ci: reject @mentions in pull request descriptions

[thepastaclaw]

Issue being fixed or feature implemented

PR descriptions that include GitHub username mentions get copied into merge commits. After that, those people get notified again whenever the PR is merged, rebased, or backported. See #7493 for the motivating case ("Thanks knst" / similar mentions in a release PR description).

This change makes CI fail when a PR description contains those mentions.

What was done?

Extended the existing semantic PR title workflow (.github/workflows/semantic-pull-request.yml) so it also validates the PR description:

• Renamed the workflow/job to cover title and description
• Kept the existing conventional-commit title check (amannn/action-semantic-pull-request@v6) unchanged
• Added a step that reads github.event.pull_request.body via env on pull_request_target (opened / edited / synchronize), writes it to a file, and fails on GitHub-style @username mentions
• Email addresses and empty descriptions are allowed
• Failure message explains the merge/rebase/backport notification problem

How Has This Been Tested?

• YAML parses cleanly
• git diff --check upstream/develop...HEAD clean
• Local regex checks (same pattern as the workflow step):
  • Thanks @knst. → fail
  • @PastaPastaPasta please look → fail
  • contact dev@example.com → pass
  • no mentions here / empty body / bare @ / @@ diff markers → pass

Breaking Changes

None. Existing PRs with @username mentions in their description will fail this check on the next edited / synchronize event until the mentions are removed.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have added or updated relevant unit/integration/functional/e2e tests
• I have made corresponding changes to the documentation
• I have assigned this pull request to a milestone (for repository code-owners and collaborators only)

[thepastaclaw]

⛔ Blockers found — Sonnet deferred (commit 9bc7ed5)
Canonical validated blockers: 1

[knst]

Nack

No new bash code please.

Firstly, it is full of bashism (set -euo pipefail) which is not part of 'sh' standard, 2ndly it is difficult to write to make it safe, reliable and avoid any injections.
Consider calling dedicated python script instead if really need.

[thepastaclaw]

Addressed knst's nack in e076f3e.

Replaced the inline bash/grep -P step with a dedicated Python helper:

• .github/workflows/check_pr_description_mentions.py
• focused unit tests in .github/workflows/test_check_pr_description_mentions.py

Workflow now checks out the trusted base branch only (actions/checkout@v6, persist-credentials: false) and runs:

python3 .github/workflows/check_pr_description_mentions.py

with the untrusted PR body only via PR_BODY env (no shell interpolation of body content).

[thepastaclaw]

Preliminary review — Codex only

The current head addresses knst's older-SHA request by replacing the inline Bash implementation with a dedicated Python helper, passing the untrusted PR body through the environment, and adding 18 passing unit tests. Two blocking issues remain: renaming the job removes an existing required-check context, and the mention regex misses punctuation-adjacent mentions while rejecting some valid email addresses. The implementation rewrite and executable-mode follow-up should also be squashed into the original feature commit to keep the history coherent and bisectable.

Source: reviewers codex/general=gpt-5.6-sol(completed); codex/dash-core-commit-history=gpt-5.6-sol(completed); verifier=codex/verifier=gpt-5.6-sol(completed); coordinator=openclaw-agent/cliproxy/gpt-5.6-sol(orchestration-only).

Validated blockers were found in the Codex precheck. Sonnet is deferred until a fresh Codex revalidation clears the blocker gate.

Review provenance

• Codex reviewers: gpt-5.6-sol — general (completed), gpt-5.6-sol — dash-core-commit-history (completed)
• Verifier: gpt-5.6-sol — verifier
• Sonnet: not run (deferred by blocker gate)

🔴 2 blocking | 🟡 1 suggestion(s)

1 additional finding(s) omitted (not in diff).

🤖 Prompt for all review comments with AI agents

These findings are from an automated code review. Verify each finding against the current code and only fix it if needed.

In `.github/workflows/semantic-pull-request.yml`:
- [BLOCKING] .github/workflows/semantic-pull-request.yml:12: Preserve the existing required-check name
  `Validate PR title` is currently a required check for this repository; GitHub's status-check metadata for PR #7496 marks that exact context as required. Changing the job display name makes future workflow runs emit `Validate PR title and description` instead, leaving the configured `Validate PR title` requirement permanently pending and blocking subsequent PRs from merging. Keep the existing job name; the new description-validation step can run within it, while the top-level workflow name can still describe the expanded behavior.

In `.github/workflows/check_pr_description_mentions.py`:
- [BLOCKING] .github/workflows/check_pr_description_mentions.py:30-32: Detect complete emails instead of suppressing punctuation-adjacent mentions
  The negative lookbehind treats `.`, `+`, and `-` as email-local characters without establishing that the surrounding text is an email. GitHub renders `Thanks.@knst` and `cc +@knst` as user mentions, but `find_mentions()` returns no matches for either, allowing notifications that this check is intended to prevent. Conversely, valid dot-atom addresses such as `dev!@example.com` are not rendered by GitHub as mentions but are rejected here as `@example`. Detect complete email spans separately from mention candidates and add tests for punctuation-adjacent mentions and valid email local-part characters.

In `<commit:e076f3e>`:
- [SUGGESTION] <commit:e076f3e>:1: Squash the implementation rewrite and mode fix into the feature commit
  Commit e076f3e1da2 replaces the inline Bash implementation introduced by 14715262e19 with the final Python implementation and tests, so these are successive revisions of one unshipped feature rather than independent logical changes. Commit 67a1e412ac5 only fixes the executable modes of the files added by e076f3e1da2, meaning that intermediate commit does not satisfy `lint-files` independently. Squash both follow-ups into 14715262e19 so the permanent history introduces the final tested implementation with correct modes in one coherent, bisectable commit.

Note: GitHub does not allow PastaClaw to submit an approval or request changes on their own PR, so the canonical verifier result is transported as a COMMENT review.

[thepastaclaw]

Addressed the current review findings in 9bc7ed53296f:

• restored the required check context to Validate PR title
• detect complete email spans separately, so punctuation-adjacent mentions are rejected while addresses such as dev!@example.com remain allowed
• folded the Python implementation, executable modes, and review fixes into one coherent feature commit

Validation: 23 focused unit tests, Python bytecode compilation, Flake8 (excluding the repository-ignored E501 rule), YAML parsing, and git diff --check.

[thepastaclaw]

The linux64_tsan-test / Test source failure is unrelated to this PR and the branch is proper as-is.

p2p_node_network_limited.py --v2transport hit the known intermittent race tracked in #7288: after the test intentionally requests a block below the NODE_NETWORK_LIMITED threshold, node 0 disconnects the peer before connect_nodes(0, 2) observes its expected pong. All three retries failed with AssertionError: Error: peer disconnected; there is no ThreadSanitizer race report.

This PR changes only the PR-description workflow and its Python helper/tests. It does not touch the failing functional test, connection helper, networking, or NODE_NETWORK_LIMITED logic. The same test also passed in the non-TSAN lanes on this exact head. No branch change or CI retrigger was made; maintainers can rerun the lane if desired.