refactor: use isRepoAllowed() in sanitize_content_core for consistent multi-repo wildcard support

[Copilot]

neutralizeGitHubReferences() used manual string[].includes() to check allowed repos, missing the wildcard support (myorg/*, *) that isRepoAllowed() from repo_helpers.cjs provides — inconsistent with all other safe-output handlers.

Changes

sanitize_content_core.cjs

• Import isRepoAllowed from repo_helpers.cjs
• buildAllowedGitHubReferences(): return type unchanged (string[]|null); adds core.info logging when the filter is active (showing configured allowed repos) or when all references will be escaped
• neutralizeGitHubReferences(): builds a Set from the array internally, expands the "repo" keyword to the current repo slug, then uses isRepoAllowed() for wildcard pattern support

sanitize_content.test.cjs

• Add tests covering *, myorg/*, and wildcard combined with "repo" keyword

// Previously ignored; now supported consistently with allowed_repos in other handlersprocess.env.GH_AW_ALLOWED_GITHUB_REFS="myorg/*";// myorg/lib#42 → kept, other/repo#7 → escaped

All existing behavior is preserved — the "repo" keyword edge case (including when GITHUB_REPOSITORY is unset) continues to work correctly.

Original prompt

Review consistency of support for multiple repository in safe outputs. Look for consistency, refactor and use helpers in JavaScript code.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

---

Changeset

• Type: patch
• Description: ensure sanitize_content_core.cjs uses isRepoAllowed() so wildcard and "repo" patterns work when neutralizing GitHub references, with tests covering the new behavior

Generated by Changeset Generator

---

---

✨ PR Review Safe Output Test - Run 22253358202

💥 [THE END] — Illustrated by Smoke Claude

[pelikhan]

@copilot keep change minimal, do not change return type

[Copilot]

@copilot keep change minimal, do not change return type

Done in e3a825b. buildAllowedGitHubReferences() keeps its original string[]|null return type. The "repo" keyword expansion and Set construction now happen inside neutralizeGitHubReferences(), where isRepoAllowed() is called for wildcard support.

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

[github-actions]

🎬 THE END — Smoke ClaudeMISSION: ACCOMPLISHED! The hero saves the day! ✨

[github-actions]

📰 BREAKING: Smoke Copilot is now investigating this pull request. Sources say the story is developing...

[Copilot]

Pull request overview

This pull request refactors the neutralizeGitHubReferences() function in sanitize_content_core.cjs to use the centralized isRepoAllowed() helper from repo_helpers.cjs, enabling consistent wildcard pattern support (*, myorg/*) for GitHub reference filtering across the codebase.

Changes:

• Replaced manual array.includes() checks with isRepoAllowed() for repository validation
• Added wildcard pattern support for allowed GitHub references
• Added comprehensive test coverage for wildcard patterns

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
actions/setup/js/sanitize_content_core.cjs	Imports isRepoAllowed and refactors neutralizeGitHubReferences() to use it, supporting wildcard patterns while preserving the "repo" keyword expansion logic
actions/setup/js/sanitize_content.test.cjs	Adds three new test cases covering universal wildcard (*), organization wildcard (myorg/*), and combination of wildcards with the "repo" keyword

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Smoke test results:

• PRs: docs: add missing required sections to 7 safe output types (REQ-002) #17417 docs: add missing required sections to 7 safe output types (REQ-002); [docs] Update documentation for multiple PR creation support #17388 [docs] Update documentation for multiple PR creation support
• GitHub MCP: ✅
• Serena MCP: ✅
• Playwright: ✅
• File write: ✅
• Bash verify: ✅
• Build: ✅
  Overall: PASS

🔮 The oracle has spoken through Smoke Codex

[github-actions]

🤖 Smoke test §22253358181 results:

Test
GitHub MCP	✅
Safe Inputs GH CLI	✅
Serena MCP	❌
Playwright	✅
File Write + Bash	✅
Discussion Query+Comment	✅
Build	✅
Discussion Create	✅
Workflow Dispatch	✅
PR Review	✅

Status: ⚠️ PARTIAL PASS (10/11) — Serena MCP not configured.
PR Author: @Copilot | Assignees: @pelikhan, @Copilot

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

This PR cleanly refactors neutralizeGitHubReferences() to use isRepoAllowed() from repo_helpers.cjs, adding wildcard pattern support (myorg/*, *) consistently with other safe-output handlers. The approach of building a Set and expanding the "repo" keyword at construction time is clean. Tests added for *, myorg/*, and combined wildcard+keyword cases. A potential edge case: null-safety of isRepoAllowed() when GITHUB_REPOSITORY is unset.

📰 BREAKING: Report filed by Smoke Copilot

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

Smoke Test Results — Run §22253358202

Overall: PARTIAL (skipped: #14, #17)

Core Tests (1–10):
✅ GitHub MCP | ✅ SafeInputs GH CLI | ✅ Serena MCP | ✅ Make Build | ✅ Playwright | ✅ Tavily Search | ✅ File Write | ✅ Bash Verify | ✅ Discussion Comment | ✅ Agentic Workflows MCP

PR Review Tests (11–17):
✅ Update PR | ✅ Review Comments | ✅ Submit Review | ⚠️ Resolve Thread (no threads) | ✅ Add Reviewer | ✅ Push to Branch | ⚠️ Close PR (no test PR)

💥 [THE END] — Illustrated by Smoke Claude

[github-actions]

💥 Automated smoke test review - all systems nominal!

💥 [THE END] — Illustrated by Smoke Claude

[pelikhan]

@copilot add logging using core.info

[Copilot]

@copilot add logging using core.info

Done in 5f5389c. Added core.info logging to buildAllowedGitHubReferences():

• When the env var is empty: logs "GitHub reference filtering: all references will be escaped (GH_AW_ALLOWED_GITHUB_REFS is empty)"
• When repos are configured: logs "GitHub reference filtering: allowed repos = myorg/*, repo" (etc.)

The existing logging for escaped individual references was already present.