FIX: forked-pr-coverage.yml env-injection via untrusted artifact

[Sumit Sarabhai (sumitmsft)]

Work Item / Issue Reference

AB#46466

Summary

• Treat fork-produced coverage artifacts as untrusted input and validate their schema and values before use.
• Bind coverage comments to the triggering pull request instead of accepting an artifact-supplied PR number.
• Remove untrusted artifact propagation through GITHUB_ENV and reject unexpected files, unsafe URLs, control characters, and oversized values.
• Pin GitHub Actions to immutable commit SHAs and disable persisted checkout credentials.
• Add regression coverage for environment injection, cross-PR targeting, executable artifacts, and Markdown/URL injection.

Validation

• 12 targeted security regression tests passed.
• Changed workflow YAML parsed successfully.
• Black formatting checks passed.
• Native extension build completed successfully.

[Copilot]

Pull request overview

Hardens the forked PR coverage-comment pipeline by treating coverage artifacts as untrusted input, validating/normalizing the data used to generate PR comments, and reducing the privileged workflow’s exposure to artifact-driven environment injection.

Changes:

• Introduces a Python validator/comment builder (prepare_fork_coverage_comment.py) and a security-focused regression test suite.
• Refactors forked-pr-coverage.yml to validate artifacts + resolve the target PR from the triggering workflow context (not artifact-supplied data), and post/update a single sticky comment.
• Tightens the producer workflow (pr-code-coverage.yml) by removing artifact-supplied PR targeting fields, hardening multiline GITHUB_ENV usage, and pinning actions to SHAs.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tests/test_fork_coverage_security.py	Adds regression tests for artifact schema validation, URL/markup injection, PR resolution, and workflow env-injection checks.
.github/workflows/pr-code-coverage.yml	Pins actions, disables persisted credentials, hardens multiline env export, and removes untrusted fields from the uploaded artifact payload.
.github/workflows/forked-pr-coverage.yml	Moves privileged workflow to validate downloaded artifacts + resolve PR from the event/commit association before commenting.
.github/scripts/prepare_fork_coverage_comment.py	Implements schema/value validation and safe comment construction for fork coverage artifacts.
.github/actions/post-coverage-comment/action.yml	Pins the sticky-comment action to an immutable SHA.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

📊 Code Coverage Report

🔥 Diff Coverage 100%

🎯 Overall Coverage 82%

📈 Total Lines Covered: 7368 out of 8963 📁 Project: mssql-python

---

Diff Coverage

Diff: main...HEAD, staged and unstaged changes

No lines with coverage information in this diff.

---

📋 Files Needing Attention

📉 Files with overall lowest coverage (click to expand)

mssql_python.pybind.logger_bridge.cpp: 59.2%
mssql_python.pybind.ddbc_bindings.h: 59.9%
mssql_python.pybind.logger_bridge.hpp: 70.8%
mssql_python.pybind.ddbc_bindings.cpp: 76.6%
mssql_python.__init__.py: 77.6%
mssql_python.row.py: 77.6%
mssql_python.ddbc_bindings.py: 79.6%
mssql_python.pybind.connection.connection_pool.cpp: 81.4%
mssql_python.pybind.connection.connection.cpp: 84.3%
mssql_python.logging.py: 85.5%

---

🔗 Quick Links

⚙️ Build Summary	📋 Coverage Details
View Azure DevOps Build	Browse Full Coverage Report