ci: support cross-repo and private issue references in link-issue workflow

[mbiuki]

Summary

• Extends issue_comp_link-issue-to-pr.yml to accept owner/repo#NUMBER and full GitHub URL formats alongside the existing same-repo #NUMBER detection
• Cross-repo references (e.g. Closes dotCMS/private-issues#642) now pass the check without requiring a public placeholder issue
• Team-label validation passes gracefully when the linked issue is in a private/inaccessible repo
• Same-repo-only side effects (PR-list comment on the issue, bare #N appended to PR body) are skipped for cross-repo references to avoid creating broken links
• Failure comment updated to document all three supported reference formats

Test plan

• PR with Fixes dotCMS/private-issues#N passes link-issue check
• PR with Closes https://github.com/dotCMS/private-issues/issues/N passes link-issue check
• PR with Fixes #N (same-repo) continues to pass and still gets the PR-list comment on the linked issue
• PR with no issue reference still fails with the updated failure comment showing all three options

References

Closes #36457

🤖 Generated with Claude Code

[claude]

Claude finished @mbiuki's task in 3m 12s —— View job

---

Review: cross-repo & private issue references

I reviewed the full diff against origin/main and traced the detection logic, the self-reference routing, and every downstream is_cross_repo guard.

New Issues

• 🟡 Medium: .github/workflows/issue_comp_link-issue-to-pr.yml:293-307 — the cross-repo branch passes unconditionally whenever the linked repo is inaccessible. Because a private/nonexistent repo and a genuinely-private-but-real issue are indistinguishable with the default GITHUB_TOKEN, any body containing a keyword + word/word#N (e.g. Fixes foo/bar#1) satisfies the gate even if the issue doesn't exist. This is an inherent tradeoff of supporting private trackers, and it's documented in the comments, so it's non-blocking — but it does weaken the "every PR is linked to a real, team-owned issue" guarantee. If you want to tighten it later, consider requiring the cross-repo owner to be on an allowlist (e.g. dotCMS/*) before treating an access failure as implicit approval.
  • Assumption: the workflow token cannot read dotCMS/private-issues; what to verify: whether a real 404 (typo'd repo) vs 403 (private) can be distinguished from gh issue view's exit code — if so, a bogus-repo typo could be rejected while private repos still pass.

Resolved

• ✅ issue_comp_link-issue-to-pr.yml:91-92 — Priority: same-repo #N is now matched first, so Fixes #123 can't be shadowed by a stray owner/repo#N elsewhere in the body. Confirmed: the same-repo regex requires the keyword immediately followed by #, so an owner/repo#N token never satisfies it, and vice-versa.
• ✅ issue_comp_link-issue-to-pr.yml:119-125, 140-146 — Self-reference: both the owner/repo#N and full-URL branches now compare the extracted owner/repo case-insensitively to $GITHUB_REPOSITORY and re-route to the same-repo path (is_cross_repo=false, link_method=pr_body) so the PR-list comment and #N body-patch side effects still run. Confirmed correct.

Notes (non-blocking, verified OK)

• The full-URL case correctly falls through to the elif cross_url_match branch — the owner/repo#N regex can't match a https://… string because : isn't in its char class. ✅
• Downstream side-effect steps (Get existing issue comments, Check if comment already exists, Create/Update comment, Link PR to issue) all gate on is_cross_repo != 'true', so cross-repo refs won't post a bare #N or a broken same-repo comment. ✅
• GITHUB_REPOSITORY and GH_TOKEN are runner/job-level and available in these steps; ${var,,} lowercasing is safe on ubuntu-latest bash 5. ✅
• The existing var=$(… | grep | head) command-substitution pattern (relied on to return empty on no-match rather than aborting under the default -eo pipefail shell) is unchanged in behavior in the new branches, matching the already-in-production same-repo path. ✅

No blocking issues. The two previously-flagged concerns are genuinely resolved.

· branch ci/link-issue-cross-repo-support

[mbiuki]

Hey @nollymar — since you introduced and hardened this workflow (dc5ec7d), tagging you for review on this one. The fix adds support for cross-repo issue references (owner/repo#N and full GitHub URLs) so PRs tracking work in private repos don't fail the check. Would love your eyes on the detection logic and the downstream step conditions.

[mbiuki]

@nollymar The two issues flagged in the AI review are now fixed (commit 642ca0c). When you get a chance, could you take another look? Summary of what changed:

1. Priority — same-repo #N is now checked first, so Fixes #123 can't be shadowed by a stray owner/repo#N elsewhere in the body.
2. Self-reference — after extracting the owner/repo from a cross-repo match, we now compare it case-insensitively to $GITHUB_REPOSITORY; if they match it routes as same-repo so all side effects still run.

Thanks!