From d4f9f9d2748852e5f137186a22fa6e9f21aa1d51 Mon Sep 17 00:00:00 2001 From: Felipe Lucero Date: Thu, 23 Jul 2026 23:55:51 -0300 Subject: [PATCH 1/2] fix(pr-review): use -F not -f for summary comment stdin body MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit gh api's @filename/@- stdin magic only works with -F (typed field), not -f (raw string). The prompt instructed -f body=@-, which set the comment body to the literal two characters "@-" instead of streaming the review text from stdin — reproduced live on baton-aws, baton-okta, baton-servicenow, baton-sql, and baton-google-workspace. --- .../actions/pr-review/prompts/base-pr-review.md | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/actions/pr-review/prompts/base-pr-review.md b/.github/actions/pr-review/prompts/base-pr-review.md index 1025a0d..360d346 100644 --- a/.github/actions/pr-review/prompts/base-pr-review.md +++ b/.github/actions/pr-review/prompts/base-pr-review.md @@ -147,10 +147,18 @@ posting a summary, inline comments, or review verdict. **Inline comments:** Post on specific lines using `mcp__github_inline_comment__create_inline_comment`. Prefix: `🔴 Security:` / `🟠 Bug:` / `🟡 Suggestion:`. Keep to 2-3 sentences. -**Summary comment:** If `summary_comment_id` is set, update that issue comment with -`gh api -X PATCH repos//issues/comments/ -f body=...`. -If it is not set, create one with -`gh api repos//issues//comments -f body=...`. +**Summary comment:** Pass the body via stdin with a heredoc, using `-F body=@-` — NOT +`-f body=...`. `-f` is a raw string field and does not support `@filename`/`@-` stdin +magic, so `-f body=@-` would literally set the comment body to the two characters `@-`. +`-F` is the typed field flag that does support it. If `summary_comment_id` is set, update +that issue comment with: +``` +gh api -X PATCH repos//issues/comments/ -F body=@- <<'BODY_EOF' +... +BODY_EOF +``` +If it is not set, create one the same way against +`repos//issues//comments`. Do not delete existing summary comments before the new review has been posted. Use this template for the summary body. The heading must be exactly the `summary_heading` From 507b3bc26bb289b00951819e2142cbef3ae38986 Mon Sep 17 00:00:00 2001 From: Felipe Lucero Date: Fri, 24 Jul 2026 10:50:24 -0300 Subject: [PATCH 2/2] fix(pr-review): use collision-resistant heredoc terminator BODY_EOF could plausibly appear as a line in a generated review body, closing the heredoc early and feeding the remainder to the shell. --- .github/actions/pr-review/prompts/base-pr-review.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/actions/pr-review/prompts/base-pr-review.md b/.github/actions/pr-review/prompts/base-pr-review.md index 360d346..7e79704 100644 --- a/.github/actions/pr-review/prompts/base-pr-review.md +++ b/.github/actions/pr-review/prompts/base-pr-review.md @@ -150,12 +150,14 @@ Prefix: `🔴 Security:` / `🟠 Bug:` / `🟡 Suggestion:`. Keep to 2-3 sentenc **Summary comment:** Pass the body via stdin with a heredoc, using `-F body=@-` — NOT `-f body=...`. `-f` is a raw string field and does not support `@filename`/`@-` stdin magic, so `-f body=@-` would literally set the comment body to the two characters `@-`. -`-F` is the typed field flag that does support it. If `summary_comment_id` is set, update +`-F` is the typed field flag that does support it. Use an unusual heredoc terminator — +never a plain word like `EOF` — so a line of ordinary review body text can never +collide with it and truncate the body early. If `summary_comment_id` is set, update that issue comment with: ``` -gh api -X PATCH repos//issues/comments/ -F body=@- <<'BODY_EOF' +gh api -X PATCH repos//issues/comments/ -F body=@- <<'GH_PR_REVIEW_BODY_EOF__' ... -BODY_EOF +GH_PR_REVIEW_BODY_EOF__ ``` If it is not set, create one the same way against `repos//issues//comments`.