fix(update_project): parse string-typed `fields` instead of iterating over characters by Copilot · Pull Request #45825 · github/gh-aw

Copilot · 2026-07-15T21:38:36Z

When an agent double-encodes fields as a JSON string (e.g. "fields": "{\"Lifecycle\":\"Sandbox\"}") instead of a plain object, Object.entries() iterates over character indices ["0","{"], ["1","\""], …, silently creating one SINGLE_SELECT project field per character. The board gets polluted with numeric junk fields that require manual GraphQL cleanup.

Root cause

Both call sites in updateProject passed output.fields directly to applyFieldUpdates after only a truthiness + Object.keys().length check — no type guard.

Changes

resolveFieldsObject() helper — added before applyFieldUpdates:
- If fields is a string → attempt JSON.parse; warn and return null on failure
- Explicitly handles null after parse (e.g. JSON 'null')
- Rejects arrays and other non-object types with a core.warning
- Returns a plain object otherwise
Both call sites in updateProject (draft issue path and regular issue path) now route through resolveFieldsObject before invoking applyFieldUpdates

// Before — guard passes for any truthy value including a string
if (output.fields && Object.keys(output.fields).length > 0) {
  await applyFieldUpdates(github, projectId, itemId, output.fields);
}

// After — string is parsed; non-objects are warned and skipped
const resolvedFields = resolveFieldsObject(output.fields);
if (resolvedFields && Object.keys(resolvedFields).length > 0) {
  await applyFieldUpdates(github, projectId, itemId, resolvedFields);
}

Tests: three new cases — valid JSON-encoded string (parsed and applied correctly), invalid JSON string (warned + skipped), and array (warned + skipped)

When output.fields is a JSON-encoded string (agent double-encoding), the old code iterated over character indices and created bogus SINGLE_SELECT project fields named 0, 1, 2, … Add resolveFieldsObject() which: - Parses a string value via JSON.parse, warns and returns null on failure - Explicitly handles null after parsing (e.g. JSON 'null') - Rejects arrays and other non-object types with a warning Both call sites in updateProject now use this helper. Fixes #44845 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

This PR hardens update_project against agent outputs that mistakenly double-encode fields as a JSON string, preventing Object.entries() from iterating character indices and creating junk project fields.

Changes:

Added resolveFieldsObject() to coerce fields into a plain object (including parsing valid JSON strings) and warn/skip on invalid types.
Routed both applyFieldUpdates call sites through resolveFieldsObject() to avoid accidental per-character iteration.
Added tests covering JSON-string fields, invalid JSON strings, and array inputs.

Show a summary per file

File	Description
actions/setup/js/update_project.cjs	Adds `resolveFieldsObject()` and uses it at both field-update call sites to prevent accidental junk field creation.
actions/setup/js/update_project.test.cjs	Adds regression tests for double-encoded `fields` and other invalid `fields` shapes.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 2
Review effort level: Low

+    core.warning("update_project: `fields` must be a JSON object; skipping field updates");
+    return null;
+  }
+  return /** @type {Record<string, unknown>} */ fields;


    expect(mockCore.warning).toHaveBeenCalledWith(expect.stringContaining('Failed to create field "NonExistentField"'));
  });

+  it("warns and skips field updates when fields is a JSON-encoded string (double-encoded)", async () => {


gh-aw-bot · 2026-07-15T22:20:53Z

@copilot please run the pr-finisher skill, investigate the failing JavaScript checks (js-typecheck and impacted-js-tests), address any outstanding review feedback, and push fixes so the PR is ready for maintainer review.

Generated by 👨‍🍳 PR Sous Chef · 8.83 AIC · ⌖ 6 AIC · ⊞ 7.5K · ◷
_{Comment /souschef to run again}

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot · 2026-07-15T22:39:02Z

@copilot please run the pr-finisher skill, investigate the failing JavaScript checks (js-typecheck and impacted-js-tests), address any outstanding review feedback, and push fixes so the PR is re...

Implemented fixes in 742360c. Investigated failing js-typecheck/impacted-js-tests logs, applied the type-check-safe resolveFieldsObject cast adjustment in /home/runner/work/gh-aw/gh-aw/actions/setup/js/update_project.cjs, and renamed the misleading JSON-string test in /home/runner/work/gh-aw/gh-aw/actions/setup/js/update_project.test.cjs. Local validation passed: npm run typecheck, targeted vitest update_project.test.cjs, plus make fmt, make lint, make test-unit, and make test.

github-actions · 2026-07-16T01:03:06Z

🤖 PR Triage

Field	Value
Category	`bug`
Risk	`low`
Score	60 / 100
Action	`fast_track`
Batch	`js-runtime-fixes` (with #45827, #45826)

Score breakdown: Impact 28 + Urgency 18 + Quality 14

Fixes update_project silently iterating over JSON string characters when fields is double-encoded. Adds JSON.parse guard + tests (2 files). CI unknown — awaiting checks. Part of JS runtime fixes batch.

Run §29462479491

Generated by 🔧 PR Triage Agent · 189.6 AIC · ⌖ 5.52 AIC · ⊞ 5.6K · ◷

pelikhan · 2026-07-16T04:20:36Z

@copilot fix https://github.com/github/gh-aw/actions/runs/29456102257/job/87532870026#step:7:1

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-07-16T04:55:50Z

@copilot fix https://github.com/github/gh-aw/actions/runs/29456102257/job/87532870026#step:7:1

Fixed in b2851bb. I investigated the failing step and updated resolveFieldsObject in actions/setup/js/update_project.cjs to return a normalized object shape that satisfies js-typecheck while preserving the field parsing/validation behavior. Verified locally with npm run typecheck and impacted JS tests (make test-impacted-js BASE_REF=origin/main).

github-actions · 2026-07-16T06:41:53Z

🎉 This pull request is included in a new release.

Release: v0.82.10

Initial plan

4b291f9

Copilot AI assigned Copilot and pelikhan Jul 15, 2026

Copilot started work on behalf of pelikhan July 15, 2026 21:38 View session

Copilot AI linked an issue Jul 15, 2026 that may be closed by this pull request

update_project: a string-typed fields value creates bogus per-character project fields (0, 1, 2, …) #44845

Closed

Copilot AI changed the title ~~[WIP] Fix bogus per-character project fields in update_project~~ fix(update_project): parse string-typed fields instead of iterating over characters Jul 15, 2026

Copilot finished work on behalf of pelikhan July 15, 2026 22:02

Copilot AI requested a review from pelikhan July 15, 2026 22:02

pelikhan marked this pull request as ready for review July 15, 2026 22:07

Copilot AI review requested due to automatic review settings July 15, 2026 22:07

Copilot started reviewing on behalf of pelikhan July 15, 2026 22:07 View session

Copilot AI reviewed Jul 15, 2026

View reviewed changes

github-actions Bot mentioned this pull request Jul 15, 2026

[pr-sous-chef] Run report — 0 nudged, 0 skipped #45581

Closed

Copilot started work on behalf of gh-aw-bot July 15, 2026 22:21 View session

fix(js): address typecheck and test-name feedback in update_project

742360c

Co-authored-by: gh-aw-bot <259018956+gh-aw-bot@users.noreply.github.com>

Copilot finished work on behalf of gh-aw-bot July 15, 2026 22:39

Copilot AI requested a review from gh-aw-bot July 15, 2026 22:39

github-actions Bot mentioned this pull request Jul 16, 2026

[pr-sous-chef] Run report — 0 nudged, 9 skipped #45855

Open

github-actions Bot added pr-action:fast_track pr-agent:copilot pr-batch:js-runtime-fixes pr-priority:medium pr-risk:low pr-type:bug labels Jul 16, 2026

This was referenced Jul 16, 2026

fix: fast-fail copilot harness when LLM invocation cap is saturated #45827

Merged

fix: add maxLength: 65536 to body/content fields to exempt from SM-IS-01 10 KB cap #45826

Merged

Copilot started work on behalf of pelikhan July 16, 2026 04:20 View session

Copilot AI and others added 2 commits July 16, 2026 04:54

fix(update_project): avoid ts-check cast issue in resolveFieldsObject

a42b761

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix(update_project): return normalized object for fields type narrowing

b2851bb

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot finished work on behalf of pelikhan July 16, 2026 04:56

pelikhan merged commit cc4ca71 into main Jul 16, 2026
14 checks passed

pelikhan deleted the copilot/update-project-bogus-fields branch July 16, 2026 05:01

github-actions Bot mentioned this pull request Jul 16, 2026

Suggested test: copilot/update-project githubnext/gh-aw-test#7434

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(update_project): parse string-typed `fields` instead of iterating over characters#45825

fix(update_project): parse string-typed `fields` instead of iterating over characters#45825
pelikhan merged 5 commits into
mainfrom
copilot/update-project-bogus-fields

Copilot AI commented Jul 15, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

gh-aw-bot commented Jul 15, 2026

Uh oh!

Copilot AI commented Jul 15, 2026

Uh oh!

github-actions Bot commented Jul 16, 2026

Uh oh!

pelikhan commented Jul 16, 2026

Uh oh!

Copilot AI commented Jul 16, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Copilot AI commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Root cause

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

gh-aw-bot commented Jul 15, 2026

Uh oh!

Copilot AI commented Jul 15, 2026

Uh oh!

github-actions Bot commented Jul 16, 2026

🤖 PR Triage

Uh oh!

pelikhan commented Jul 16, 2026

Uh oh!

Copilot AI commented Jul 16, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Jul 15, 2026 •

edited

Loading