Skip to content

TEST: testing code coverage failure for forked PRs / external contributors #374

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
gargsaumya wants to merge 4 commits into from
Closed

TEST: testing code coverage failure for forked PRs / external contributors #374

gargsaumya wants to merge 4 commits into from

Conversation

@gargsaumya
Copy link
Contributor

@gargsaumya gargsaumya commented Dec 16, 2025 •
edited by azure-boards bot
Loading

Work Item / Issue Reference

AB#40910

GitHub Issue: #<ISSUE_NUMBER>

Summary

This pull request introduces a simple test message to verify the setup in main.py. It does not make any functional changes to the application logic.

  • Added print statements to confirm logging setup and indicate this is a test pull request for mssql-python.

Copilot AI review requested due to automatic review settings December 16, 2025 04:21
Copilot AI reviewed Dec 16, 2025
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request is a test change designed to verify code coverage reporting functionality for forked PRs and external contributors. It adds two informational print statements to the main.py sample script without affecting any functional behavior of the mssql-python library.

  • Adds print statements after logging setup to indicate the test nature of the change
  • No changes to library code, tests, or documentation

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-advanced-security[bot]
github-advanced-security bot found potential problems Dec 16, 2025
View reviewed changes
.github/workflows/post-coverage-comment.yml
Comment on lines +29 to +62
run: |
if [[ ! -f pr-info.json ]]; then
echo "❌ pr-info.json not found"
exit 1
fi

cat pr-info.json

# Extract values from JSON
PR_NUMBER=$(jq -r '.pr_number' pr-info.json)
COVERAGE_PCT=$(jq -r '.coverage_percentage' pr-info.json)
COVERED_LINES=$(jq -r '.covered_lines' pr-info.json)
TOTAL_LINES=$(jq -r '.total_lines' pr-info.json)
PATCH_PCT=$(jq -r '.patch_coverage_pct' pr-info.json)
LOW_COV_FILES=$(jq -r '.low_coverage_files' pr-info.json)
PATCH_SUMMARY=$(jq -r '.patch_coverage_summary' pr-info.json)
ADO_URL=$(jq -r '.ado_url' pr-info.json)

# Export to env for next step
echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
echo "COVERAGE_PERCENTAGE=$COVERAGE_PCT" >> $GITHUB_ENV
echo "COVERED_LINES=$COVERED_LINES" >> $GITHUB_ENV
echo "TOTAL_LINES=$TOTAL_LINES" >> $GITHUB_ENV
echo "PATCH_COVERAGE_PCT=$PATCH_PCT" >> $GITHUB_ENV
echo "ADO_URL=$ADO_URL" >> $GITHUB_ENV

# Handle multiline values
echo "LOW_COVERAGE_FILES<<EOF" >> $GITHUB_ENV
echo "$LOW_COV_FILES" >> $GITHUB_ENV
echo "EOF" >> $GITHUB_ENV

echo "PATCH_COVERAGE_SUMMARY<<EOF" >> $GITHUB_ENV
echo "$PATCH_SUMMARY" >> $GITHUB_ENV
echo "EOF" >> $GITHUB_ENV

Check failure

Code scanning / CodeQL

Environment variable built from user-controlled sources Critical

Potential environment variable injection in [if \[\[ ! -f pr-info.json \]\]; then
echo "❌ pr-info.json not found"
exit 1
fi cat pr-info.json Extract values from JSON PR_NUMBER=$(jq -r '.pr_number' pr-info.json)
COVERAGE_PCT=$(jq -r '.coverage_percentage' pr-info.json)
COVERED_LINES=$(jq -r '.covered_lines' pr-info.json)
TOTAL_LINES=$(jq -r '.total_lines' pr-info.json)
PATCH_PCT=$(jq -r '.patch_coverage_pct' pr-info.json)
LOW_COV_FILES=$(jq -r '.low_coverage_files' pr-info.json)
PATCH_SUMMARY=$(jq -r '.patch_coverage_summary' pr-info.json)
ADO_URL=$(jq -r '.ado_url' pr-info.json) Export to env for next step echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
echo "COVERAGE_PERCENTAGE=$COVERAGE_PCT" >> $GITHUB_ENV
echo "COVERED_LINES=$COVERED_LINES" >> $GITHUB_ENV
echo "TOTAL_LINES=$TOTAL_LINES" >> $GITHUB_ENV
echo "PATCH_COVERAGE_PCT=$PATCH_PCT" >> $GITHUB_ENV
echo "ADO_URL=$ADO_URL" >> $GITHUB_ENV Handle multiline values echo "LOW_COVERAGE_FILES<<EOF" >> $GITHUB_ENV
echo "$LOW_COV_FILES" >> $GITHUB_ENV
echo "EOF" >> $GITHUB_ENV echo "PATCH_COVERAGE_SUMMARY<<EOF" >> $GITHUB_ENV
echo "$PATCH_SUMMARY" >> $GITHUB_ENV
echo "EOF" >> $GITHUB_ENV](1), which may be controlled by an external user (
workflow_run
Loading
).

Copilot Autofix

AI 15 days ago

In general:
Scrub and validate all inputs taken from untrusted sources before writing them as environment variables via $GITHUB_ENV. This involves:

  • For single-line variables: Strip newlines and, optionally, enforce an allowlist pattern.
  • For multi-line values: Generate a unique delimiter to reduce the chance of injection, and if possible, also validate or escape user-provided values to prevent them containing the delimiter.

Detailed fix for this code:

  • For single-line variables (PR_NUMBER, COVERAGE_PCT, etc.), sanitize the values to remove any newlines or dangerous characters. Use tr -d '\n' or similar to strip newlines.
  • For multi-line environment variables (LOW_COV_FILES, PATCH_SUMMARY), use a random, unique delimiter for the heredoc (e.g., EOF_<uuid> or derived from uuidgen). Ensure that the delimiter is unique and unlikely to appear in the injected data. This prevents attackers from prematurely closing the heredoc via injected newlines.
  • Optional: For critical integer fields (PR_NUMBER and line counts), consider restricting to only digits via pattern matching.
  • The changes are all in the "Read coverage data" run block in the YAML. No new packages are needed.
  • Minimal posix utilities (e.g., tr, uuidgen) are available in ubuntu-latest runners.
Suggested changeset 1
.github/workflows/post-coverage-comment.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/post-coverage-comment.yml b/.github/workflows/post-coverage-comment.yml
--- a/.github/workflows/post-coverage-comment.yml
+++ b/.github/workflows/post-coverage-comment.yml
@@ -35,16 +35,16 @@
           cat pr-info.json
           
           # Extract values from JSON
-          PR_NUMBER=$(jq -r '.pr_number' pr-info.json)
-          COVERAGE_PCT=$(jq -r '.coverage_percentage' pr-info.json)
-          COVERED_LINES=$(jq -r '.covered_lines' pr-info.json)
-          TOTAL_LINES=$(jq -r '.total_lines' pr-info.json)
-          PATCH_PCT=$(jq -r '.patch_coverage_pct' pr-info.json)
+          PR_NUMBER=$(jq -r '.pr_number' pr-info.json | tr -d '\n\r')
+          COVERAGE_PCT=$(jq -r '.coverage_percentage' pr-info.json | tr -d '\n\r')
+          COVERED_LINES=$(jq -r '.covered_lines' pr-info.json | tr -d '\n\r')
+          TOTAL_LINES=$(jq -r '.total_lines' pr-info.json | tr -d '\n\r')
+          PATCH_PCT=$(jq -r '.patch_coverage_pct' pr-info.json | tr -d '\n\r')
           LOW_COV_FILES=$(jq -r '.low_coverage_files' pr-info.json)
           PATCH_SUMMARY=$(jq -r '.patch_coverage_summary' pr-info.json)
-          ADO_URL=$(jq -r '.ado_url' pr-info.json)
+          ADO_URL=$(jq -r '.ado_url' pr-info.json | tr -d '\n\r')
           
-          # Export to env for next step
+          # Export to env for next step (sanitize values to avoid env var injection)
           echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
           echo "COVERAGE_PERCENTAGE=$COVERAGE_PCT" >> $GITHUB_ENV
           echo "COVERED_LINES=$COVERED_LINES" >> $GITHUB_ENV
@@ -52,14 +49,16 @@
           echo "PATCH_COVERAGE_PCT=$PATCH_PCT" >> $GITHUB_ENV
           echo "ADO_URL=$ADO_URL" >> $GITHUB_ENV
           
-          # Handle multiline values
-          echo "LOW_COVERAGE_FILES<<EOF" >> $GITHUB_ENV
+          # Handle multiline values SAFELY using unique delimiter
+          EOFF=$(uuidgen)
+          echo "LOW_COVERAGE_FILES<<EOF_$EOFF" >> $GITHUB_ENV
           echo "$LOW_COV_FILES" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
+          echo "EOF_$EOFF" >> $GITHUB_ENV
           
-          echo "PATCH_COVERAGE_SUMMARY<<EOF" >> $GITHUB_ENV
+          EOFS=$(uuidgen)
+          echo "PATCH_COVERAGE_SUMMARY<<EOF_$EOFS" >> $GITHUB_ENV
           echo "$PATCH_SUMMARY" >> $GITHUB_ENV
-          echo "EOF" >> $GITHUB_ENV
+          echo "EOF_$EOFS" >> $GITHUB_ENV
 
       - name: Comment coverage summary on PR
         uses: marocchino/sticky-pull-request-comment@v2
EOF
@@ -35,16 +35,16 @@
cat pr-info.json

# Extract values from JSON
PR_NUMBER=$(jq -r '.pr_number' pr-info.json)
COVERAGE_PCT=$(jq -r '.coverage_percentage' pr-info.json)
COVERED_LINES=$(jq -r '.covered_lines' pr-info.json)
TOTAL_LINES=$(jq -r '.total_lines' pr-info.json)
PATCH_PCT=$(jq -r '.patch_coverage_pct' pr-info.json)
PR_NUMBER=$(jq -r '.pr_number' pr-info.json | tr -d '\n\r')
COVERAGE_PCT=$(jq -r '.coverage_percentage' pr-info.json | tr -d '\n\r')
COVERED_LINES=$(jq -r '.covered_lines' pr-info.json | tr -d '\n\r')
TOTAL_LINES=$(jq -r '.total_lines' pr-info.json | tr -d '\n\r')
PATCH_PCT=$(jq -r '.patch_coverage_pct' pr-info.json | tr -d '\n\r')
LOW_COV_FILES=$(jq -r '.low_coverage_files' pr-info.json)
PATCH_SUMMARY=$(jq -r '.patch_coverage_summary' pr-info.json)
ADO_URL=$(jq -r '.ado_url' pr-info.json)
ADO_URL=$(jq -r '.ado_url' pr-info.json | tr -d '\n\r')

# Export to env for next step
# Export to env for next step (sanitize values to avoid env var injection)
echo "PR_NUMBER=$PR_NUMBER" >> $GITHUB_ENV
echo "COVERAGE_PERCENTAGE=$COVERAGE_PCT" >> $GITHUB_ENV
echo "COVERED_LINES=$COVERED_LINES" >> $GITHUB_ENV
@@ -52,14 +49,16 @@
echo "PATCH_COVERAGE_PCT=$PATCH_PCT" >> $GITHUB_ENV
echo "ADO_URL=$ADO_URL" >> $GITHUB_ENV

# Handle multiline values
echo "LOW_COVERAGE_FILES<<EOF" >> $GITHUB_ENV
# Handle multiline values SAFELY using unique delimiter
EOFF=$(uuidgen)
echo "LOW_COVERAGE_FILES<<EOF_$EOFF" >> $GITHUB_ENV
echo "$LOW_COV_FILES" >> $GITHUB_ENV
echo "EOF" >> $GITHUB_ENV
echo "EOF_$EOFF" >> $GITHUB_ENV

echo "PATCH_COVERAGE_SUMMARY<<EOF" >> $GITHUB_ENV
EOFS=$(uuidgen)
echo "PATCH_COVERAGE_SUMMARY<<EOF_$EOFS" >> $GITHUB_ENV
echo "$PATCH_SUMMARY" >> $GITHUB_ENV
echo "EOF" >> $GITHUB_ENV
echo "EOF_$EOFS" >> $GITHUB_ENV

- name: Comment coverage summary on PR
uses: marocchino/sticky-pull-request-comment@v2
Copilot is powered by AI and may make mistakes. Always verify output.
@gargsaumya gargsaumya closed this Dec 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@gargsaumya