fix: gate /format command behind authorized-commenter check via slash…

[Tamcodes4]

Description

Fixes a GitHub Actions security vulnerability where /format could be triggered by any commenter, including a PR author on their own fork — letting untrusted code run inside a job holding contents: write and a live GITHUB_TOKEN ("pwn request" pattern).

Previously, /format was handled directly from the issue_comment event, allowing untrusted fork content to reach a workflow with write permissions. This change moves authorization into slash-command-dispatch, ensuring only authorized commenters can dispatch the formatting workflow before any PR code is checked out or executed. This follows the maintainer's preferred approach of using peter-evans/slash-command-dispatch rather than adding manual author_association checks.

Linked Issue

#236 (merging to test the workflow, follow-up PR possible)

Changes Made

• Added .github/workflows/slash-command-dispatch.yml: new workflow, the only one now listening to issue_comment. Uses peter-evans/slash-command-dispatch@v5 with permission: write, so the commenter's repo access is verified before any dispatch event is created. No PR/fork code is ever checked out in this job.
• Rewrote .github/workflows/format-command.yml: now triggers only on repository_dispatch (type format-command) instead of issue_comment, so it's unreachable except via an authorized dispatch. Checkout, Prettier, and commit/push logic are unchanged from the original. Also added a failure-comment step so a broken Prettier run no longer fails silently.
• Contributor-facing behavior is unchanged, commenting /format on a PR still works the same way for contributors.

⚠️ Maintainer action required after merge: peter-evans/slash-command-dispatch requires a repo-scoped Personal Access Token — GITHUB_TOKEN cannot create dispatch events. Please add one as a repository secret named PAT (Settings → Secrets and variables → Actions → New repository secret), or /format will not dispatch.

Type of Change

• Bug fix
• New feature
• UI/Visual update
• Documentation update
• Refactor

Testing

• Tested locally
• Tested on mobile viewport (if applicable)
• No console errors introduced

Validated both workflow files with actionlint (no errors) and cross-checked the client_payload field paths (pull_request.head.repo.full_name, pull_request.head.ref, github.payload.issue.number) against the action's official documentation. Full end-to-end testing of the live dispatch requires the PAT secret to exist on this repo, which I don't have access to add, so I wasn't able to test the actual /format flow against this repository. Happy to verify together once the secret is added.

Checklist

• My code follows the project's coding style
• I have formatted my code locally by running npx prettier --write . before submitting
• I am submitting my PR from a dedicated feature/* branch, not the main branch
• I have performed a self-review of my code
• My changes generate no new warnings or errors
• I have updated documentation if required
• I have linked the relevant issue

Screenshots / Screen Recording

N/A — this is a CI/workflow-only change with no UI impact.

[github-actions]

Thank you for submitting a pull request.

Please ensure your changes comply with the project's contribution guidelines and that all workflow checks pass successfully.

Formatting and Branching

• Please confirm you have formatted your code locally using npx prettier --write ., or you can simply comment /format on this PR to have our bot do it for you!
• Ensure this PR is made from a feature/* branch and not main.

Note: This project is currently maintained by a solo maintainer, so reviews and responses may sometimes take a little time. Thanks for your patience.

[Tamcodes4]

Hey @jagdish-15, kindly review this pr...

[jagdish-15]

/format

[jagdish-15]

/format

[jagdish-15]

I don't think the above command will work right now, since this PR changes that very workflow.

Could you format the files locally and push the changes instead? That way, I can merge this PR, test the updated workflow, and let you know if any amendments are required. If needed, you can then open a follow-up PR.

[Tamcodes4]

/format

[github-actions]

I have successfully run Prettier and pushed the formatting fixes to this PR.

Note for Contributors: Because this commit was pushed by a bot, GitHub will not automatically re-run the CI checks. To trigger them to pass, you must either:

• Push an empty commit locally (git commit --allow-empty -m "Trigger builds" and push)
• Close and immediately reopen this Pull Request.

[Tamcodes4]

@jagdish-15 the latest commit needs workflow approval to run CI (fork PR, GitHub requires manual approval for first-time/external runs). Ready for review whenever you have a chance.