Limit attachment batches to 50 files - #14289
Merged
Merged
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Copilot review overview
Review tier: Balanced
Findings: 1
New issues introduced by this change (1)
| Severity | Finding |
|---|---|
internal/attachments/flags.go — 🛑 Requirement: Obtain explicit maintainer approval for this breaking CLI contract change. A script… |
What changed in this PR
Caps each command invocation at 50 attachment values to prevent unbounded validation and uploads.
Changes:
- Enforces and tests the 50-value boundary.
- Documents the limit across six commands.
- Updates the installable
ghskill guidance.
| File | Description |
|---|---|
internal/attachments/flags.go |
Enforces the limit. |
internal/attachments/flags_test.go |
Tests boundary behavior. |
pkg/cmd/issue/create/create.go |
Updates create help. |
pkg/cmd/issue/edit/edit.go |
Updates edit help. |
pkg/cmd/issue/comment/comment.go |
Updates comment help. |
pkg/cmd/pr/create/create.go |
Updates create help. |
pkg/cmd/pr/edit/edit.go |
Updates edit help. |
pkg/cmd/pr/comment/comment.go |
Updates comment help. |
skills/gh/SKILL.md |
Documents the limit for agents. |
💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
babakks
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

Related implementation: Make commands own attachment flag policy
Description
The repeatable
--attachflag currently has no per-command value limit. Asingle command can therefore begin validating and uploading an arbitrarily
large batch of local files.
This caps each invocation at 50 attachment values in the shared flag resolver.
The check runs after command-owned conflicts and before attachment path
validation, uploads, or issue and pull request updates. It counts images and
videos together, including duplicate or invalid paths.
The six supported issue and pull request commands now document the limit in
their detailed help. The installable
ghskill contains the same guidance.How did you test this change?
I ran the local
gh issue createimplementation with 51 generated--attachvalues that named missing files. It stopped before reporting a missing path and
printed:
I also rendered
gh issue create --help. The detailed help said that a commandcan attach up to 50 files, while the flag table retained its concise file-format
description.
Key points
Notes for reviewers
Start with the shared flag resolution and its 50 and 51 boundary cases. The six
command edits only add the same sentence to detailed help.
The placement preserves the command-owned policy boundary established in
PR #14255.
Authorship and follow-up
Who wrote this:
Who answers review comments: