Skip to content

Commit 6038011

Browse files
JSONboredJSONbored
authored
fix(submissions): harden intake comments and restore awesome badge
## Summary - harden submission risk comments so trust signals use safe code spans instead of numeric HTML entities - keep contributor identity rendering in the dedicated contributor section instead of duplicating analyzed handles in trust signals - restore the Mentioned in Awesome Claude Code badge through the README generator and regenerate README ## Validation - pnpm test:submission-intake - pnpm test - pnpm validate:issue-templates - pnpm validate:readme - pnpm generate:readme --check - actionlint .github/workflows/submission-pr-risk.yml .github/workflows/submission-issue-validation.yml - trunk check --ci --all ## Notes - CodeRabbit was bypassed because the status failed for insufficient review credits, not a code finding.
1 parent 85d36b8 commit 6038011

5 files changed

Lines changed: 56 additions & 56 deletions

File tree

‎.github/workflows/submission-pr-risk.yml‎

Lines changed: 18 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -99,15 +99,10 @@ jobs:
9999
/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?(?:\[bot\])?$/;
100100
const isGitHubLogin = (value) =>
101101
GITHUB_LOGIN_PATTERN.test(normalizeText(value));
102-
const neutralizeMarkdownControl = (value) =>
103-
normalizeText(value)
104-
.replace(/#(?=\d)/g, "#")
105-
.replace(/@/g, "@");
106102
const escapeMarkdownText = (value) =>
107-
neutralizeMarkdownControl(compactWhitespace(value)).replace(
108-
/([\\`*_{}\[\]()#+\-.!|>])/g,
109-
"\\$1"
110-
);
103+
compactWhitespace(value)
104+
.replace(/([\\`*_{}\[\]()#+\-.!|>])/g, "\\$1")
105+
.replace(/@/g, "\\@");
111106
const markdownCodeSpan = (value) => {
112107
const text = compactWhitespace(value).slice(0, 1000);
113108
if (!text) return "";
@@ -124,6 +119,19 @@ jobs:
124119
const detail = markdownCodeSpan(value);
125120
return detail ? ` - ${detail}` : "";
126121
};
122+
const markdownLabelValue = (value) => {
123+
const text = compactWhitespace(value);
124+
if (!text) return "";
125+
const delimiter = text.indexOf(":");
126+
if (delimiter > 0 && delimiter <= 48) {
127+
const label = text.slice(0, delimiter);
128+
const detail = text.slice(delimiter + 1).trim();
129+
return detail
130+
? `${escapeMarkdownText(label)}: ${markdownCodeSpan(detail)}`
131+
: escapeMarkdownText(label);
132+
}
133+
return markdownCodeSpan(text);
134+
};
127135
const lower = (value) => normalizeText(value).toLowerCase();
128136
const frontmatterValue = (value) => {
129137
const trimmed = String(value || "").trim();
@@ -444,20 +452,6 @@ jobs:
444452
) => {
445453
const analysis = contributorAnalysis(contributor, source, fallback);
446454
report.contributorAnalysis = analysis;
447-
if (analysis.login) {
448-
report.trustSignals.push(
449-
`Contributor analyzed: ${githubUserReference(analysis.login)}`
450-
);
451-
} else {
452-
const raw = normalizeText(
453-
contributor.login || fallback.login || contributor.name
454-
);
455-
if (raw) {
456-
report.trustSignals.push(
457-
`Contributor identity unresolved: ${githubUserReference(raw)}`
458-
);
459-
}
460-
}
461455
if (analysis.accountAgeDays !== null) {
462456
if (analysis.accountAgeDays < 7) {
463457
addFlag(
@@ -1473,7 +1467,8 @@ jobs:
14731467
if (report.trustSignals.length) {
14741468
lines.push("", "### Trust signals");
14751469
for (const signal of report.trustSignals.slice(0, 12)) {
1476-
lines.push(`- ${escapeMarkdownText(signal)}`);
1470+
const formatted = markdownLabelValue(signal);
1471+
if (formatted) lines.push(`- ${formatted}`);
14771472
}
14781473
}
14791474
const maintainerChecks = [

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@
1212

1313
[Feeds](https://heyclau.de/api/registry/feed) • [RSS](https://heyclau.de/feed.xml) • [Atom](https://heyclau.de/atom.xml) • [LLM export](https://heyclau.de/llms-full.txt) • [Raycast](integrations/raycast) • [MCP endpoint](https://heyclau.de/api/mcp) • [Claim/update](https://heyclau.de/claim)
1414

15+
[![Mentioned in Awesome Claude Code](https://awesome.re/mentioned-badge.svg)](https://github.com/hesreallyhim/awesome-claude-code/blob/main/README_ALTERNATIVES/README_EXTRA.md#workflows--knowledge-guides-)
16+
1517
</div>
1618

1719
---

‎packages/registry/src/submission-risk.js‎

Lines changed: 19 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -48,17 +48,10 @@ function isGitHubLogin(value) {
4848
return GITHUB_LOGIN_PATTERN.test(normalizeText(value));
4949
}
5050

51-
function neutralizeMarkdownControl(value) {
52-
return normalizeText(value)
53-
.replace(/#(?=\d)/g, "&#35;")
54-
.replace(/@/g, "&#64;");
55-
}
56-
5751
function escapeMarkdownText(value) {
58-
return neutralizeMarkdownControl(compactWhitespace(value)).replace(
59-
/([\\`*_{}\[\]()#+\-.!|>])/g,
60-
"\\$1",
61-
);
52+
return compactWhitespace(value)
53+
.replace(/([\\`*_{}\[\]()#+\-.!|>])/g, "\\$1")
54+
.replace(/@/g, "\\@");
6255
}
6356

6457
function markdownCodeSpan(value) {
@@ -78,6 +71,20 @@ function markdownDetail(value) {
7871
return detail ? ` - ${detail}` : "";
7972
}
8073

74+
function markdownLabelValue(value) {
75+
const text = compactWhitespace(value);
76+
if (!text) return "";
77+
const delimiter = text.indexOf(":");
78+
if (delimiter > 0 && delimiter <= 48) {
79+
const label = text.slice(0, delimiter);
80+
const detail = text.slice(delimiter + 1).trim();
81+
return detail
82+
? `${escapeMarkdownText(label)}: ${markdownCodeSpan(detail)}`
83+
: escapeMarkdownText(label);
84+
}
85+
return markdownCodeSpan(text);
86+
}
87+
8188
function lower(value) {
8289
return normalizeText(value).toLowerCase();
8390
}
@@ -381,21 +388,6 @@ function applyContributorAnalysis(
381388
const analysis = contributorAnalysis(contributor, source, fallback);
382389
report.contributorAnalysis = analysis;
383390

384-
if (analysis.login) {
385-
report.trustSignals.push(
386-
`Contributor analyzed: ${githubUserReference(analysis.login)}`,
387-
);
388-
} else {
389-
const raw = normalizeText(
390-
contributor.login || fallback.login || contributor.name,
391-
);
392-
if (raw) {
393-
report.trustSignals.push(
394-
`Contributor identity unresolved: ${githubUserReference(raw)}`,
395-
);
396-
}
397-
}
398-
399391
if (analysis.accountAgeDays !== null) {
400392
if (analysis.accountAgeDays < 7) {
401393
addFlag(
@@ -1692,7 +1684,8 @@ export function formatSubmissionRiskMarkdown(report) {
16921684
if (report.trustSignals.length) {
16931685
lines.push("", "### Trust signals");
16941686
for (const signal of report.trustSignals.slice(0, 12)) {
1695-
lines.push(`- ${escapeMarkdownText(signal)}`);
1687+
const formatted = markdownLabelValue(signal);
1688+
if (formatted) lines.push(`- ${formatted}`);
16961689
}
16971690
}
16981691

‎scripts/generate-readme.mjs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,8 @@ ${total}+ file-backed entries covering agents, MCP servers, tools, skills, hooks
112112
113113
[Feeds](https://heyclau.de/api/registry/feed) • [RSS](https://heyclau.de/feed.xml) • [Atom](https://heyclau.de/atom.xml) • [LLM export](https://heyclau.de/llms-full.txt) • [Raycast](integrations/raycast) • [MCP endpoint](https://heyclau.de/api/mcp) • [Claim/update](https://heyclau.de/claim)
114114
115+
[![Mentioned in Awesome Claude Code](https://awesome.re/mentioned-badge.svg)](https://github.com/hesreallyhim/awesome-claude-code/blob/main/README_ALTERNATIVES/README_EXTRA.md#workflows--knowledge-guides-)
116+
115117
</div>
116118
117119
---

‎tests/submission-intake.test.ts‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1320,6 +1320,11 @@ Review payloads before posting tweets, replies, DMs, or profile updates.`,
13201320
expect(report.effectiveContributor?.login).toBe("zjg678");
13211321
expect(report.contributorAnalysis.login).toBe("zjg678");
13221322
expect(markdown).toContain("Contributor analyzed: @zjg678");
1323+
expect(markdown).not.toContain(
1324+
"Analyze user profile system implementation",
1325+
);
1326+
expect(markdown).not.toContain("&#64;");
1327+
expect(markdown).not.toContain("&#35;");
13231328
expect(markdown).not.toContain("@&Analyze");
13241329

13251330
const malformedIssue = {
@@ -1825,11 +1830,11 @@ Run the install command.`,
18251830
expect(report.contributorSource).toBe("submission_issue_author");
18261831
expect(report.trustSignals).toEqual(
18271832
expect.arrayContaining([
1828-
"Contributor analyzed: @vy35",
18291833
"PR opened by: @github-actions[bot]",
18301834
"Submission issue: #325",
18311835
]),
18321836
);
1837+
expect(report.trustSignals).not.toContain("Contributor analyzed: @vy35");
18331838
expect(report.classificationWarnings).not.toEqual(
18341839
expect.arrayContaining([
18351840
expect.objectContaining({ id: "generated_readme_change" }),
@@ -1976,10 +1981,10 @@ Review payloads before posting tweets, replies, DMs, or profile updates.`,
19761981
expect(report.pullRequestActor?.login).toBe("JSONbored");
19771982
expect(report.contributorSource).toBe("content_frontmatter");
19781983
expect(report.trustSignals).toEqual(
1979-
expect.arrayContaining([
1980-
"Contributor analyzed: @kriptoburak",
1981-
"PR opened by: @JSONbored",
1982-
]),
1984+
expect.arrayContaining(["PR opened by: @JSONbored"]),
1985+
);
1986+
expect(report.trustSignals).not.toContain(
1987+
"Contributor analyzed: @kriptoburak",
19831988
);
19841989
expect(report.classificationWarnings).not.toEqual(
19851990
expect.arrayContaining([
@@ -2196,8 +2201,11 @@ claude mcp add malicious-source-mcp -- npx -y malicious-source-mcp`);
21962201
...report,
21972202
trustSignals: ["Reference bait: word#123 @octocat"],
21982203
});
2199-
expect(trustMarkdown).toContain("word&\\#35;123");
2200-
expect(trustMarkdown).toContain("&\\#64;octocat");
2204+
expect(trustMarkdown).toContain("- Reference bait: `word#123 @octocat`");
2205+
expect(trustMarkdown).not.toContain("&#35;");
2206+
expect(trustMarkdown).not.toContain("&\\#35;");
2207+
expect(trustMarkdown).not.toContain("&#64;");
2208+
expect(trustMarkdown).not.toContain("&\\#64;");
22012209
});
22022210

22032211
it("rejects non-GitHub submittedBy provenance in content metadata", () => {

0 commit comments

Comments
 (0)