fix(ci): harden PR→issue linking gate against shell injection and missed refs

[nollymar]

Fixes #35794

Summary

Hardens the PR-to-issue linking gate (.github/workflows/issue_open-pr.yml → issue_comp_link-issue-to-pr.yml) and adds a second gate on the linked issue's metadata.

Linking-gate fixes (the original three)

• Shell injection / template interpolation. inputs.pr_body, pr_title, pr_author, pr_url, pr_branch, pr_merged were template-substituted by GitHub Actions directly into the bash run: scripts. PRs whose body contained backticks, $var(...), or unbalanced parens (e.g. feat(tiptap): convert Story Block content to Markdown (#35727) #35728's $markdownTool.blockToMarkdown(json)) caused a bash syntax error on the first Debug workflow inputs step → entire job exited code 2 → Add failure comment to PR was skipped (its condition needs failure_detected=true, never set) → PR appeared unchecked. Hoisted all inputs into a job-level env: block and reference them as $ENV_VAR in shell, so user-supplied values are treated as data, not code.
• Missed markdown-link refs. The regex (close[ds]?|fix(e[ds])?|resolve[ds]?)(:)?\s+#([0-9]+) requires a literal # immediately after the keyword and misses GitHub's other valid form fixes [#123](url) (as in feat(dotAI): Dot AI LangChain4J - Amazon Bedrock #35242). Added a GraphQL closingIssuesReferences lookup as the 4th and final fallback in Determine final issue number.
• Stale-on-open. The workflow only triggered on pull_request: [opened], so editing the body or pushing new commits never re-evaluated the gate. A once-broken PR stayed broken even after the author fixed the link. Broadened triggers to [opened, edited, synchronize, reopened]. Existing idempotency (grep -q "#$issue_number" before body patch, sort -u on PR-list comments, Remove failure comment step) handles the extra runs; the failure-comment step is now dedup-guarded.

New second gate — linked issue must have a team label

After the link is resolved, the workflow validates that the linked issue carries a Team : * label and fails with a distinct ❌ Linked Issue Needs Team Label PR comment if it doesn't. The validation step runs before the side-effect steps (PR-list comment on the issue, PR body PATCH), so a PR whose linked issue is missing a team label does not mutate any remote state before failing.

Review-driven follow-ups (commit 312ced3e)

• Step order moved so gates run before side effects (Link PR to issue and the issue's PR-list comment no longer run when validation fails).
• gh issue view errors in the team-label step are surfaced distinctly instead of being collapsed into "no team label."
• $GITHUB_OUTPUT heredocs use a random ghadelimiter_<random> instead of literal EOF to prevent delimiter collision with user-controlled content.
• Markdown link characters (\, [, ]) in PR_TITLE are escaped before being embedded in the bot's linked-issue comment.
• URL-presence check on the existing PR list switched from grep -q to grep -qF.

Operational notes

• Fork PRs are skipped via if: github.event.pull_request.head.repo.full_name == github.repository because the pull_request GITHUB_TOKEN is read-only on forks. If this gate ever becomes a required check, fork contributors will be unchecked by design — flag for follow-up at that point.
• Explicit permissions: { pull-requests: write, issues: write } declared on the reusable workflow.
• The check remains advisory (not in branch-protection required checks on main).

Test plan

• Confirm no shell error in Debug workflow inputs when the PR body contains backticks / $var(...) (this PR's own description is the test case).
• GraphQL fallback runs only when neither body regex nor branch-name extraction succeeds.
• synchronize re-fires the check on a new push (empty commit 2e6b0ed0 validated this).
• Linked-issue gate fails with ❌ Linked Issue Needs Team Label when the linked issue has no Team : * label.
• Linked-issue gate passes when Team : * is restored on the issue.
• Side-effect steps (Create new comment, Link PR to issue) are skipped on a run where team-label validation fails.
  🤖 Generated with Claude Code

[claude]

Claude finished @nollymar's task in 4m 57s —— View job

---

PR Review

The hardening is solid — env hoisting is consistent, the heredoc-delimiter randomization closes the GH_OUTPUT injection class, markdown-link escaping in the bot comment looks right, and the gate/side-effect ordering is mostly correct. A few things worth a second look:

Findings

1. Priority inversion between body-regex and closingIssuesReferences — .github/workflows/issue_comp_link-issue-to-pr.yml:90 vs :152
The PR description says GraphQL was added "as the 4th and final fallback," but the body-regex in check_existing_issues (line 90) actually outranks it (it sets has_linked_issues=true and short-circuits the determine_issue step). For a body containing both fixes #1234 (typo) and fixes [#35794](url), the regex wins on the typo. GitHub's own closingIssuesReferences is the authoritative source for "what this PR closes" — consider promoting GraphQL above the loose regex, or at least falling back to GraphQL when the regex hit doesn't appear in closingIssuesReferences.

2. gh issue view failure is silent on the PR — .github/workflows/issue_comp_link-issue-to-pr.yml:230-235
When the labels lookup fails (transient 5xx, rate limit, deleted issue, scope issue) the step exit 1s without setting validation_failed=true. Both Add failure comment and Add issue-validation failure comment are then gated off, so the job fails red but the PR shows no comment explaining why. The PR description specifically calls this case out as a fix vs. "collapsed into no team label" — but the author still gets nothing on the PR. Either set a third output flag (fetch_failed=true) with its own comment branch, or fall through to the existing "needs team label" comment with a generic message.

3. Remove failure comment if issue is now resolved runs before the team-label gate — .github/workflows/issue_comp_link-issue-to-pr.yml:188-216 and :218-247
The PR description states "gates run before side effects," but this comment-deletion side effect runs between gate 1 (issue determination) and gate 2 (team-label validation). It's semantically defensible — the linking-required failure IS resolved as soon as we found a link — but a stricter ordering would be: gate, gate, then both cleanup steps. Worth a comment in the workflow noting the deliberate interleaving.

4. sort -u reorders the issue's PR-list every run — .github/workflows/issue_comp_link-issue-to-pr.yml:319, 340
Lines are sorted alphabetically by title, so adding a new PR can re-shuffle older entries. Combined with edit-mode: replace, every new PR causes the whole list to reorder. Cosmetic but visible in the issue thread. Consider stable-sorting (e.g., by PR number / URL suffix) so order remains predictable.

5. GraphQL -F typing on string args — .github/workflows/issue_comp_link-issue-to-pr.yml:153-155
gh api graphql -F owner="$owner" -F name="$repo" uses -F (smart JSON coercion). For owner="dotCMS", repo="core" this works, but -f is the explicit string form and matches the String! schema. If someone ever creates an all-numeric repo or owner, -F would coerce to a number and the query would 400. Minor — switch to -f owner=... -f name=... -F num=....

6. Pre-existing: connected timeline event picks first, not most-recent — .github/workflows/issue_comp_link-issue-to-pr.yml:76
Not introduced by this PR, but: jq '.[] | select(.event == "connected") | .source.issue.number' | head -1 returns the earliest connect event, ignoring any subsequent disconnect/reconnect. A PR that was linked to issue A, unlinked, then linked to B will still resolve to A. Flag for follow-up.

7. Unchecked test-plan item is the most important one to verify
The last item — "Side-effect steps are skipped on a run where team-label validation fails" — is the whole point of the gate-reordering fix. Reading the workflow it should work (default behavior is to skip subsequent steps on a prior exit 1), but worth an actual run with a label-less linked issue to confirm Create new comment, Update existing comment, and Link PR to issue are visibly skipped in the action log before merging.

Nits

• ${{ env.GH_TOKEN }} is still template-interpolated in curl headers in multiple steps (e.g. :64, :71, :198). Token is system-generated so not an injection vector, but inconsistent with the hardening goal — $GH_TOKEN would match the rest of the file.
• Branch-name pattern ^([0-9]+)- at :110 will happily match 2025-something or 404-not-found. Heuristic of last resort and probably acceptable, but worth keeping in mind.

Summary

• Read changed workflow files
• Check shell-injection hardening (env hoisting, quoting)
• Check the Determine final issue number fallback chain
• Check team-label gate, step ordering, and side-effect skipping
• Check the synchronize/edited re-run paths for idempotency
• Post review

The shell-injection hardening is the highest-value change and looks correct. The two findings worth addressing before merge are #1 (priority ordering of GraphQL vs body regex) and #2 (silent failure on gh issue view errors). The rest are smaller cleanups or follow-ups.
· Branch