You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add the selected review and workflow skills, checksum all maintained assets, and include the shared documentation-audit checker fix.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The recovery recipe leaves an unauthenticated SYSTEM shell accessible from the sign-in screen, creating a critical persistent local privilege-escalation risk.
Missing input or a nonexistent input file only prints an error, so the generated tool can return success without doing any work. Cleanup can also overwrite the operation's failure status. Set nonzero results on validation failures, capture the operation's result before cleanup, and return that saved result explicitly.
An unknown function only prints an error and enters cleanup; no nonzero exit status is set. With a successful caller status, this returns success, so a caller using if errorlevel or || cannot detect a misspelled function name. Run cleanup and explicitly return a failure code on this branch.
FOR /F treats ; as its default comment marker. An input such as ;text is skipped by this loop, so the trailing-space loop runs but the leading spaces remain. Trim leading spaces directly rather than using a parser that can discard the entire input.
Padding is limited to the 50 literal spaces here. For example, padRight Hello 100 produces only 55 characters rather than the requested width because the following substring operation cannot extend the string. Append enough spaces for the requested width before slicing.
Return the task status after cleanup
.github/skills/batch-files/assets/task.txt:89
The task result is not saved before finishing logs and cleanup, so a failure can be replaced by a later command's status and Task Scheduler can report success. The missing-target branch also returns without setting a failure code. Return nonzero for missing targets, capture the task status immediately after this call, and explicitly return it after cleanup.
Every log call depends on WMIC, which is unavailable by default on current Windows 11 installations (also noted in references/batch-files-and-functions.md). On those systems the command fails and _dtMyTask is never populated, leaving logs without a usable timestamp. Use the built-in PowerShell date command, or provide an explicitly checked fallback, rather than requiring WMIC for logging.
This toggles on any backtick fence and never recognizes tilde fences. Consequently, commands documented inside a valid ~~~sh block are not checked, and a three-backtick example inside a four-backtick block incorrectly ends command scanning. Use the fence character and opening delimiter length, as the link-scanning helper already does, instead of toggling a boolean.
A closing Markdown fence cannot have non-whitespace text after its marker, but this condition accepts a line such as ```not-a-closing-fence. That exposes link-shaped text inside the code block to the link checker and can hide real links after the actual closing fence. Require the remainder of the closing-fence line to be whitespace.
Markdown code spans can span multiple lines, but this masks inline code one line at a time. A span containing [Not a link](missing.md) on its second line therefore produces a false broken-link finding. Track matching backtick delimiters across lines while preserving line numbers.
This external-link filter misses protocol-relative URLs such as //cdn.example.com/file.css and URI schemes such as ftp:. They fall through to the filesystem check and are reported as high-severity broken relative links even though they are external. Skip protocol-relative URLs and any valid URI scheme before resolving local paths.
Exclude prerelease tags from stable version filters
.github/skills/github-release/SKILL.md:88
The tag filters accept prereleases such as v2.0.0-rc.1, but Step 4 assumes three integer version components and provides no suffix handling. Anchor both filters at the end with $ to select complete stable tags, or explicitly handle prerelease version arithmetic. The same issue occurs in the PowerShell filter at line 99.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Unresolved correctness issues make the docs audit check scripts and Make targets against incorrect directories, while the batch library can corrupt arguments containing exclamation marks.
No open issues 🎉
3 previously missed issues
In code that hasn't changed since last review
Preserve exclamation marks when copying arguments with delayed expansion
Delayed expansion is enabled here, so expanding _argOneMyLib with percent syntax inserts its contents before the delayed-expansion pass. For example, call myLib padRight "Hello!" 10 loses the literal exclamation mark; paired exclamation marks can also expand an unintended environment variable. Copy the argument using delayed expansion so its contents are not scanned again.
Resolve Make targets per directory and invocation working directory
Merging targets across all Makefiles hides broken commands: a root README's make build passes this check when only subproject/Makefile defines build. Keep targets keyed by directory and resolve each invocation's working directory, including cd and make -C, before checking it.
Resolve script paths relative to the command's working directory
Script-file checks ignore the fenced block's working directory: cd tools followed by python check.py reports an existing tools/check.py as missing, while a root check.py can hide a missing file under tools. Resolve each script invocation against its current directory, including commands on the same line as cd. Use repo/doc/skill fallbacks only when no explicit working directory is established.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The new test file is missing from CHECKSUMS.txt, causing final validation to fail until the manifest is regenerated with the documented ordinal ordering.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Unresolved scanner false positives, incorrect Windows cleanup ordering, and premature checksum generation can cause spurious findings, task failures, and stale changelog hashes.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Unresolved defects cause false missing-target reports for valid shell commands, allow inherited batch variables to bypass argument handling, and produce incomplete help output containing code fragments.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Unresolved defects produce false missing-script reports for continued commands and nested workspaces, while caret escaping corrupts batch-library arguments and return values.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The scanner incorrectly inserts whitespace when joining shell continuation lines, causing paths split within a token to be reported as missing; preserve existing whitespace and add a regression test.
The reason will be displayed to describe this comment to others. Learn more.
🔵 Needs a closer look
Multiple correctness concerns in environment-read detection, Markdown parsing, and workspace selection can produce false audit findings and require human assessment.
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
Unresolved issues generate invalid release comparison links and cause the docs audit to misreport conditional-path commands and miss broken links in nested lists.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
github-actions-hardening,pester-should-migration,docs-sync-audit,github-release, andbatch-files.CHECKSUMS.txtfor all maintained skill assets.Validation
git diff --checkpassed.