fix(ci): stop splicing repo-health report content into github-script bodies

[bradygaster]

Closes #1770

Working as Booster (CI/CD Engineer).

Root cause

actions/github-script compiles its script: body with new AsyncFunction(...), so anything a workflow interpolates into that body via ${{ }} becomes JavaScript source, not data. All three repo-health reporters passed their scan output as output: `${{ steps.*.outputs.result }}` — a template literal. Security findings legitimately quote the offending code in backticks (scripts/security-review.mjs:212 emits Unsafe git operation: `git push --force-with-lease` …), so the first backtick in the report closed the literal and the remaining JSON was parsed as code, producing SyntaxError: Unexpected identifier 'git' (run 32392990636). The gate died with an opaque parse error and never posted the finding — indistinguishable from a clean run to anyone skimming, which is the worst possible failure mode for a security gate.

Sites fixed

Yes, the sibling reporters shared the bug — it was the same line in all three:

Workflow	Step	Shared the bug?
squad-repo-health.yml	Security Review → Comment on findings	✅ yes — fixed
squad-repo-health.yml	Architectural Review → Comment on findings	✅ yes — fixed
squad-repo-health.yml	Squad File Leakage → Comment on leakage	✅ yes — fixed
squad-impact.yml	Post impact report	Interpolated a PR number (integer, not attacker-shaped) — hardened anyway
squad-repo-health.yml	Bootstrap Protection, Diff Size Guard	❌ no — neither uses github-script; they only echo/::warning::
agentics-maintenance.yml	gh-aw generated	❌ no — only ${{ runner.temp }} in a require() path; generated file, left alone

I scanned every script: | block in .github/workflows/ for embedded ${{ }} to build that table, not just the reported job.

Fix is at the boundary, not at the message. Messages containing backticks are correct — quoting the offending code is the whole point. Report content now travels through the step environment and is read with process.env.REPO_HEALTH_OUTPUT, so payload text is never part of the parsed script:

env:
  REPO_HEALTH_OUTPUT: ${{ steps.security.outputs.result }}
with:
  script: |
    output: process.env.REPO_HEALTH_OUTPUT || '',

No escaping is involved, so there is no escape to get wrong.

Proof the test fails pre-fix

test/scripts/repo-health-comment-transport.test.ts reads the real workflow YAML, extracts each script: body and its env: map, applies GitHub Actions ${{ }} substitution exactly as the runner does, then compiles the result as an async function body (vm.compileFunction, matching github-script's new AsyncFunction) and runs it against the real scripts/repo-health-comment.mjs with a mocked Octokit. The payload messages contain a backtick pair, a bare ${, an apostrophe, a double quote, and an embedded newline.

Stashed the workflow fix, kept the test, ran it — red, with the exact production error:

 ❯ test/scripts/repo-health-comment-transport.test.ts (5 tests | 5 failed)
     × reports a security finding whose message contains backticks
     × reports an architectural finding whose message contains backticks
     × reports leaked squad files whose paths contain backticks
     × squad-repo-health.yml keeps all interpolation out of script bodies
     × squad-impact.yml keeps all interpolation out of script bodies

 FAIL  … > reports a security finding whose message contains backticks
SyntaxError: Unexpected identifier 'git'
 ❯ runWorkflowScript test/scripts/repo-health-comment-transport.test.ts:155:22

 FAIL  … > squad-repo-health.yml keeps all interpolation out of script bodies
AssertionError: expected [ 'Comment on leakage', …(2) ] to deeply equal []
- []
+ [ "Comment on leakage", "Comment on findings", "Comment on findings" ]

Restored the fix — 5 passed (5). The test asserts the finding text survives verbatim into the comment body, so it also catches a silently-mangled report, not just a crash.

Verification

$ git diff --cached --stat
 .github/workflows/squad-impact.yml                 |   4 +-
 .github/workflows/squad-repo-health.yml            |  17 +-
 test/scripts/repo-health-comment-transport.test.ts | 281 +++++++++++++++++++++
 3 files changed, 298 insertions(+), 4 deletions(-)

$ git diff --cached --diff-filter=D --name-only
(empty)

• npm run build — ✅ passes. Version/template churn from prebuild restored, not committed.
• npx vitest run test/scripts/ — 38 existing tests pass, plus the 5 new ones.
• npx eslint on the new test — clean.

Note on an unrelated pre-existing failure

test/scripts/check-changeset-drift.test.ts fails to load with SyntaxError: Invalid or unexpected token. I confirmed this reproduces on clean dev with my changes stashed, so it is not from this PR. Worth a separate issue.

No changeset — nothing under packages/*/src was touched.

---

Addendum: this PR reproduced its own bug in CI

Repo Health / Security Review — Permissions & Secrets was red on this PR, at the then-current head SHA, with:

##[error]Unhandled error: SyntaxError: Unexpected identifier 'git'
    at new AsyncFunction (<anonymous>)
    at callAsyncFunction (.../github-script/dist/index.js:64949:16)

That is #1770 — the exact error string, in the exact call frame — crashing on the pull request that fixes it.

Why, and why it is not a defect in the fix. squad-repo-health.yml runs on pull_request_target and deliberately checks out base-branch scripts (no ref: override on any of its four checkout steps). pull_request_target also takes the workflow definition from the base branch. So the workflow evaluating this PR is dev's copy — which still has the bug. This fix cannot take effect until it merges; it is structurally unverifiable in CI beforehand. The only pre-merge signal available is "the job didn't crash," which is precisely the weak signal that let #1770 live undetected in the first place. Filed separately as a permanent gotcha for this workflow family.

What actually triggered it — an accident worth more than the unit test. The test fixture quoted git push --force-with-lease as sample finding text. That is a real entry on security-review.mjs's unsafe-git denylist, and fixtures are added lines in the diff, so:

1. The scanner read this PR's diff and flagged the command in test/scripts/repo-health-comment-transport.test.ts — category unsafe-git, severity error.
2. It formatted the finding as Unsafe git operation: `git push --force-with-lease` — … — wrapping the command in backticks, exactly as designed.
3. That message was spliced as source into base dev's backtick template literal, closing it early.
4. SyntaxError: Unexpected identifier 'git'.

Nobody designed this. A fixture written to exercise backtick handling caused the production scanner to emit a backtick-wrapped finding that crashed the production reporter — a live, end-to-end reproduction of #1770 in CI, unprompted. It is better evidence than the unit test precisely because it was not constructed.

Resolution. The fixture now quotes a command the scanner does not flag. No finding is emitted, so nothing crashes. Every hostile character stays — the backticks, the bare ${, the apostrophe, the double quote, the embedded newline — because none of those are what the scanner objects to, and they are the entire point of the test. The gate itself is untouched: no ignore entry, no severity change, no path exclusion. All five repo-health reporters are now green.

[github-actions]

🟡 Impact Analysis — PR #1786

Risk tier: 🟡 MEDIUM

📊 Summary

Metric	Count
Files changed	3
Files added	1
Files modified	2
Files deleted	0
Modules touched	2

🎯 Risk Factors

• 3 files changed (≤5 → LOW)
• 2 modules touched (2-4 → MEDIUM)

📦 Modules Affected

ci-workflows (2 files)

• .github/workflows/squad-impact.yml
• .github/workflows/squad-repo-health.yml

tests (1 file)

• test/scripts/repo-health-comment-transport.test.ts

---

This report is generated automatically for every PR. See #733 for details.

[github-actions]

🏗️ Architectural Review

⚠️ Architectural review: 1 info.

Severity	Category	Finding	Files
ℹ️ info	template-sync	Template files changed in .github/workflows/ but not in other template locations. If these templates should stay in sync, consider updating the others too.	Changed: .github/workflows/, Unchanged: templates/, .squad-templates/, packages/squad-cli/templates/

---

Automated architectural review — informational only.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit f590d23

PR Scope: 🔧 Infrastructure

⚠️ 4 item(s) to address before review

Status	Check	Details
❌	Single commit	2 commits — consider squashing before review
✅	Not in draft	Ready for review
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	No source files changed — changeset not required
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
❌	Copilot threads resolved	2 unresolved Copilot thread(s) — fix and resolve before merging
❌	CI passing	1 check(s) failing: test

Files Changed (3 files, +304 −4)

File	+/−
.github/workflows/squad-impact.yml	+3 −1
.github/workflows/squad-repo-health.yml	+14 −3
test/scripts/repo-health-comment-transport.test.ts	+287 −0

Total: +304 −4

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[Copilot]

Pull request overview

This PR fixes a GitHub Actions actions/github-script failure mode where repo-health report content was interpolated into the JavaScript script: body (becoming JS source), causing syntax errors when findings include backticks / ${ (e.g. security findings quoting code). It moves report payloads to step environment variables so the script reads them as data, and adds a regression test that compiles/executes the real workflow script bodies the same way github-script does.

Changes:

• Update squad-repo-health.yml to pass reporter outputs via env (REPO_HEALTH_OUTPUT) and read process.env.REPO_HEALTH_OUTPUT in the github-script steps.
• Harden squad-impact.yml by passing PR number via env instead of interpolating it into the script: body.
• Add regression tests that load the real workflow YAML, simulate ${{ }} substitution, compile the resulting script, and assert hostile finding content survives verbatim.

Show a summary per file

File	Description
.github/workflows/squad-repo-health.yml	Stops embedding reporter output into github-script source; uses env var transport for leakage/architectural/security comment steps.
.github/workflows/squad-impact.yml	Removes workflow-expression interpolation from the github-script body by using an env-provided PR number.
test/scripts/repo-health-comment-transport.test.ts	Adds regression coverage that reproduces the pre-fix syntax error and asserts safe transport + verbatim comment content.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite