mirror of
https://github.com/anthropics/claude-code-action.git
synced 2026-08-03 17:58:30 +08:00
360be9c8fc
`validateBranchName` rejects branch names containing `@`, even though `git check-ref-format` permits `@` and GitHub itself accepts such branches. PRs whose head or base branch contains an `@` fail validation in-process before any git operation, so the action errors out immediately. Branch names with `@` show up in real workflows: ticket conventions like "TICKET-123@add-feature" (#998), leading-prefix conventions like "@hotfix/...", and agent tooling that appends "@<sessionid>" (#1305). There is no workaround other than renaming the branch, which is often not under the user's control. Branch names are never passed through a shell (git calls use execFileSync argv arrays), so `@` carries no injection risk. This is the same reasoning used to add `#` in #1167, `+` in #1248, and `,` in #1310. The bare name "@" (HEAD shorthand in git revision syntax) and the "@{" reflog sequence are still rejected. - Add `@` to the validateBranchName whitelist regex, including the leading position (the leading-character rule blocks option injection via `-`, which `@` cannot cause) - Reject the bare name "@" with a dedicated check - Update the surrounding comment, JSDoc, and error message to match - Add test cases for @-containing names and bare "@" Fixes #998 Co-authored-by: Claude Fable 5 <noreply@anthropic.com>