mosaicstack/stack
16
0
Fork 1
Code Issues 330 Pull Requests 12 Actions Packages Projects Releases 15 Wiki Activity

issue-comment.sh takes the body only in argv (-c): no -F/--file, so long comments ride the process table and ARG_MAX #1233

New Issue
Open
opened 2026-08-15 21:26:56 +00:00 by Ghost · 0 comments
Ghost commented 2026-08-15 21:26:56 +00:00
Copy Link
Copy Source

What is missing

issue-comment.sh accepts the comment body only as an argv string:

issue-comment.sh -i <issue_number> -c <comment> [--login <name>]

There is no -F/--file and no stdin form. Every long comment therefore has to be interpolated
into the command line by the caller.

Why that is worse than an ergonomic complaint

  • The body lands in the process table. Anything passed in argv is readable by every process on
    the host for the lifetime of the call. For a review summary that is merely untidy; the framework
    also forbids credential values in any output, and argv is output. A file-based path removes a
    standing opportunity to get that wrong, which is the cheapest kind of fix.
  • It caps the body at ARG_MAX. A structured review verdict, a CI failure excerpt, or a
    measurement table is exactly the kind of comment that is long, and it fails at a size that has
    nothing to do with the forge's own limits.
  • Quoting is the caller's problem. A body containing backticks, $, or an embedded quote has
    to survive one more layer of shell than it should. The workaround everybody converges on is
    -c "$(cat body.md)", which fixes the quoting and fixes neither of the two problems above.

issue-create.sh has the same shape (-b BODY) and would benefit from the same flag, but the
comment path is the one that carries long bodies routinely, so it is the one worth fixing first.

Suggested shape

-F, --body-file FILE (and -F - for stdin), mutually exclusive with -c, refusing rather than
silently preferring one when both are given. The existing create-then-read-back verification is
unaffected — only the source of the string changes.

## What is missing `issue-comment.sh` accepts the comment body only as an argv string: ``` issue-comment.sh -i <issue_number> -c <comment> [--login <name>] ``` There is no `-F`/`--file` and no stdin form. Every long comment therefore has to be interpolated into the command line by the caller. ## Why that is worse than an ergonomic complaint - **The body lands in the process table.** Anything passed in argv is readable by every process on the host for the lifetime of the call. For a review summary that is merely untidy; the framework also forbids credential values in any output, and argv is output. A file-based path removes a standing opportunity to get that wrong, which is the cheapest kind of fix. - **It caps the body at `ARG_MAX`.** A structured review verdict, a CI failure excerpt, or a measurement table is exactly the kind of comment that is long, and it fails at a size that has nothing to do with the forge's own limits. - **Quoting is the caller's problem.** A body containing backticks, `$`, or an embedded quote has to survive one more layer of shell than it should. The workaround everybody converges on is `-c "$(cat body.md)"`, which fixes the quoting and fixes neither of the two problems above. `issue-create.sh` has the same shape (`-b BODY`) and would benefit from the same flag, but the comment path is the one that carries long bodies routinely, so it is the one worth fixing first. ## Suggested shape `-F, --body-file FILE` (and `-F -` for stdin), mutually exclusive with `-c`, refusing rather than silently preferring one when both are given. The existing create-then-read-back verification is unaffected — only the source of the string changes.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-be-01 (Mosaic fleet seat code-be-01) code-be-02 (Mosaic fleet seat code-be-02) code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1233