Harden setup JavaScript input and I/O boundaries

actions/setup/js/add_reaction_and_edit_comment.cjs

@@ -28,9 +28,24 @@ function expectRestEndpoint(endpoint, endpointName, eventName) {
   if (!isRestEndpoint(endpoint)) {
     throw new Error(`${ERR_VALIDATION}: Unexpected ${endpointName} endpoint shape for event: ${eventName}`);
   }
+
   return endpoint;
 }
 
+/**
+ * @param {string} endpoint
+ * @param {"discussion"|"discussion_comment"} eventName
+ * @returns {number}
+ */
+function parseDiscussionEndpoint(endpoint, eventName) {
+  const match = endpoint.match(eventName === "discussion" ? /^discussion:([1-9]\d*)$/ : /^discussion_comment:([1-9]\d*):[1-9]\d*$/);
+  const discussionNumber = Number(match?.[1]);
+  if (!Number.isSafeInteger(discussionNumber)) {
+    throw new Error(`${ERR_VALIDATION}: Invalid discussion endpoint: ${endpoint}`);
+  }
+  return discussionNumber;
+}
+
 /**
  * Resolve the reaction and comment API endpoints for a given event.
  * Returns null (after calling core.setFailed) when the event or payload is invalid.
@@ -262,8 +277,7 @@ async function addCommentWithWorkflowLink(endpoint, runUrl, eventName, invocatio
       if (typeof endpoint !== "string") {
         throw new Error(`${ERR_VALIDATION}: Unexpected comment endpoint shape for event: ${eventName}`);
       }
-      // Parse discussion number from special format: "discussion:NUMBER" or "discussion_comment:NUMBER:COMMENT_ID"
-      const discussionNumber = parseInt(endpoint.split(":")[1], 10);
+      const discussionNumber = parseDiscussionEndpoint(endpoint, eventName);
       const discussionId = await getDiscussionNodeId(eventRepo.owner, eventRepo.repo, discussionNumber);
       // For discussion_comment events, thread the reply under the triggering comment.
       // GitHub Discussions only supports two nesting levels, so resolve the top-level parent node ID.
@@ -291,4 +305,4 @@ async function addCommentWithWorkflowLink(endpoint, runUrl, eventName, invocatio
   }
 }
 
-module.exports = { main, addCommentWithWorkflowLink, resolveEventEndpoints, VALID_REACTIONS, addReaction, addDiscussionReaction, expectRestEndpoint };
+module.exports = { main, addCommentWithWorkflowLink, resolveEventEndpoints, VALID_REACTIONS, addReaction, addDiscussionReaction, expectRestEndpoint, parseDiscussionEndpoint };

actions/setup/js/add_reaction_and_edit_comment.test.cjs

@@ -38,8 +38,8 @@ global.context = mockContext;
 
 // Helper to import the module fresh (bust module cache)
 async function loadModule() {
-  const { main, addCommentWithWorkflowLink, addReaction, addDiscussionReaction, resolveEventEndpoints, VALID_REACTIONS, expectRestEndpoint } = await import("./add_reaction_and_edit_comment.cjs?" + Date.now());
-  return { main, addCommentWithWorkflowLink, addReaction, addDiscussionReaction, resolveEventEndpoints, VALID_REACTIONS, expectRestEndpoint };
+  const { main, addCommentWithWorkflowLink, addReaction, addDiscussionReaction, resolveEventEndpoints, VALID_REACTIONS, expectRestEndpoint, parseDiscussionEndpoint } = await import("./add_reaction_and_edit_comment.cjs?" + Date.now());
+  return { main, addCommentWithWorkflowLink, addReaction, addDiscussionReaction, resolveEventEndpoints, VALID_REACTIONS, expectRestEndpoint, parseDiscussionEndpoint };
 }
 
 describe("add_reaction_and_edit_comment.cjs", () => {
@@ -72,6 +72,17 @@ describe("add_reaction_and_edit_comment.cjs", () => {
     });
   });
 
+  describe("discussion endpoint validation", () => {
+    it("rejects malformed and non-positive discussion endpoint numbers", async () => {
+      const { parseDiscussionEndpoint } = await loadModule();
+
+      for (const endpoint of ["discussion:5junk", "discussion:0", "discussion:5:extra"]) {
+        expect(() => parseDiscussionEndpoint(endpoint, "discussion")).toThrow("Invalid discussion endpoint");
+      }
+      expect(() => parseDiscussionEndpoint("discussion_comment:5:2junk", "discussion_comment")).toThrow("Invalid discussion endpoint");
+    });
+  });
+
   describe("Issue reactions", () => {
     it("should add reaction to issue successfully", async () => {
       process.env.GH_AW_REACTION = "eyes";

actions/setup/js/add_workflow_run_comment.cjs

@@ -53,6 +53,7 @@ function setCommentOutputs(commentId, commentUrl, eventRepo = context.repo, opti
   } else {
     core.info(`Successfully created comment with workflow link`);
   }
+
   core.info(`Comment ID: ${commentId}`);
   core.info(`Comment URL: ${commentUrl}`);
   core.info(`Comment Repo: ${eventRepo.owner}/${eventRepo.repo}`);
@@ -66,6 +67,20 @@ function setCommentOutputs(commentId, commentUrl, eventRepo = context.repo, opti
   };
 }
 
+/**
+ * @param {string} endpoint
+ * @param {"discussion"|"discussion_comment"} eventName
+ * @returns {number}
+ */
+function parseDiscussionEndpoint(endpoint, eventName) {
+  const match = endpoint.match(eventName === "discussion" ? /^discussion:([1-9]\d*)$/ : /^discussion_comment:([1-9]\d*):[1-9]\d*$/);
+  const discussionNumber = Number(match?.[1]);
+  if (!Number.isSafeInteger(discussionNumber)) {
+    throw new Error(`${ERR_VALIDATION}: Invalid discussion endpoint: ${endpoint}`);
+  }
+  return discussionNumber;
+}
+
 /**
  * @param {unknown} value
  * @returns {Record<string, any>|null}
@@ -418,17 +433,15 @@ async function addCommentWithWorkflowLink(endpoint, runUrl, eventName, invocatio
     if (typeof endpoint !== "string") {
       throw new Error(`${ERR_VALIDATION}: Unexpected comment endpoint shape for event: ${eventName}`);
     }
-    // Parse discussion number from special format: "discussion:NUMBER"
-    const discussionNumber = parseInt(endpoint.split(":")[1], 10);
+    const discussionNumber = parseDiscussionEndpoint(endpoint, eventName);
     return postDiscussionComment(discussionNumber, commentBody, null, eventRepo);
   }
 
   if (eventName === "discussion_comment") {
     if (typeof endpoint !== "string") {
       throw new Error(`${ERR_VALIDATION}: Unexpected comment endpoint shape for event: ${eventName}`);
     }
-    // Parse discussion number from special format: "discussion_comment:NUMBER:COMMENT_ID"
-    const discussionNumber = parseInt(endpoint.split(":")[1], 10);
+    const discussionNumber = parseDiscussionEndpoint(endpoint, eventName);
 
     // GitHub Discussions only supports two nesting levels, so resolve the top-level parent's node ID
     const commentNodeId = await resolveTopLevelDiscussionCommentId(github, eventPayload?.comment?.node_id);
@@ -449,4 +462,4 @@ async function addCommentWithWorkflowLink(endpoint, runUrl, eventName, invocatio
   return setCommentOutputs(createResponse.data.id, createResponse.data.html_url, eventRepo);
 }
 
-module.exports = { main, addCommentWithWorkflowLink, buildCommentBody, postDiscussionComment, createOrReuseStatusComment };
+module.exports = { main, addCommentWithWorkflowLink, buildCommentBody, postDiscussionComment, createOrReuseStatusComment, parseDiscussionEndpoint };

actions/setup/js/add_workflow_run_comment.test.cjs

@@ -102,6 +102,17 @@ describe("add_workflow_run_comment", () => {
     return import("./add_workflow_run_comment.cjs?test=" + importCounter);
   }
 
+  describe("discussion endpoint validation", () => {
+    it("rejects malformed and non-positive discussion endpoint numbers", async () => {
+      const { parseDiscussionEndpoint } = await importAddWorkflowRunComment();
+
+      for (const endpoint of ["discussion:12junk", "discussion:0", "discussion:12:extra"]) {
+        expect(() => parseDiscussionEndpoint(endpoint, "discussion")).toThrow("Invalid discussion endpoint");
+      }
+      expect(() => parseDiscussionEndpoint("discussion_comment:5junk:2", "discussion_comment")).toThrow("Invalid discussion endpoint");
+    });
+  });
+
   // Helper function to run the script
   async function runScript() {
     const { main } = await importAddWorkflowRunComment();

actions/setup/js/artifact_client.cjs

@@ -33,6 +33,30 @@ function sleep(ms) {
   return new Promise(resolve => setTimeout(resolve, ms));
 }
 
+async function readResponseText(response, context) {
+  try {
+    return await response.text();
+  } catch (error) {
+    throw new Error(`failed to read ${context} response body: ${getErrorMessage(error)}`, { cause: error });
+  }
+}
+
+async function readResponseJSON(response, context) {
+  try {
+    return await response.json();
+  } catch (error) {
+    throw new Error(`failed to parse ${context} response body: ${getErrorMessage(error)}`, { cause: error });
+  }
+}
+
+function makeTempDir(prefix) {
+  try {
+    return fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+  } catch (error) {
+    throw new Error(`failed to create temporary directory for ${prefix}: ${getErrorMessage(error)}`, { cause: error });
+  }
+}
+
 function parseURL(url, base, errorMessage) {
   try {
     return base === undefined ? new URL(url) : new URL(url, base);
@@ -108,10 +132,10 @@ async function twirpRequest(method, body) {
       });
 
       if (response.ok) {
-        return await response.json();
+        return await readResponseJSON(response, `artifact twirp ${method}`);
       }
 
-      const responseBody = await response.text();
+      const responseBody = await readResponseText(response, `artifact twirp ${method}`);
       const retryable = response.status >= 500 || response.status === 429;
       if (!retryable || attempt === DEFAULT_RETRY_ATTEMPTS) {
         throw new Error(`artifact twirp ${method} failed (${response.status}): ${responseBody || response.statusText}`);
@@ -238,7 +262,7 @@ async function uploadFileToSignedURL(filePath, signedUploadURL, contentType) {
     throw new Error(`artifact blob upload failed: ${getErrorMessage(err)}`, { cause: err });
   }
   if (!response.ok) {
-    const body = await response.text();
+    const body = await readResponseText(response, "artifact blob upload");
     throw new Error(`artifact blob upload failed (${response.status}): ${body || response.statusText}`);
   }
   return stats.size;
@@ -293,10 +317,10 @@ class DefaultArtifactClient {
         throw new Error(`failed to list artifacts: ${getErrorMessage(err)}`, { cause: err });
       }
       if (!response.ok) {
-        throw new Error(`failed to list artifacts (${response.status}): ${await response.text()}`);
+        throw new Error(`failed to list artifacts (${response.status}): ${await readResponseText(response, "list artifacts")}`);
       }
       /** @type {any} */
-      const payload = await response.json();
+      const payload = await readResponseJSON(response, "list artifacts");
       const pageArtifacts = Array.isArray(payload?.artifacts) ? payload.artifacts : [];
       for (const item of pageArtifacts) {
         artifacts.push({
@@ -372,7 +396,7 @@ class DefaultArtifactClient {
     const zipLike = isZipResponse(location, contentType);
     if (zipLike && !options.skipDecompress) {
       ensureUnzipAvailable();
-      const tempDownloadDir = fs.mkdtempSync(path.join(os.tmpdir(), "gh-aw-artifact-download-"));
+      const tempDownloadDir = makeTempDir("gh-aw-artifact-download-");
       const tempZip = path.join(tempDownloadDir, "artifact.zip");
       try {
         digest = await streamToFile(blobResponse, tempZip);
@@ -420,7 +444,7 @@ class DefaultArtifactClient {
       uploadPath = files[0];
       contentType = "application/octet-stream";
     } else {
-      tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "gh-aw-artifact-upload-"));
+      tmpDir = makeTempDir("gh-aw-artifact-upload-");
       uploadPath = path.join(tmpDir, `${artifactName || "artifact"}.zip`);
       createZipFromFiles(files, rootDirectory, uploadPath);
     }

actions/setup/js/awf_reflect.cjs

@@ -748,7 +748,12 @@ function endpointBaseUrl(endpoint) {
  * @returns {string}
  */
 function deriveBaseUrlFromModelsURL(modelsUrl, env = process.env, readFileSync = fs.readFileSync) {
-  const parsed = new URL(modelsUrl);
+  let parsed;
+  try {
+    parsed = new URL(modelsUrl);
+  } catch (error) {
+    throw new Error(`Invalid models URL: ${modelsUrl}`, { cause: error });
+  }
   const basePath = parsed.pathname.replace(/\/models\/?$/i, "");
   return rewriteAPIProxyURLForHostBridge(`${parsed.origin}${basePath}`, env, readFileSync);
 }

actions/setup/js/check_daily_aic_workflow_guardrail.cjs

@@ -277,7 +277,12 @@ async function getRunAIC(artifactClient, runId, token, owner, repo) {
     artifactId: artifact.id,
     artifactName: artifact.name,
   });
-  const downloadRoot = fs.mkdtempSync(path.join(os.tmpdir(), `gh-aw-daily-guardrail-${runId}-`));
+  let downloadRoot;
+  try {
+    downloadRoot = fs.mkdtempSync(path.join(os.tmpdir(), `gh-aw-daily-guardrail-${runId}-`));
+  } catch (error) {
+    throw new Error(`Failed to create temporary artifact directory for run ${runId}: ${getErrorMessage(error)}`, { cause: error });
+  }
   const download = await artifactClient.downloadArtifact(artifact.id, {
     path: downloadRoot,
     findBy: {

actions/setup/js/check_rate_limit.cjs

@@ -43,8 +43,11 @@ async function main() {
 
   // Get configuration from environment variables
   // Use .trim() + || so that empty/whitespace-only values also fall back to defaults
-  const maxRuns = parseInt(process.env.GH_AW_RATE_LIMIT_MAX?.trim() || "5", 10);
-  const windowMinutes = parseInt(process.env.GH_AW_RATE_LIMIT_WINDOW?.trim() || "60", 10);
+  const maxRuns = Number(process.env.GH_AW_RATE_LIMIT_MAX?.trim() || "5");
+  const windowMinutes = Number(process.env.GH_AW_RATE_LIMIT_WINDOW?.trim() || "60");
+  if (!Number.isFinite(maxRuns) || !Number.isSafeInteger(maxRuns) || maxRuns <= 0 || !Number.isFinite(windowMinutes) || !Number.isSafeInteger(windowMinutes) || windowMinutes <= 0) {
+    throw new Error("Rate limit maximum and window must be positive integers");
+  }
   const eventsList = process.env.GH_AW_RATE_LIMIT_EVENTS?.trim() || "";
   // Default: admin, maintain, and write roles are exempt from rate limiting
   const ignoredRolesList = process.env.GH_AW_RATE_LIMIT_IGNORED_ROLES?.trim() || "admin,maintain,write";
@@ -109,8 +112,8 @@ async function main() {
 
   // Calculate time threshold
   const windowMs = windowMinutes * 60 * 1000;
-  const thresholdTime = new Date(Date.now() - windowMs);
-  const thresholdISO = thresholdTime.toISOString();
+  const thresholdTimestamp = Date.now() - windowMs;
+  const thresholdISO = new Date(thresholdTimestamp).toISOString();
 
   core.info(`   Time window: runs created after ${thresholdISO}`);
 
@@ -158,7 +161,11 @@ async function main() {
 
         // Stop if run is older than the time window (runs are newest-first)
         const runCreatedAt = new Date(run.created_at);
-        if (runCreatedAt < thresholdTime) {
+        if (Number.isNaN(runCreatedAt.getTime())) {
+          core.warning(`Skipping run ${run.id} with invalid creation date`);
+          continue;
+        }
+        if (runCreatedAt.getTime() < thresholdTimestamp) {
           core.info(`   Stopping pagination - run ${run.id} created before threshold (${run.created_at})`);
           hasMore = false;
           break;

actions/setup/js/check_runs_helpers.cjs

@@ -40,7 +40,20 @@ function selectLatestRelevantChecks(checkRuns, options = {}) {
       continue;
     }
     const existing = latestByName.get(run.name);
-    if (!existing || new Date(run.started_at ?? 0) > new Date(existing.started_at ?? 0)) {
+    if (!existing) {
+      latestByName.set(run.name, run);
+      continue;
+    }
+    const runStartedAt = Date.parse(run.started_at ?? "");
+    const existingStartedAt = Date.parse(existing.started_at ?? "");
+    if (!Number.isFinite(runStartedAt)) {
+      continue;
+    }
+    if (!Number.isFinite(existingStartedAt)) {
+      latestByName.set(run.name, run);
+      continue;
+    }
+    if (runStartedAt > existingStartedAt) {
       latestByName.set(run.name, run);
     }
   }

actions/setup/js/check_runs_helpers.test.cjs

@@ -40,6 +40,14 @@ describe("check_runs_helpers", () => {
       expect(ci?.id).toBe(2);
     });
 
+    it("replaces an invalid timestamp with a valid later same-name run", () => {
+      const { relevant } = selectLatestRelevantChecks([
+        { id: 1, name: "CI", started_at: null, app: { slug: "github-actions" } },
+        { id: 2, name: "CI", started_at: "2024-01-02T00:00:00Z", app: { slug: "github-actions" } },
+      ]);
+      expect(relevant.find(r => r.name === "CI")?.id).toBe(2);
+    });
+
     it("excludes deployment checks and reports count", () => {
       const { relevant, deploymentCheckCount } = selectLatestRelevantChecks(runs);
       expect(relevant.every(r => r.app?.slug !== "github-deployments")).toBe(true);

actions/setup/js/create_prompt.cjs

@@ -28,7 +28,7 @@ function parseConfig(value) {
   try {
     parsed = JSON.parse(value);
   } catch (error) {
-    throw new Error(`${ERR_PARSE}: Invalid GH_AW_PROMPT_CONFIG: ${getErrorMessage(error)}`);
+    throw new Error(`${ERR_PARSE}: Invalid GH_AW_PROMPT_CONFIG: ${getErrorMessage(error)}`, { cause: error });
   }
   if (!parsed || !Array.isArray(parsed.items)) {
     throw new Error(`${ERR_CONFIG}: GH_AW_PROMPT_CONFIG must contain an items array`);
@@ -83,7 +83,11 @@ function writePromptFile(promptPath, content) {
   const fd = fs.openSync(promptPath, flags, 0o600);
   try {
     fs.fchmodSync(fd, 0o600);
-    fs.writeFileSync(fd, content, "utf8");
+    try {
+      fs.writeFileSync(fd, content, "utf8");
+    } catch (error) {
+      throw new Error(`${ERR_SYSTEM}: Failed to write prompt file ${promptPath}: ${getErrorMessage(error)}`, { cause: error });
+    }
   } finally {
     fs.closeSync(fd);
   }
@@ -131,7 +135,7 @@ function renderPrompt(config, env, promptsDir) {
     try {
       result += fs.readFileSync(promptFile, "utf8");
     } catch (error) {
-      throw new Error(`${ERR_SYSTEM}: Failed to read prompt file: ${getErrorMessage(error)}`);
+      throw new Error(`${ERR_SYSTEM}: Failed to read prompt file: ${getErrorMessage(error)}`, { cause: error });
     }
   }
 

actions/setup/js/data_schema_normalizer.cjs

@@ -152,7 +152,12 @@ function resolveDataSchema(rawSchema, path) {
     return normalized;
   }
   if (typeof rawSchema === "string") {
-    const parsed = JSON.parse(rawSchema);
+    let parsed;
+    try {
+      parsed = JSON.parse(rawSchema);
+    } catch (error) {
+      throw new Error(`${path}: invalid JSON schema`, { cause: error });
+    }
     if (!isPlainObject(parsed)) {
       throw new Error(`${path}: string JSON must decode to an object schema`);
     }

actions/setup/js/evaluate_outcomes.cjs

@@ -1222,7 +1222,12 @@ function isOnOrAfter(timestamp, threshold) {
   if (!threshold) return true;
   const a = Date.parse(timestamp);
   const b = Date.parse(threshold);
-  if (!Number.isFinite(a) || !Number.isFinite(b)) return false;
+  if (!Number.isFinite(a)) {
+    return false;
+  }
+  if (!Number.isFinite(b)) {
+    return false;
+  }
   return a >= b;
 }