Format {files} placeholders as inline code in JS template rendering

[Copilot]

{files} values were rendered as raw comma-separated text, which made multi-file output harder to scan. This change adds dedicated {files} rendering so filenames are consistently markdown-formatted and unsafe input is rejected.

• Template rendering behavior

  • Added special handling for the files expression in actions/setup/js/messages_core.cjs.
  • Treats files as a comma-separated list, trims entries, drops empty segments, and renders each filename as an inline code span.

• Input safety

  • Rejects any filename containing backticks to prevent malformed markdown/injection in rendered output.
  • Error now includes the offending filename for fast diagnosis.

• Coverage updates

  • Extended actions/setup/js/messages_core.test.cjs with focused cases for:
    • standard comma-separated file lists,
    • backtick-containing filename rejection,
    • empty files input behavior,
    • file-template rendering path (renderTemplateFromFile).

renderTemplate("Changed files: {files}", {
  files: "a.txt,b/c.md, docs/readme.md ",
});
// => "Changed files: `a.txt`, `b/c.md`, `docs/readme.md`"

[pelikhan]

@copilot do not throw, replace with redacted. Handle case where file names have been pre wrapped in back ticks

[Copilot]

Updated in commit 7a8f39b.

{files} rendering now avoids throwing, supports filenames that are already wrapped in backticks, and redacts unsafe entries as `redacted`.

[Copilot]

Pull request overview

This PR updates JS template rendering so {files} placeholders are rendered as inline-code filenames (improving readability of multi-file output) and updates action pin/lock data for docker/metadata-action@v6.

Changes:

• Added special {files} handling in actions/setup/js/messages_core.cjs to split comma-separated file lists and wrap each filename in inline code.
• Added/extended vitest cases around {files} rendering (including empty input and backtick-containing entries) and file-based template rendering.
• Updated action pin/lock data to include docker/metadata-action@v6 and updated the pinned SHA in the release workflow lock.

Show a summary per file

File	Description
actions/setup/js/messages_core.cjs	Implements special {files} placeholder rendering logic.
actions/setup/js/messages_core.test.cjs	Adds tests covering {files} formatting behavior and render-from-file path.
pkg/workflow/data/action_pins.json	Adds docker/metadata-action@v6 pin entry.
pkg/actionpins/data/action_pins.json	Adds docker/metadata-action@v6 pin entry.
.github/aw/actions-lock.json	Adds docker/metadata-action@v6 pin entry for GitHub Actions locking.
.github/workflows/release.lock.yml	Updates the pinned docker/metadata-action SHA used in the release workflow.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

actions/setup/js/messages_core.cjs:101

• PR description says backtick-containing filenames are rejected and the error includes the offending filename, but the implementation/test suite currently silently replaces those entries with redacted. Please align either the behavior (throw with a helpful message) or the PR description/tests so consumers know whether this is a hard failure or a soft-sanitize.

          if (!normalized || normalized.includes("`")) {
            normalized = "redacted";
          }
          return `\`${normalized}\``;

• Files reviewed: 6/6 changed files
• Comments generated: 2

[pelikhan]

@copilot move logic into a helper "renderFilesList" and apply to call sites instead

[github-actions]

@copilot review all comments and address the unresolved review feedback.
Please extract renderFilesList and update the call sites so this blocker can move forward.

Generated by 👨‍🍳 PR Sous Chef · ● 2.7M · ◷

[Copilot]

@copilot move logic into a helper "renderFilesList" and apply to call sites instead

Updated in commit d79ea31.