Skip to content

Limit attachment batches to 50 files - #14289

Merged
BagToad merged 1 commit into
trunkfrom
bagtoad/limit-attachment-batches
Aug 28, 2026
Merged

Limit attachment batches to 50 files#14289
BagToad merged 1 commit into
trunkfrom
bagtoad/limit-attachment-batches

Conversation

@BagToad

@BagToad BagToad commented Aug 28, 2026

Copy link
Copy Markdown
Member

Related implementation: Make commands own attachment flag policy

Description

The repeatable --attach flag currently has no per-command value limit. A
single command can therefore begin validating and uploading an arbitrarily
large batch of local files.

This caps each invocation at 50 attachment values in the shared flag resolver.
The check runs after command-owned conflicts and before attachment path
validation, uploads, or issue and pull request updates. It counts images and
videos together, including duplicate or invalid paths.

The six supported issue and pull request commands now document the limit in
their detailed help. The installable gh skill contains the same guidance.

How did you test this change?

I ran the local gh issue create implementation with 51 generated --attach
values that named missing files. It stopped before reporting a missing path and
printed:

`--attach` accepts at most 50 values per command

I also rendered gh issue create --help. The detailed help said that a command
can attach up to 50 files, while the flag table retained its concise file-format
description.

Key points

  • The unexported limit is enforced once for all six commands.
  • The count combines images and videos and precedes file validation.
  • Existing command-owned conflict errors keep their precedence.
  • The limit applies only to one process invocation and adds no persistent state.
  • Detailed command help carries the limit without expanding the shared flag row.

Notes for reviewers

Start with the shared flag resolution and its 50 and 51 boundary cases. The six
command edits only add the same sentence to detailed help.

The placement preserves the command-owned policy boundary established in
PR #14255.

Authorship and follow-up

Who wrote this:

  • A human wrote it.
  • An agent wrote it under close human direction.
  • An agent wrote it independently, and no human has guided the implementation beyond the initial prompt.

Who answers review comments:

  • @BagToad will read and reply directly. Name the account.
  • An agent will draft replies and @username will read them before they are posted.
  • Nobody has explicitly committed to replying.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI balanced review requested due to automatic review settings August 28, 2026 18:21
@BagToad
BagToad requested a review from a team as a code owner August 28, 2026 18:21
@BagToad
BagToad requested a review from tidy-dev August 28, 2026 18:21
@BagToad
BagToad requested a review from babakks August 28, 2026 18:24

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

Review tier: Balanced
Findings: 1 Medium severity

New issues introduced by this change (1)
Severity Finding
Medium severity internal/​attachments/​flags.go — 🛑 Requirement: Obtain explicit maintainer approval for this breaking CLI contract change. A script…
What changed in this PR

Caps each command invocation at 50 attachment values to prevent unbounded validation and uploads.

Changes:

  • Enforces and tests the 50-value boundary.
  • Documents the limit across six commands.
  • Updates the installable gh skill guidance.
File Description
internal/​attachments/​flags.go Enforces the limit.
internal/​attachments/​flags_test.go Tests boundary behavior.
pkg/​cmd/​issue/​create/​create.go Updates create help.
pkg/​cmd/​issue/​edit/​edit.go Updates edit help.
pkg/​cmd/​issue/​comment/​comment.go Updates comment help.
pkg/​cmd/​pr/​create/​create.go Updates create help.
pkg/​cmd/​pr/​edit/​edit.go Updates edit help.
pkg/​cmd/​pr/​comment/​comment.go Updates comment help.
skills/​gh/​SKILL.md Documents the limit for agents.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Comment thread internal/attachments/flags.go
@BagToad
BagToad enabled auto-merge August 28, 2026 18:27
@BagToad
BagToad merged commit 40b742f into trunk Aug 28, 2026
19 checks passed
@BagToad
BagToad deleted the bagtoad/limit-attachment-batches branch August 28, 2026 18:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants