Skip to content
Draft
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 51 additions & 0 deletions .github/actions/check-pr-title-format/action.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
name: Validate PR title
description: Validate pull request title against a regex
inputs:
title:
description: Pull request title
required: true
pattern:
description: Regex pattern the PR title must match
required: true
error_message:
description: Custom error message
required: false
default: Pull request title does not match required format
runs:
using: composite
steps:
- name: Validate PR title
shell: bash
env:
TITLE: ${{ inputs.title }}
PATTERN: ${{ inputs.pattern }}
MESSAGE: ${{ inputs.error_message }}
run: |
title="$TITLE"
pattern="$PATTERN"
message="$MESSAGE"

echo "PR title: $title"
echo "Required pattern: $pattern"

if [ -z "$pattern" ]; then
echo "::error::Input 'pattern' must be a non-empty regular expression"
exit 1
fi
if printf '%s\n' "$title" | grep -Eq -- "$pattern"; then
echo "PR title is valid"
else
status=$?
case "$status" in
1)
echo "::error::$message"
;;
Comment on lines +40 to +42
Copy link

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow-command annotation echo "::error::$message" uses a free-form message without escaping. If the message contains characters like %, carriage returns, or newlines, it can break the annotation formatting and (in worst cases) enable workflow command injection. Escape the message per GitHub’s workflow command rules (e.g., replace %, \r, \n) or avoid passing unescaped user-provided text into ::error:: commands.

Copilot uses AI. Check for mistakes.
2)
echo "::error::Input 'pattern' is not a valid regular expression: $pattern"
;;
*)
echo "::error::Unexpected error while validating PR title"
;;
esac
exit 1
fi