<!-- ccr-overview-v2 -->

[leuasseurfarrelds247-arch]

Copilot review overview

🟡 Changes recommended

The sanitizer still has source-corruption and URL-masking edge cases that weaken its fidelity and security guarantees.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Balanced
Findings: 4

New issues introduced by this change (4)

Severity	Finding
	pkg/​sanitize/​sanitize.go — This fallback escapes every ampersand, including those inside inline, fenced, and indented code.…
	pkg/​sanitize/​sanitize.go — The bare-URL detector treats every alphabetic scheme:// token as safely visible, although the…
	pkg/​sanitize/​sanitize.go — These loops cast individual UTF-8 bytes to runes, so Unicode whitespace is never recognized. With…
	pkg/​sanitize/​sanitize.go — This lookup is case-sensitive even though URI schemes are case-insensitive. A valid CommonMark…

What changed in this PR

Introduces Markdown-aware sanitization to preserve code-bearing GitHub content while neutralizing hidden constructs.

Changes:

• Adds Goldmark-based sanitize.Content.
• Applies it across bodies, comments, releases, commits, and sub-issues.
• Adds extensive tests, benchmarks, and license metadata.

File	Description
pkg/​sanitize/​sanitize.go	Implements Markdown-aware sanitization.
pkg/​sanitize/​sanitize_test.go	Tests fidelity, safety, and performance.
pkg/​github/​minimal_types.go	Applies content sanitization to converters.
pkg/​github/​issues.go	Sanitizes issue and sub-issue responses.
pkg/​github/​issues_test.go	Tests sub-issue sanitization.
pkg/​github/​repositories.go	Sanitizes releases and blame messages.
pkg/​github/​repositories_test.go	Tests release and blame behavior.
pkg/​github/​discussions.go	Preserves discussion body content.
pkg/​github/​discussions_test.go	Updates discussion expectations.
pkg/​github/​projects.go	Uses content policy for status updates.
pkg/​github/​sanitize_coverage_test.go	Expands policy coverage tests.
go.mod	Adds Goldmark dependency.
go.sum	Records Goldmark checksums.
third-party/​github.com/​yuin/​goldmark/​LICENSE	Adds Goldmark’s license.
third-party-licenses.linux.md	Updates Linux licenses.
third-party-licenses.darwin.md	Updates macOS licenses.
third-party-licenses.windows.md	Updates Windows licenses.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Originally posted by @copilot-pull-request-reviewer in github/github-mcp-server#3177 (review)