Update Managed Files

[ChiaAutomation]

Note

Low Risk
Changes only affect Dependabot review workflow prompt text and post-processing of Cursor output; no application runtime or auth paths are modified.

Overview
This PR tightens how supply-chain malware Cursor output is formatted before it lands on Dependabot/Renovate PR comments.

The malware task prompt now requires the model to open with a standalone bold line (**Verdict: benign** or **Verdict: malicious**), a blank line, then reasoning—not a plain Verdict: prefix or an inline verdict.

After the agent runs, inline Python format_malware_review_verdict parses the malware review text, picks the “official” verdict (standalone line or sentence-glued forms), strips duplicate verdict snippets from the body (including format-example lines), and re-emits a normalized block with the bold verdict first. That normalized text is what gets merged into the combined Cursor analysis comment.

^{Reviewed by Cursor Bugbot for commit f460905. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f460905. Configure here.}

[cursor]

First verdict match can mislabel review

High Severity

_official_verdict_match keeps the first standalone or glued Verdict and format_malware_review_verdict then deletes every other matching line. FORMAT_HEADING_RE does not recognize this prompt’s or: examples, and glued text after e.g. can count as official, so an early draft or echoed template can become the posted label while a later correction disappears.

Additional Locations (2)

• .github/workflows/dependency-cursor-review.yml#L995-L1009
• .github/workflows/dependency-cursor-review.yml#L1040-L1059

 

^{Reviewed by Cursor Bugbot for commit f460905. Configure here.}