Quote workflow shell repository expansions to clear SC2086 findings by Copilot · Pull Request #48798 · github/gh-aw

Copilot · 2026-07-29T07:38:20Z

Static analysis reported actionlint/ShellCheck SC2086 warnings in generated workflow run: blocks. The remaining hits came from unquoted repository-related shell expansions in one shared PR prefetch fragment and one workflow-local GEO audit command.

Shared PR prefetch quoting
- Updated .github/workflows/shared/pr-diff-data-fetch.md to quote EXPR_GITHUB_REPOSITORY in gh pr diff and gh pr view.
- This removes the duplicated SC2086 findings emitted into:
  - impeccable-skills-reviewer.lock.yml
  - mattpocock-skills-reviewer.lock.yml
  - pr-code-quality-reviewer.lock.yml
Geo optimizer URL quoting
- Updated .github/workflows/daily-geo-optimizer.md to quote the repository URL passed to geo audit.
- This removes the remaining SC2086 hit in daily-geo-optimizer.lock.yml.
Regenerated compiled workflows
- Recompiled the affected .lock.yml files so the source and generated workflows stay in sync with the quoting changes.
Focused regression coverage
- Extended pkg/cli/pr_prefetch_cache_contract_test.go with assertions that pin the quoted shared prefetch commands and the quoted GEO audit URL.

Example of the change:

# before
gh pr diff "$PR_NUMBER" --repo $EXPR_GITHUB_REPOSITORY
geo audit --url https://github.com/${{ github.repository }} --format json

# after
gh pr diff "$PR_NUMBER" --repo "$EXPR_GITHUB_REPOSITORY"
geo audit --url "https://github.com/${{ github.repository }}" --format json

Fixes [static-analysis] Report - 2026-07-29 #48779

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-07-29T08:21:23Z

      - name: Audit README via GitHub repository page
        run: |
-          geo audit --url https://github.com/${{ github.repository }} --format json \
+          geo audit --url "https://github.com/${{ github.repository }}" --format json \


@copilot always use env vars

Addressed in 19a6797.

pelikhan · 2026-07-29T08:21:49Z

 	assert.Contains(t, text, "pr-data-head-sha.txt", "Shared PR prefetch should persist head SHA marker")
 	assert.Contains(t, text, "--json number,title,body,headRefName,headRefOid,additions,deletions,changedFiles,files", "Shared PR prefetch should capture head SHA in metadata")
 	assert.Contains(t, text, "Cache hit: using pre-fetched PR data for head", "Shared PR prefetch should verify cache by current head SHA")
+	assert.Contains(t, text, `gh pr diff "$PR_NUMBER" --repo "$EXPR_GITHUB_REPOSITORY"`, "Shared PR prefetch should quote repository on gh pr diff")


@copilot delete this test file

Removed my changes from this test file in 19a6797.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-07-29T08:39:08Z

✅ PR Code Quality Reviewer completed the code quality review.

github-actions · 2026-07-29T08:39:15Z

✅ Design Decision Gate 🏗️ completed the design decision gate check.

No ADR enforcement needed: PR #48798 does not have the 'implementation' label and has 0 new lines of code in business logic directories (threshold: 100).

github-actions · 2026-07-29T08:39:27Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

Copilot

Pull request overview

Quotes repository-related shell expansions to resolve SC2086 findings in generated workflows.

Changes:

Quotes shared PR-prefetch repository arguments.
Introduces a quoted GEO repository URL environment variable.
Regenerates affected workflow lock files.

Show a summary per file

File	Description
`.github/workflows/shared/pr-diff-data-fetch.md`	Quotes `gh pr` repository arguments.
`.github/workflows/pr-code-quality-reviewer.lock.yml`	Regenerates shared prefetch logic.
`.github/workflows/mattpocock-skills-reviewer.lock.yml`	Regenerates shared prefetch logic.
`.github/workflows/impeccable-skills-reviewer.lock.yml`	Regenerates shared prefetch logic.
`.github/workflows/daily-geo-optimizer.md`	Safely supplies the GEO audit repository URL.
`.github/workflows/daily-geo-optimizer.lock.yml`	Regenerates the GEO optimizer workflow.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 6/6 changed files
Comments generated: 2
Review effort level: Medium

      - name: Audit README via GitHub repository page
        run: |
-          geo audit --url https://github.com/${{ github.repository }} --format json \
+          geo audit --url "$REPOSITORY_URL" --format json \


        echo "Cache hit: using pre-fetched PR data for head ${CURRENT_HEAD_SHA} (${LINES} diff lines, ${COMMENT_COUNT} review comments)"
      else
-        { gh pr diff "$PR_NUMBER" --repo $EXPR_GITHUB_REPOSITORY \
+        { gh pr diff "$PR_NUMBER" --repo "$EXPR_GITHUB_REPOSITORY" \


github-actions · 2026-07-29T08:40:49Z

✅ Test Quality Sentinel completed test quality analysis.

No test files were added or modified in this PR. Test Quality Sentinel skipped.

github-actions

Review: Quoting fixes for SC2086

Clean, mechanical fix. Verified the shared pr-diff-data-fetch.md quoting changes are correctly propagated into all three dependent lock files, and the geo-optimizer job-level REPOSITORY_URL env var change is consistent with the new os.environ["REPOSITORY_URL"]/os.environ["GITHUB_REPOSITORY"] usage in the Python heredoc.

Notes

GITHUB_REPOSITORY is a GitHub Actions default env var, always present at runtime, so bare dict access is safe.
REPOSITORY_URL is declared at job level, correctly threading through to the later Python step.
No correctness, security, or performance regressions found in the changed lines. No blocking issues.

🔎 Code quality review by PR Code Quality Reviewer · sonnet50 · 20.4 AIC · ⌖ 7.04 AIC · ⊞ 7.5K
_{Comment /review to run again}

github-actions

Skills-Based Review

Applied /codebase-design - changes are focused, consistent, and correct.

Root cause fixed in the shared source (pr-diff-data-fetch.md) so all three consumer lock files update correctly. The daily-geo-optimizer.md correctly uses an env block and os.environ access - the right pattern for passing GitHub context values. Lock files regenerated in sync. No blocking issues found.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · sonnet46 · 25.1 AIC · ⌖ 4.75 AIC · ⊞ 6.8K
_{Comment /matt to run again}

github-actions

The SC2086 fixes look correct and complete.

The REPOSITORY_URL env-var pattern in daily-geo-optimizer.md is the right approach: Actions expressions (${{ }}) cannot be double-quoted directly in shell, so hoisting the value into an env var and quoting "$REPOSITORY_URL" is idiomatic and safe.
Quoting "$EXPR_GITHUB_REPOSITORY" in the shared PR-prefetch fragment fixes the remaining ShellCheck findings without any behavioural change.
Lock files are correctly regenerated from the updated shared fragment.

🧵 Reviewed using Impeccable skills by Impeccable Skills Reviewer · sonnet46 · 22.3 AIC · ⌖ 5.85 AIC · ⊞ 5.1K

github-actions · 2026-07-29T10:46:50Z

🎉 This pull request is included in a new release.

Release: v0.83.5

Initial plan

149d78d

Copilot AI assigned Copilot and pelikhan Jul 29, 2026

Copilot started work on behalf of pelikhan July 29, 2026 07:39 View session

Copilot AI linked an issue Jul 29, 2026 that may be closed by this pull request

[static-analysis] Report - 2026-07-29 #48779

Closed

6 tasks

fix: quote workflow shell repository expansions

e9ab728

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Update static analysis findings for 2026-07-29~~ Quote workflow shell repository expansions to clear SC2086 findings Jul 29, 2026

Copilot AI requested a review from pelikhan July 29, 2026 07:58

Copilot finished work on behalf of pelikhan July 29, 2026 07:58

pelikhan reviewed Jul 29, 2026

View reviewed changes

Copilot started work on behalf of pelikhan July 29, 2026 08:22 View session

Use env var for geo audit repo URL

19a6797

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan marked this pull request as ready for review July 29, 2026 08:36

Copilot AI review requested due to automatic review settings July 29, 2026 08:36

Copilot started reviewing on behalf of pelikhan July 29, 2026 08:37 View session

Copilot finished work on behalf of pelikhan July 29, 2026 08:37

Copilot AI requested a review from pelikhan July 29, 2026 08:37

Copilot AI reviewed Jul 29, 2026

View reviewed changes

github-actions Bot reviewed Jul 29, 2026

View reviewed changes

github-actions Bot approved these changes Jul 29, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jul 29, 2026

[aw] No-Op Runs #43499

Closed

pelikhan merged commit fc2942a into main Jul 29, 2026
41 of 42 checks passed

pelikhan deleted the copilot/static-analysis-report-2026-07-29 branch July 29, 2026 08:50

github-actions Bot mentioned this pull request Jul 29, 2026

Smoke Test: MAI-Code-1-Flash - 30448364948 #48855

Closed

Uh oh!

Conversation

Copilot AI commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pelikhan Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 29, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

github-actions Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Review: Quoting fixes for SC2086

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jul 29, 2026 •

edited

Loading

github-actions Bot commented Jul 29, 2026 •

edited

Loading

github-actions Bot commented Jul 29, 2026 •

edited

Loading

github-actions Bot commented Jul 29, 2026 •

edited

Loading

github-actions Bot commented Jul 29, 2026 •

edited

Loading