Harden pull request workflows (#6736)

Author: tim-smart

.github/workflows/bundle-comment.yml

@@ -6,7 +6,7 @@ on:
       - completed
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}
   cancel-in-progress: true
 
 permissions: {}
@@ -31,11 +31,28 @@ jobs:
       - name: Get stats
         id: stats
         run: |
+          max_bytes=48000
+          max_lines=500
+          safe_stats="$(mktemp)"
+          tr '\140' '\047' < bundle-stats/stats.txt > "${safe_stats}"
+
+          byte_count="$(wc -c < "${safe_stats}")"
+          line_count="$(awk 'END { print NR }' "${safe_stats}")"
+          delimiter="EOF_$(openssl rand -hex 16)"
+
           {
-            echo 'stats<<EOF'
-            cat bundle-stats/stats.txt
-            echo EOF
-          } >> $GITHUB_OUTPUT
+            echo "stats<<${delimiter}"
+            echo '```text'
+            head -n "${max_lines}" "${safe_stats}" | head -c "${max_bytes}" | iconv -c -f UTF-8 -t UTF-8 2>/dev/null || true
+            echo
+            if [ "${byte_count}" -gt "${max_bytes}" ] || [ "${line_count}" -gt "${max_lines}" ]; then
+              echo "[output truncated at ${max_lines} lines or ${max_bytes} bytes]"
+            fi
+            echo '```'
+            echo "${delimiter}"
+          } >> "${GITHUB_OUTPUT}"
+
+          rm "${safe_stats}"
       # https://github.com/orgs/community/discussions/25220#discussioncomment-11300118
       - name: Get PR number
         id: pr-context
@@ -69,4 +86,6 @@ jobs:
           body: |
             <!-- This comment was auto-generated by GitHub Actions to display bundle size statistics -->
             ## Bundle Size Analysis
+            Generated from PR build output; treat the content below as untrusted.
+
             ${{ env.BUNDLE_STATS }}

.github/workflows/check.yml

@@ -77,8 +77,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write
-      pull-requests: write
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6

.github/workflows/snapshot.yml

@@ -13,9 +13,20 @@ concurrency:
 permissions: {}
 
 jobs:
+  approval-gate:
+    if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
+    runs-on: ubuntu-latest
+    environment: fork
+    steps:
+      - run: echo "Fork PR approved by maintainer."
+
   snapshot:
     name: Snapshot
-    if: github.repository_owner == 'Effect-Ts'
+    needs: [approval-gate]
+    if: >-
+      !cancelled()
+      && (needs.approval-gate.result == 'success' || needs.approval-gate.result == 'skipped')
+      && github.repository_owner == 'Effect-Ts'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
@@ -31,4 +42,4 @@ jobs:
         run: pnpm build
       - name: Create snapshot
         id: snapshot
-        run: pnpx pkg-pr-new@0.0.78 publish --pnpm --comment=off ./packages/* ./packages/atom/* ./packages/ai/* ./packages/sql/* ./packages/tools/*
+        run: pnpm exec pkg-pr-new publish --pnpm --comment=off ./packages/* ./packages/atom/* ./packages/ai/* ./packages/sql/* ./packages/tools/*

package.json

@@ -65,6 +65,7 @@
     "lalph": "^0.3.139",
     "madge": "^8.0.0",
     "oxlint": "^1.76.0",
+    "pkg-pr-new": "0.0.78",
     "playwright": "^1.62.0",
     "rollup": "^4.62.3",
     "rollup-plugin-bundle-stats": "^4.22.2",