Too many mentions in allow lists cases too few names to be considered

[ckittel]

Compiled gh-aw version: v0.86.2

Example output from a recent run:

Found 237 unique mentions in text
Mention limit exceeded: 237 mentions found, processing only first 50
[MENTIONS] Mention limit exceeded: 50 mentions, limiting to 7
[OUTPUT COLLECTOR] Allowed mentions: abossard, achocron, akanso, akhan-msft, Albertyang0, aloshalaa1992-MSFT, amattas
Escaped mention: @barnstee (not in allowed list)
Escaped mention: @claytonsiemens77 (not in allowed list)
Escaped mention: @ckittel (not in allowed list)

The shared configuration has max: 7 and an allowed list of 237 accounts. gh-aw's resolveAllowedMentionsFromPayload builds fake mention text from the full configured allowlist, resolves it, and then applies max to that resolved identity list. As a result, only the first seven alphabetically sorted allowed accounts survive ingestion. Valid accounts later in the allowlist are neutralized into code spans before the comment handler posts them.

Implementation: resolve_mentions_from_payload.cjs

Expected behavior

safe-outputs.mentions.max should cap live mentions in each output message. It shouldn't truncate the configured set of identities that are permitted to be mentioned. An allowed identity should consume the limit only when that identity appears in the message.

In this scenario, it should have considered the first 50 candidates, not just the first seven candidates.

Requested change

• Preserve the complete configured allowlist during mention authorization.
• Apply max only to approved mentions that actually occur in each output message.
• Add a regression test with an allowlist larger than max and a message containing no more than max permitted users whose names occur late in the allowlist.

Addresses an internal issue we are tracking: MicrosoftDocs/architecture-center-pr#16523