Case Study: Securing Sticky Summary Authorship & Identity Pinning

File 1: scripts/github-actions/post-review-comments.js

This is the core runtime engine for posting reviews, managing sticky summaries, and evaluating cross-push checkpoints.

1. Function Signature (runPostReviewComments): Added appSlug = "" to the destructured options object so the caller can pin the expected GitHub App identity ('github-actions' when running under the default token).
2. Early Memoized Closure (authenticatedLogin): Moved the lazy promise memoizer above the early-exit branches (checkpointNoop, malformed JSON catch block, and comments.length === 0 zero-findings exit) so all summary-posting paths have access to it without hitting a JavaScript Temporal Dead Zone (TDZ) error:

   let authenticatedLoginPromise = null;  
                           const authenticatedLogin = () => {  
                           if (!authenticatedLoginPromise) authenticatedLoginPromise = getAuthenticatedLogin(github, log);  
                           return authenticatedLoginPromise;  
                           };

3. Threading botLogin and appSlug Through Summary Call Sites: Updated the malformed-JSON error summary path, the zero-findings summary path, ensureSummaryAnchor, and finalizeSummary to pass botLogin: authenticatedLogin (as a lazy function reference) and appSlug.
4. Updating findExistingSummaryComment and findSummaryIssueComment: Updated both lookup loops to lazily resolve botLogin only when a matching marker (SUMMARY_MARKER or tag) is found, and gated the return on isSummaryAuthorOurs(comments[i], login, appSlug):

   async function findSummaryIssueComment({ github, owner, repo, prNumber, sticky, tag, log, botLogin, appSlug, ignoreAuthor = false }) {  
                           const comments = await readAllPages("listIssueComments", (page, per_page) =>  
                               github.rest.issues.listComments({ owner, repo, issue_number: prNumber, per_page, page }), log  
                           );  
                           for (let i = comments.length - 1; i >= 0; i--) {  
                               const body = comments[i].body || "";  
                               if (sticky ? body.includes(SUMMARY_MARKER) : body.includes(tag)) {  
                               const login = typeof botLogin === "function" ? await botLogin() : botLogin;  
                               if (ignoreAuthor || isSummaryAuthorOurs(comments[i], login, appSlug)) {  
                                   return comments[i];  
                               }  
                               }  
                           }  
                           return null;  
                           }

5. Implementing isSummaryAuthorOurs & Hardening getAuthenticatedLogin: Added isSummaryAuthorOurs to bridge PAT logins and App/Bot verification, and added defensive null-checks to getAuthenticatedLogin:

   function isSummaryAuthorOurs(comment, botLogin, appSlug) {  
                           if (!comment || !comment.user) return false;  
                           if (botLogin && comment.user.login === botLogin) return true;  
                           return isCheckpointAuthorOurs(comment, appSlug);  
                           }

File 2: action.yml

This composite GitHub Action manifest defines the environment variables and inline actions/github-script execution blocks.

1. Exposing OCR_CHECKPOINT_APP_SLUG in the Posting Step: In GitHub Actions, step-level env: blocks do not carry over to subsequent steps. Previously, OCR_CHECKPOINT_APP_SLUG was only defined on the Resolve review range step. We added the exact same expression to the Post review comments step's env: block:

   OCR_CHECKPOINT_APP_SLUG: ${{ inputs.github_token == github.token && 'github-actions' || '' }}

   Why this expression? When the user uses the default github.token, we know with 100% certainty the writer is the github-actions App, so we pin it. If they pass a custom token (PAT or custom App), it evaluates to '' because an installation token cannot query GET /app without a JWT.

2. Forwarding appSlug into runPostReviewComments: Inside the with: script: | block of Post review comments, we wired the environment variable into the function call:

   resolveOutdated: process.env.OCR_RESOLVE_OUTDATED,  appSlug: process.env.OCR_CHECKPOINT_APP_SLUG || '',

File 3: scripts/github-actions/post-review-comments.test.js

The unit and integration test suite for the review poster. Added targeted regression tests covering:

• Human Comment Protection: Ensuring a human comment containing <!-- ocr-summary --> is ignored and never overwritten.
• PAT Authorship: Ensuring a sticky summary authored by the authenticated PAT user is recognized and updated in place.
• Custom GitHub App Authorship: Ensuring comments written by a custom [bot] account are recognized when appSlug is unpinned, while foreign bots are rejected when appSlug is pinned to 'github-actions'.
• Malformed JSON / Stderr Fallback: (testMalformedJsonWithStderrUsesAuthenticatedLogin) Verifying that early-exit error summaries properly resolve identity without throwing reference or TDZ errors.

File 4: scripts/github-actions/action-contract.test.js

The static and behavioral contract test suite that parses action.yml without external dependencies.

1. Upgrading parseSteps() to Extract actions/github-script Bodies: Previously, the custom YAML parser in action-contract.test.js only extracted run: | bash blocks and env: maps, leaving actions/github-script steps (with: script: |) invisible to contract assertions. We extended finish() inside parseSteps() to detect script: | and capture its 10-space-indented JavaScript body as step.script:

   let script;  
                           const scriptMarker = rawLines.findIndex((line) => /^        script:\s*\|\s*$/.test(line));  
                           if (scriptMarker >= 0) {  
                           const body = [];  
                           for (let index = scriptMarker + 1; index < rawLines.length; index += 1) {  
                               const line = rawLines[index];  
                               if (line.trim() === "") {  
                               body.push("");  
                               } else if (/^          /.test(line)) {  
                               body.push(line.slice(10));  
                               } else {  
                               break;  
                               }  
                           }  
                           script = body.join("\n");  
                           }

2. Adding testPostReviewCommentsWiresAppSlug: Added a dedicated contract test verifying both halves of the action.yml wiring so they can never drift apart in future refactors:

   function testPostReviewCommentsWiresAppSlug() {  
                           const post = stepNamed("Post review comments");  
                           assert.ok(post, "action.yml must retain the Post review comments step");
   
                           // 1. The step exposes the env value.  
                           assert.strictEqual(  
                               post.env.OCR_CHECKPOINT_APP_SLUG,  
                               "${{ inputs.github_token == github.token && 'github-actions' || '' }}",  
                               "Post review comments must resolve and expose OCR_CHECKPOINT_APP_SLUG in its env block"  
                           );
   
                           // 2. The github-script body forwards it into the runPostReviewComments({...}) call.  
                           assert.ok(post.script, "Post review comments must define a github-script `with: script:` body");  
                           const call = post.script.match(/runPostReviewComments\(\{\[\s\S\]*?\n\}\);/);  
                           assert.ok(call, "Post review comments script must call runPostReviewComments({...})");  
                           assert.match(  
                               call[0],  
                               /^\s*appSlug:\s*process\.env\.OCR_CHECKPOINT_APP_SLUG\s*\|\|\s*(\['"\])\1\s*,?\s*$/m,  
                               "runPostReviewComments must be passed the appSlug from process.env"  
                           );  
                           }