🔒 Fix potential argument injection via PR number string coercion

.github/workflows/opencode-review.yml

@@ -45,6 +45,11 @@ jobs:
           persist-credentials: true
           ref: ${{ github.event.pull_request.head.sha || inputs.pr_head_sha || github.sha }}
 
+      - name: Set up Python 3.14
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.14"
+
       - name: Fetch PR base branch for OpenCode context
         env:
           PR_BASE_REF: ${{ github.event.pull_request.base.ref || inputs.pr_base_ref }}

.github/workflows/pr-review-merge-scheduler.yml

@@ -49,6 +49,11 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Set up Python 3.14
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.14"
+
       - name: Self-test scheduler
         run: python3 scripts/ci/pr_review_merge_scheduler.py --self-test
 

scripts/ci/pr_review_merge_scheduler.py

@@ -159,10 +159,35 @@ def review_author_login(review: dict[str, Any]) -> str:
     return ((review.get("author") or {}).get("login") or "").lower()
 
 
-def current_head_review_state(pr: dict[str, Any], state: str) -> bool:
+def _parse_pr_number(raw: Any) -> str:
+    """Strictly validate and convert a PR number to a positive-integer string.
+
+    Accepts only a plain ``int`` (excluding ``bool``) or a digit-only ``str``.
+    Raises ``ValueError`` for booleans, floats, non-digit strings, zero, and
+    negative values so that the validated string is safe to pass to the ``gh``
+    CLI without risk of option/argument injection.
+    """
+    if isinstance(raw, bool):
+        raise ValueError(f"Invalid PR number (bool not accepted): {raw!r}")
+    if isinstance(raw, int):
+        if raw <= 0:
+            raise ValueError(f"Invalid PR number (must be > 0): {raw!r}")
+        return str(raw)
+    if isinstance(raw, str):
+        if not raw.isdigit():
+            raise ValueError(f"Invalid PR number (non-digit string): {raw!r}")
+        value = int(raw)
+        if value <= 0:
+            raise ValueError(f"Invalid PR number (must be > 0): {raw!r}")
+        return str(value)
+    raise ValueError(f"Invalid PR number (unexpected type {type(raw).__name__}): {raw!r}")
+
+
+def current_head_review_state(pr: dict[str, Any], state: str, *, extra_authors: tuple[str, ...] = ()) -> bool:
     head = pr.get("headRefOid")
     for review in reversed((pr.get("reviews") or {}).get("nodes") or []):
-        if not review_author_login(review).startswith("opencode-agent"):
+        login = review_author_login(review)
+        if not (login.startswith("opencode-agent") or login in extra_authors):
             continue
         if (review.get("state") or "").upper() != state:
             continue
@@ -177,18 +202,19 @@ def has_current_head_approval(pr: dict[str, Any]) -> bool:
 
 
 def has_current_head_changes_requested(pr: dict[str, Any]) -> bool:
-    return current_head_review_state(pr, "CHANGES_REQUESTED")
+    return current_head_review_state(pr, "CHANGES_REQUESTED", extra_authors=("github-actions[bot]",))
 
 
 def enable_auto_merge(repo: str, pr: dict[str, Any], *, dry_run: bool) -> None:
-    number = str(pr["number"])
-    head = pr["headRefOid"]
+    number = _parse_pr_number(pr["number"])
+    head = str(pr["headRefOid"])
     if dry_run:
         return
     run(["gh", "pr", "merge", number, "--repo", repo, "--auto", "--merge", "--match-head-commit", head])
 
 
 def dispatch_opencode_review(repo: str, workflow: str, pr: dict[str, Any], *, dry_run: bool) -> None:
+    number = _parse_pr_number(pr["number"])
     if dry_run:
         return
     run(
@@ -202,7 +228,7 @@ def dispatch_opencode_review(repo: str, workflow: str, pr: dict[str, Any], *, dr
             "--ref",
             pr["baseRefName"],
             "-f",
-            f"pr_number={pr['number']}",
+            f"pr_number={number}",
             "-f",
             f"pr_base_ref={pr['baseRefName']}",
             "-f",
@@ -224,7 +250,7 @@ def inspect_pr(
     enable_auto_merge_flag: bool,
     workflow: str,
 ) -> Decision:
-    number = pr["number"]
+    number = int(_parse_pr_number(pr["number"]))
     head_repo = (pr.get("headRepository") or {}).get("nameWithOwner")
 
     if pr.get("isDraft"):

tests/scripts/ci/test_pr_review_merge_scheduler.py

@@ -1,5 +1,10 @@
 import pytest
-from scripts.ci.pr_review_merge_scheduler import split_repo
+from scripts.ci.pr_review_merge_scheduler import (
+    _parse_pr_number,
+    has_current_head_approval,
+    has_current_head_changes_requested,
+    split_repo,
+)
 
 def test_split_repo_valid():
     assert split_repo("owner/name") == ("owner", "name")
@@ -17,3 +22,79 @@ def test_split_repo_invalid():
 
     with pytest.raises(ValueError, match="repo must be owner/name, got '/'"):
         split_repo("/")
+
+
+# --- _parse_pr_number tests ---
+
+def test_parse_pr_number_valid_int():
+    assert _parse_pr_number(1) == "1"
+    assert _parse_pr_number(42) == "42"
+
+def test_parse_pr_number_valid_str():
+    assert _parse_pr_number("5") == "5"
+    assert _parse_pr_number("100") == "100"
+
+def test_parse_pr_number_rejects_bool():
+    with pytest.raises(ValueError, match="bool not accepted"):
+        _parse_pr_number(True)
+    with pytest.raises(ValueError, match="bool not accepted"):
+        _parse_pr_number(False)
+
+def test_parse_pr_number_rejects_float():
+    with pytest.raises(ValueError, match="unexpected type float"):
+        _parse_pr_number(1.9)
+
+def test_parse_pr_number_rejects_non_digit_string():
+    with pytest.raises(ValueError, match="non-digit string"):
+        _parse_pr_number("abc")
+    with pytest.raises(ValueError, match="non-digit string"):
+        _parse_pr_number("1.9")
+    with pytest.raises(ValueError, match="non-digit string"):
+        _parse_pr_number("-1")
+
+def test_parse_pr_number_rejects_zero():
+    with pytest.raises(ValueError, match="must be > 0"):
+        _parse_pr_number(0)
+    with pytest.raises(ValueError, match="must be > 0"):
+        _parse_pr_number("0")
+
+def test_parse_pr_number_rejects_negative():
+    with pytest.raises(ValueError, match="must be > 0"):
+        _parse_pr_number(-5)
+
+def test_parse_pr_number_rejects_none():
+    with pytest.raises(ValueError, match="unexpected type NoneType"):
+        _parse_pr_number(None)
+
+
+# --- has_current_head_changes_requested with github-actions[bot] ---
+
+def _make_pr(head_oid: str, reviews: list) -> dict:
+    return {
+        "headRefOid": head_oid,
+        "reviewDecision": "CHANGES_REQUESTED",
+        "reviews": {"nodes": reviews},
+        "reviewThreads": {"nodes": []},
+        "statusCheckRollup": {"contexts": {"nodes": []}},
+    }
+
+def test_github_actions_bot_changes_requested_current_head():
+    pr = _make_pr("abc", [
+        {"state": "CHANGES_REQUESTED", "author": {"login": "github-actions[bot]"}, "commit": {"oid": "abc"}}
+    ])
+    assert has_current_head_changes_requested(pr)
+
+def test_github_actions_bot_changes_requested_old_commit_not_blocking():
+    pr = _make_pr("newhead", [
+        {"state": "CHANGES_REQUESTED", "author": {"login": "github-actions[bot]"}, "commit": {"oid": "oldhead"}}
+    ])
+    assert not has_current_head_changes_requested(pr)
+
+def test_github_actions_bot_approval_not_recognised():
+    """github-actions[bot] APPROVED should not trigger auto-merge."""
+    pr = _make_pr("abc", [
+        {"state": "APPROVED", "author": {"login": "github-actions[bot]"}, "commit": {"oid": "abc"}}
+    ])
+    # reviewDecision is CHANGES_REQUESTED so the fallback won't fire either
+    pr["reviewDecision"] = "REVIEW_REQUIRED"
+    assert not has_current_head_approval(pr)