [2][4]. If you are looking for REST API documentation regarding "discussions," it is limited to team discussions (within organizations) [5], which are distinct from the repository discussions feature [1]. For repository discussions, you must use the GraphQL API [2][3].Citations:
🌐 Web query:
GitHub REST API POST /repos/{owner}/{repo}/discussions parameter category_id expected type (numeric ID vs slug) general💡 Result:
For GitHub’s REST endpoint POST /repos/{owner}/{repo}/discussions, the request body parameter category_id expects the numeric database ID of the discussion category, not a slug. Evidence: the REST-side discussion category object includes an integer id field (and also a separate slug string), indicating that category selection is done by the integer id rather than the slug. Specifically, the discussion category JSON schema shows id: {type: integer} and slug: {type: string} as separate fields, with id being the numeric identifier you would pass as category_id.[1] Note: GitHub’s discussion-category template syntax uses the slug name (YAML template filenames correspond to the category slug), but that slug mechanism is for custom templates, not the REST API create-discussion input.[2]
Citations:
Fix
metrics-summarydiscussion posting security + correctcategory_id${{ steps.read_report.outputs.content }}is interpolated directly into theactions/github-scriptJavaScript template literal. Untrusted content can break the script (and${...}sequences can get interpreted by JS). Pass it viaenvand readprocess.env.REPORT_CONTENTinstead.category_id: 'general'is likely incorrect—POST /repos/{owner}/{repo}/discussionsexpects the numeric discussion category ID (not the slug/name).🛡️ Safer pattern
- name: Post to discussions if: steps.read_report.outputs.content != '' uses: actions/github-script@v7 + env: + REPORT_CONTENT: ${{ steps.read_report.outputs.content }} with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | const title = `Weekly Metrics Summary — ${new Date().toISOString().split('T')[0]}`; const reportUrl = `${{ github.server_url }}/${{ github.repository }}/tree/develop/.github/reports/metrics/`; - const body = `${{ steps.read_report.outputs.content }}\n\n---\n\n*Generated by metrics-summary workflow. [View full reports](${reportUrl})*`; + const reportContent = process.env.REPORT_CONTENT || ''; + const body = `${reportContent}\n\n---\n\n*Generated by metrics-summary workflow. [View full reports](${reportUrl})*`;📝 Committable suggestion
🧰 Tools
🪛 zizmor (1.25.2)
[info] 139-139: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents