diff --git a/.github/workflows/ampcode-pr-review.yml b/.github/workflows/ampcode-pr-review.yml index 6c100c243..e2905f905 100644 --- a/.github/workflows/ampcode-pr-review.yml +++ b/.github/workflows/ampcode-pr-review.yml @@ -92,16 +92,19 @@ jobs: # Read the review output REVIEW_CONTENT=$(cat ampcode_review.txt) - # Sanitize the review content to prevent injection attacks - SANITIZED_CONTENT=$(echo "$REVIEW_CONTENT" | sed 's/"/\\"/g' | sed 's/`/\\`/g' | sed 's/\$/\\$/g' | tr '\n' ' ') + # Create a comprehensive PR review comment using proper JSON escaping + # Use jq to properly escape the review content for JSON + ESCAPED_CONTENT=$(echo "$REVIEW_CONTENT" | jq -Rs .) - # Create a comprehensive PR review comment with sanitized content - cat > review_comment.json << EOF - { - "body": "## 🤖 Automated Code Review by Ampcode\n\n**Review Summary:**\n\nI've analyzed the changes in this PR using AI-powered code review. Here are my findings:\n\n### 📋 Review Results\n\n\`\`\`\n${SANITIZED_CONTENT}\n\`\`\`\n\n### 🔍 Key Areas Reviewed\n- Code quality and best practices\n- Potential bugs and security issues\n- Performance considerations\n- Maintainability and readability\n\n### 📝 Notes\n- This is an automated review generated by Ampcode AI\n- Please review the suggestions and apply them as appropriate\n- For questions about specific recommendations, feel free to ask!\n\n---\n*Generated by [Ampcode](https://ampcode.com) • [View Workflow](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})*", - "event": "COMMENT" - } - EOF + # Create the JSON payload with proper escaping + jq -n \ + --arg content "$REVIEW_CONTENT" \ + --arg run_id "${{ github.run_id }}" \ + --arg repo "${{ github.repository }}" \ + '{ + "body": ("## 🤖 Automated Code Review by Ampcode\n\n**Review Summary:**\n\nI'\''ve analyzed the changes in this PR using AI-powered code review. Here are my findings:\n\n### 📋 Review Results\n\n```\n" + $content + "\n```\n\n### 🔍 Key Areas Reviewed\n- Code quality and best practices\n- Potential bugs and security issues\n- Performance considerations\n- Maintainability and readability\n\n### 📝 Notes\n- This is an automated review generated by Ampcode AI\n- Please review the suggestions and apply them as appropriate\n- For questions about specific recommendations, feel free to ask!\n\n---\n*Generated by [Ampcode](https://ampcode.com) • [View Workflow](https://github.com/" + $repo + "/actions/runs/" + $run_id + ")*"), + "event": "COMMENT" + }' > review_comment.json # Post the review comment curl -X POST \