🤔 Background
--report-md puts each failure message in a fenced code block, unescaped, because a fence renders its contents literally. That holds only while the fence is longer than any run of backticks inside it.
A hook that prints a bare ``` produces:
``` <- opening fence
oops
``` <- the message's own fence CLOSES the block
not code <- renders as prose, not code
``` <- opens a new, unterminated block
Reproduced with a set_up_before_script that prints oops\n```\nnot code and returns 1: the report ends with an odd number of fence delimiters, so every section after it is swallowed by an unterminated code block.
The Markdown report is auto-appended to $GITHUB_STEP_SUMMARY, so this corrupts the Actions job summary page — the place the report exists to be read.
The diff-rendered case survives by luck: assert_same wraps changed lines as [-```-], which is indented and not a bare delimiter. It is the undiffed messages — hook failures, source failures — that reach the report intact.
💡 Proposal
CommonMark closes a fence only with one at least as long as the opener, so grow the fence past the longest run of backticks present in the message. Fork-free and terminating: the message is finite, so some length is not a substring of it, and testing containment rather than equality finds the longest run (a message holding ```` contains ``` too).
💡 Found by
Continuing the report sweep from #1301/#1303 into the Markdown and HTML writers. HTML was clean — <script> is escaped and no stray ampersands — and the Markdown summary table has no message column to inject a | into. This was the one hole.
🤔 Background
--report-mdputs each failure message in a fenced code block, unescaped, because a fence renders its contents literally. That holds only while the fence is longer than any run of backticks inside it.A hook that prints a bare ``` produces:
Reproduced with a
set_up_before_scriptthat printsoops\n```\nnot codeand returns 1: the report ends with an odd number of fence delimiters, so every section after it is swallowed by an unterminated code block.The Markdown report is auto-appended to
$GITHUB_STEP_SUMMARY, so this corrupts the Actions job summary page — the place the report exists to be read.The diff-rendered case survives by luck:
assert_samewraps changed lines as[-```-], which is indented and not a bare delimiter. It is the undiffed messages — hook failures, source failures — that reach the report intact.💡 Proposal
CommonMark closes a fence only with one at least as long as the opener, so grow the fence past the longest run of backticks present in the message. Fork-free and terminating: the message is finite, so some length is not a substring of it, and testing containment rather than equality finds the longest run (a message holding ```` contains ``` too).
💡 Found by
Continuing the report sweep from #1301/#1303 into the Markdown and HTML writers. HTML was clean —
<script>is escaped and no stray ampersands — and the Markdown summary table has no message column to inject a|into. This was the one hole.