[code-simplifier] refactor: dedupe mention-alias normalization and JSONL iteration helpers in safe-output scripts

actions/setup/js/add_comment.cjs

@@ -72,6 +72,16 @@ function normalizeWorkflowIdList(ids) {
   ];
 }
 
+/**
+ * Normalize a list of mention aliases: trim, strip leading "@" characters, and drop empty entries.
+ * @param {unknown} aliases
+ * @returns {string[]}
+ */
+function normalizeMentionAliases(aliases) {
+  if (!Array.isArray(aliases)) return [];
+  return aliases.map(alias => (typeof alias === "string" ? alias.trim().replace(/^@+/, "") : "")).filter(alias => alias.length > 0);
+}
+
 /**
  * Resolve effective event name/payload for native and forwarded contexts.
  * Supports:
@@ -408,10 +418,8 @@ async function main(config = {}) {
   const requiredLabels = Array.isArray(config.required_labels) ? config.required_labels : [];
   const requiredTitlePrefix = config.required_title_prefix || "";
   const mentionsDisabled = config.mentions === false || config.mentions?.enabled === false;
-  const preResolvedMentionAliases =
-    !mentionsDisabled && Array.isArray(config.allowedMentionAliases) ? config.allowedMentionAliases.map(alias => (typeof alias === "string" ? alias.trim().replace(/^@+/, "") : "")).filter(alias => alias.length > 0) : [];
-  const configuredMentionAliases =
-    !mentionsDisabled && Array.isArray(config.mentions?.allowed) ? config.mentions.allowed.map(alias => (typeof alias === "string" ? alias.trim().replace(/^@+/, "") : "")).filter(alias => alias.length > 0) : [];
+  const preResolvedMentionAliases = !mentionsDisabled ? normalizeMentionAliases(config.allowedMentionAliases) : [];
+  const configuredMentionAliases = !mentionsDisabled ? normalizeMentionAliases(config.mentions?.allowed) : [];
 
   // Create an authenticated GitHub client. Uses config["github-token"] when set
   // (for cross-repository operations), otherwise falls back to the step-level github.

actions/setup/js/add_reaction.cjs

@@ -30,7 +30,7 @@ async function main() {
   core.info(`Adding reaction: ${reaction}`);
 
   // Validate reaction type
-  if (!Object.prototype.hasOwnProperty.call(REACTION_MAP, reaction)) {
+  if (!Object.hasOwn(REACTION_MAP, reaction)) {
     core.setFailed(`${ERR_VALIDATION}: Invalid reaction type: ${reaction}. Valid reactions are: ${Object.keys(REACTION_MAP).join(", ")}`);
     return;
   }

actions/setup/js/add_reaction.test.cjs

@@ -107,6 +107,15 @@ describe("add_reaction", () => {
       expect(mockGithub.request).not.toHaveBeenCalled();
     });
 
+    it("should reject inherited property names as invalid reaction types", async () => {
+      process.env.GH_AW_REACTION = "constructor";
+
+      await runScript();
+
+      expect(mockCore.setFailed).toHaveBeenCalledWith(expect.stringContaining("Invalid reaction type"));
+      expect(mockGithub.request).not.toHaveBeenCalled();
+    });
+
     it("should accept all valid reaction types", async () => {
       const validReactions = ["+1", "-1", "laugh", "confused", "heart", "hooray", "rocket", "eyes"];
 

actions/setup/js/ai_credits_context.cjs

@@ -206,22 +206,7 @@ function parseAICreditsErrorInfoFromAuditEntry(entry) {
 function iterateAuditEntries(auditJsonlPathOverride, defaultValue, contentGuard, accumulate) {
   try {
     const auditJsonlPath = resolveFirewallAuditLogPath(auditJsonlPathOverride);
-    if (!fs.existsSync(auditJsonlPath)) return defaultValue;
-    const content = fs.readFileSync(auditJsonlPath, "utf8");
-    if (!content.trim()) return defaultValue;
-    if (contentGuard && !contentGuard(content)) return defaultValue;
-    let result = defaultValue;
-    for (const line of content.split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed || trimmed[0] !== "{") continue;
-      try {
-        const nextResult = accumulate(result, JSON.parse(trimmed));
-        if (nextResult !== undefined) result = nextResult;
-      } catch {
-        // ignore malformed lines
-      }
-    }
-    return result;
+    return iterateJSONLFiles([auditJsonlPath], defaultValue, contentGuard, accumulate);
   } catch {
     return defaultValue;
   }