actions/claude-code-action
1
0
Fork 0
mirror of https://github.com/anthropics/claude-code-action.git synced 2026-08-22 03:18:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: allow leading underscore in branch names (valid per git-check-ref-format) (#1486)

Browse Source 
Branch names starting with an underscore (e.g. _release/v1.2.3) are valid
per git check-ref-format but were rejected by validateBranchName's
first-character whitelist. Since setupBranch validates a PR's baseRefName
after checkout, the action failed on every open PR targeting such a
branch. A leading underscore carries no option-injection risk (only a
leading dash does, which is still rejected separately).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Riley Mete
2026-07-15 20:27:12 -07:00
committed by GitHub
co-authored by Claude Fable 5
parent 214a70611b
commit 5bfa96a5b0
2 changed files with 16 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/validate-branch-name.test.ts
+10
View File
@@ -74,6 +74,16 @@ describe("validateBranchName", () => {
expect(() => validateBranchName("@hotfix/login-timeout")).not.toThrow();
expect(() => validateBranchName("agent/task@abc123")).not.toThrow();
});
it("should accept branch names starting with underscore (git-valid, common for release branches)", () => {
// Leading underscores are valid per git check-ref-format and a common
// convention for release/internal branches. Rejecting them broke the
// action on any open PR whose base branch was e.g. "_release/v1.2.3",
// since setupBranch validates the PR's baseRefName after checkout.
expect(() => validateBranchName("_release/v1.2.3")).not.toThrow();
expect(() => validateBranchName("_internal")).not.toThrow();
expect(() => validateBranchName("_wip/feature-x")).not.toThrow();
});
});
describe("command injection attempts", () => {