[Safe Outputs Conformance] SEC-004: github_api_helpers.cjs flagged for body field without sanitization (false positive — add exemption)

[github-actions]

Conformance Check Failure

Check ID: SEC-004
Severity: MEDIUM
Category: Security (Content Sanitization Required)

Problem Description

The SEC-004 conformance check flags actions/setup/js/github_api_helpers.cjs because it contains a body field (used in GraphQL mutation strings) but does not itself call any sanitization function (sanitize, stripHTML, escapeMarkdown, cleanContent).

On inspection this is a false positive. github_api_helpers.cjs is a low-level GraphQL API helper. Its createDiscussionComment(github, discussionId, body, replyToId) function receives an already-sanitized body from its callers:

• actions/setup/js/add_comment.cjs:646 — calls sanitizeContent(processedBody, ...) before invoking the helper (add_comment.cjs:382).
• actions/setup/js/add_reaction_and_edit_comment.cjs:245 — calls sanitizeContent(...) when building the comment body before invoking the helper (add_reaction_and_edit_comment.cjs:260).

Sanitization is correctly the responsibility of the handler layer, not the raw API helper. The helper should therefore be exempted from SEC-004 rather than have redundant sanitization added (double-sanitization would risk stripping intentionally-preserved workflow markers/mentions).

Affected Components

• Files: actions/setup/js/github_api_helpers.cjs
• Callers (already sanitize): actions/setup/js/add_comment.cjs, actions/setup/js/add_reaction_and_edit_comment.cjs
• Checker: scripts/check-safe-outputs-conformance.sh (SEC-004, lines 136-164)

🔍 Current vs Expected Behavior

Current Behavior

github_api_helpers.cjs contains body-bearing GraphQL mutations but no sanitization keyword, so SEC-004 reports it as a MEDIUM failure on every run. The body it forwards is already sanitized upstream, so the finding does not reflect a real security gap — it is noise that masks genuine future SEC-004 regressions.

Expected Behavior

The SEC-004 check provides a documented suppression mechanism: a file carrying the annotation @safe-outputs-exempt SEC-004 is skipped (see scripts/check-safe-outputs-conformance.sh:145-148). Low-level API helpers whose bodies are sanitized by their callers should carry this annotation so SEC-004 passes cleanly.

Remediation Steps

This task can be assigned to a Copilot coding agent:

1. Confirm that every caller of github_api_helpers.cjs exports (createDiscussionComment and any other body-forwarding helpers) sanitizes body via sanitizeContent() before calling into the helper. (Currently: add_comment.cjs and add_reaction_and_edit_comment.cjs both do.)
2. Add a documented exemption annotation near the top of actions/setup/js/github_api_helpers.cjs, e.g. a comment: // @safe-outputs-exempt SEC-004: low-level GraphQL helper; body is sanitized by callers (add_comment.cjs, add_reaction_and_edit_comment.cjs) before it reaches this layer.
3. Do NOT add sanitization inside the helper itself — double sanitization can strip intentionally-preserved workflow markers and allowed mentions (see the note at add_comment.cjs:598-601).
4. Re-run the conformance checker and confirm SEC-004 reports PASS.

Verification

After remediation, verify the fix by running:

bash scripts/check-safe-outputs-conformance.sh

The check SEC-004 should report [PASS] SEC-004: All handlers properly sanitize content without the MEDIUM finding.

References

• Safe Outputs Specification: docs/src/content/docs/specs/safe-outputs-specification.md
• Conformance Checker: scripts/check-safe-outputs-conformance.sh
• Run ID: 28773674062
• Date: 2026-07-06

Generated by ✅ Daily Safe Outputs Conformance Checker · 40.2 AIC · ⌖ 7.9 AIC · ⊞ 6.6K · ◷

• expires on Jul 6, 2026, 11:04 PM UTC-08:00