[code-scanning-fix] Fix js/http-to-file-access: use correct CodeQL suppression syntax by github-actions[bot] · Pull Request #56500 · github/gh-aw

github-actions · 2026-08-28T03:45:34Z

test

Generated by PR Description Updater for #56500 · copilot · auto · 52.8 AIC · ⌖ 8.75 AIC · ⊞ 7.7K · ◷

The lgtm[rule-id] suppression comment syntax is from the deprecated LGTM.com service and is not recognized by GitHub's native CodeQL alert-suppression mechanism, which uses codeql[rule-id]. This left the js/http-to-file-access alert open despite the file already performing full validation (content-type, size limit, PDF signature check) of the downloaded bytes before writing them to disk. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions · 2026-08-28T03:52:34Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-08-28T03:52:37Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions · 2026-08-28T03:52:45Z

⚠️ Security scanning failed for Ponytail Reviewer. Review the logs for details.

Lean already. Ship.

Warning

Firewall blocked 4 domains

The following domains were blocked by the firewall during workflow execution:

ab.chatgpt.com
api.github.com
chatgpt.com
github.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"
    - "api.github.com"
    - "chatgpt.com"
    - "github.com"

See Network Configuration for more information.

Generated by Ponytail Reviewer for #56500

github-actions · 2026-08-28T03:52:52Z

✅ PR Code Quality Reviewer completed the code quality review.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-08-28T03:52:52Z

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. Test Quality Sentinel skipped.

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-08-28T03:56:47Z

Comment Memory

reviewed_at: 2026-08-28T03:53:00Z
review_event: COMMENT
top_themes:
  - comment-only change
  - no changed-line correctness or maintainability regressions found
files_reviewed:
  - scripts/ensure-docs-slide-pdf.js
comment_count: 0

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

🔎 Code quality review by PR Code Quality Reviewer · pi · gpt54 · 3.18 AIC · ⌖ 8.58 AIC · ⊞ 7K · ◷
_{Comment /review to run again}

github-actions

Verdict

No actionable issues in the changed lines. This PR only swaps the suppression marker from lgtm[...] to codeql[...] and preserves the existing safety rationale around the write.

Review notes

The diff is comment-only; runtime behavior and validation logic are unchanged.
I did not find any changed-line correctness, performance, or maintainability regressions worth blocking.
The background sub-agent did not produce usable findings, so this review is based on direct analysis of the diff.

🔎 Code quality review by PR Code Quality Reviewer · pi · gpt54 · 3.18 AIC · ⌖ 8.58 AIC · ⊞ 7K
_{Comment /review to run again}

github-actions

Correct fix — replaces the deprecated lgtm[...] suppression syntax with the current codeql[...] form. The rationale is thorough and the change is minimal/surgical.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · copilot · sonnet46 · 13.7 AIC · ⌖ 10.5 AIC · ⊞ 6.2K

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs — one blocking issue found.

📋 Key Themes & Highlights

Key Themes

Suppression placement risk: The // codeql[js/http-to-file-access] token was moved to its own line block several lines above writeFileSync. CodeQL requires the annotation on the same line as the flagged statement (inline trailing comment). As written, the alert may not be suppressed, defeating the PR's stated purpose.

Positive Highlights

✅ Correct migration from deprecated // lgtm[...] to // codeql[...] syntax
✅ Thorough justification comment explaining why the write is safe
✅ No functional/runtime changes — comment-only, low risk

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet46 · 21.7 AIC · ⌖ 10.5 AIC · ⊞ 7.7K
_{Comment /matt to run again}

github-actions · 2026-08-28T03:57:59Z

+  // after checking the response content-type, enforcing a size limit, and
+  // verifying the PDF file signature — or a locally generated placeholder PDF.
+  // Neither path writes arbitrary/unvalidated network data to disk.
+  fs.writeFileSync(OUTPUT_PATH, pdfBytes);


[/diagnosing-bugs] The // codeql[js/http-to-file-access] annotation is now placed 5 lines above the flagged writeFileSync statement. GitHub CodeQL suppression requires the annotation to appear on the same line as the flagged statement (or, for some configurations, the immediately preceding line). With several intervening comment lines, the scanner may not associate the token with the write call, leaving alert #654 still open — the exact problem this PR aims to fix.

💡 Suggested fix — annotation inline with the statement

// readPdfBytes() only ever returns bytes from a fixed, hardcoded GitHub media // URL (constructed from validated repo/ref values) after checking the response // content-type, enforcing a size limit, and verifying the PDF file signature — // or a locally generated placeholder PDF. Neither path writes arbitrary/unvalidated // network data to disk. fs.writeFileSync(OUTPUT_PATH, pdfBytes); // codeql[js/http-to-file-access]

This keeps the full justification comment while placing the suppression token exactly where CodeQL expects it — on the same line as the flagged statement, matching the GitHub CodeQL suppression docs.

@copilot please address this.

Copilot

Pull request overview

Updates a JavaScript CodeQL suppression annotation for the validated PDF write path.

Changes:

Replaces the legacy lgtm annotation with codeql.
Consolidates the safety justification.

Show a summary per file

File	Description
`scripts/ensure-docs-slide-pdf.js`	Updates the suppression annotation and justification.

Review details

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Files reviewed: 1/1 changed files
Comments generated: 1
Review effort level: Balanced

+  // codeql[js/http-to-file-access]: readPdfBytes() only ever returns bytes from a
+  // fixed, hardcoded GitHub media URL (constructed from validated repo/ref values)
+  // after checking the response content-type, enforcing a size limit, and
+  // verifying the PDF file signature — or a locally generated placeholder PDF.
+  // Neither path writes arbitrary/unvalidated network data to disk.
+  fs.writeFileSync(OUTPUT_PATH, pdfBytes);


github-actions · 2026-08-28T21:14:30Z

🎉 This pull request is included in a new release.

Release: v0.87.9

github-actions Bot added agentic-campaign automated-fix security z_campaign_security-alert-burndown labels Aug 28, 2026

github-actions Bot mentioned this pull request Aug 28, 2026

[WIP] Code Scanning Fixer: work in progress #56498

Closed

pelikhan marked this pull request as ready for review August 28, 2026 03:51

Copilot AI balanced review requested due to automatic review settings August 28, 2026 03:51

Copilot started reviewing on behalf of pelikhan August 28, 2026 03:52 View session

pelikhan merged commit 30bbba9 into main Aug 28, 2026
75 of 94 checks passed

pelikhan deleted the fix-alert-654-http-to-file-access-8981cf613bfb7f6d branch August 28, 2026 03:54

github-actions Bot commented Aug 28, 2026

View reviewed changes

Copilot AI reviewed Aug 28, 2026

View reviewed changes

Navigation Menu

Repository navigation

[code-scanning-fix] Fix js/http-to-file-access: use correct CodeQL suppression syntax - #56500

[code-scanning-fix] Fix js/http-to-file-access: use correct CodeQL suppression syntax#56500
pelikhan merged 1 commit into
mainfrom
fix-alert-654-http-to-file-access-8981cf613bfb7f6d

github-actions Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot Aug 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Aug 28, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Verdict

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Key Themes

Positive Highlights

Uh oh!

github-actions Bot Aug 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Aug 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading

github-actions Bot commented Aug 28, 2026 •

edited

Loading