From de204db539eba79930e0975a0e0c36744e8666e7 Mon Sep 17 00:00:00 2001 From: m3taversal Date: Tue, 28 Apr 2026 13:07:50 +0100 Subject: [PATCH] fix(sync-mirror): tighten gh-pr-* regex + document SQL-integer-safety MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ganymede review nit on commit 1eb259d: - Regex changed from [0-9]* (zero-or-more) to [0-9][0-9]* (one-or-more, portable BRE form of [0-9]+ that works on both GNU and BSD sed). - Empty/non-numeric branches now fail at parse, not just at the empty-guard below — SQL-integer-safety load-bearing on the regex alone. - Comment above the UPDATE notes the integer-validation invariants (INTEGER `number` column + regex-validated gh_pr_num) since bash sqlite3 has no parametric binding. Smoke tested: gh-pr-/foo, gh-pr-abc/foo no longer parse to non-empty. gh-pr-90/main, gh-pr-4066/contrib/x, gh-pr-1/x all parse correctly. Co-Authored-By: Claude Opus 4.7 (1M context) --- deploy/sync-mirror.sh | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/deploy/sync-mirror.sh b/deploy/sync-mirror.sh index 15c9cdd..7b3a4e2 100755 --- a/deploy/sync-mirror.sh +++ b/deploy/sync-mirror.sh @@ -378,8 +378,15 @@ if [ -f "$PIPELINE_DB" ]; then sqlite3 -separator '|' "$PIPELINE_DB" \ "SELECT number, branch FROM prs WHERE branch LIKE 'gh-pr-%' AND github_pr IS NULL;" \ 2>/dev/null | while IFS='|' read -r pr_num branch; do - gh_pr_num=$(echo "$branch" | sed -n 's|^gh-pr-\([0-9]*\)/.*|\1|p') + # Regex requires >=1 digit — empty/non-numeric branches fail to parse here, + # not just at the empty-guard below. Keeps SQL-integer-safety load-bearing + # on the regex alone. [0-9][0-9]* is the portable BRE form of [0-9]+, + # works on both GNU sed (VPS) and BSD sed (dev macs). + gh_pr_num=$(echo "$branch" | sed -n 's|^gh-pr-\([0-9][0-9]*\)/.*|\1|p') [ -z "$gh_pr_num" ] && continue + # Both interpolated values are integer-validated upstream (pr_num from + # INTEGER `number` column, gh_pr_num from regex above). No parametric + # binding available in bash sqlite3 — safety relies on those invariants. if sqlite3 "$PIPELINE_DB" \ "UPDATE prs SET github_pr = $gh_pr_num, source_channel = 'github' WHERE number = $pr_num;" \ 2>/dev/null; then