Jan Krivanek 01050ea83c Fix pr-malicious-scan: repeat-spam + integrity-filter blocks (#722) ...

* Fix malicious-scan repeat-spam + integrity-filter blocks

Root causes (observed on PR #237):
1. Agent's emitted add_comment body did not include the HTML marker line
   (<!-- pr-malicious-scan:fingerprint=... -->), so both the orchestrator's
   pre-dispatch check and the agent's own Step 1 idempotency lookup failed
   to find a prior scan for the same head SHA. Result: hourly re-dispatch.
2. The github MCP tools (pull_request_read, list_pull_requests,
   search_pull_requests) are blocked by the gh-aw integrity filter on PRs
   from non-approved authors -- exactly the population this scanner targets.
   Result: 'Integrity filter blocked N items' notes in every comment.

Fixes:
- pr-malicious-scan.agent.md: drop the github MCP toolset, add 'gh' to the
  bash allowlist, and instruct the agent to use 'gh api' for all PR data
  reads (PAT-authenticated, not subject to the integrity filter).
- Strengthen Step 5: the HTML marker MUST be the first line of the comment
  body. Add a defense-in-depth note that the orchestrator also accepts the
  visible-body sentinel.
- pr-triage-batch.yml + pr-triage-act.sh: match prior scans by EITHER the
  HTML marker OR the visible-body sentinel ('Automated diff scan' + backticked
  sha7), so a missing marker on a previously-emitted comment no longer
  triggers re-dispatch.

Workflow disabled remotely while this lands.

* Orchestrator-only dispatch + integrity-filter opt-out

Replace the per-push pull_request_target trigger and the gh-api workaround
with the documented gh-aw pattern:

- pr-malicious-scan.agent.md: drop pull_request_target; trigger only via
  workflow_dispatch from the orchestrator. Restore the github MCP toolset
  with min-integrity: none (the documented level for spam-detection /
  analytics workflows; safe-outputs still gates every mutation). Drop the
  'gh' bash hack and visible-body sentinel requirements.

- pr-triage-batch.yml: orchestrator now posts a deterministic
  '<!-- pr-malicious-scan:dispatched=SHORT --> ' comment BEFORE calling
  gh workflow run. That comment is the source of truth for 'a scan has
  been initiated for this head SHA' and survives every agent-side failure
  mode (PAT outage, integrity block, dropped HTML marker). Dedup matches
  either that orchestrator marker OR the agent's own fingerprint marker.

- pr-triage-act.sh: drop the visible-body-sentinel fallback; match the
  orchestrator dispatched marker plus the agent fingerprint marker.

Validated: gh aw compile clean; bash -n clean for both worker script and
orchestrator embedded script; markdownlint clean; dedup query and POST
api tested live against PR #713.

2026-06-04 12:30:55 +02:00

10 KiB

Raw Permalink Blame History

View Raw