fix: handle SIGPIPE in Fetch PR changed files step to prevent missing delimiter error

[Copilot]

Root Cause

When the Security Guard workflow ran on PR #1648 (perf/security-guard-token-optimization), the "Fetch PR changed files" step failed with:

##[error]Unable to process file command 'output' successfully.
##[error]Invalid value. Matching delimiter not found 'GHAW_PR_FILES_1775255800'

Why it failed: GitHub Actions' default bash shell runs with -eo pipefail. When gh api ... | head -c 8000 executes and the PR diff exceeds 8000 bytes:

1. head -c 8000 reads exactly 8000 bytes and exits cleanly (exit 0)
2. gh api receives SIGPIPE (exit code 141) when it tries to write more data
3. With pipefail, the pipeline's exit code is 141 (non-zero)
4. With errexit, the subshell aborts before writing the closing delimiter echo "${DELIM}"
5. GITHUB_OUTPUT has the opening PR_FILES<<GHAW_PR_FILES_... but no closing delimiter → error

Fix

Added || true after head -c 8000 to swallow the SIGPIPE/pipefail error, ensuring the subshell always reaches echo "${DELIM}":

gh api ... | head -c 8000 || true
echo "${DELIM}"

Changes

• .github/workflows/security-guard.md — source workflow file
• .github/workflows/security-guard.lock.yml — compiled workflow file

Fixes failing job: https://github.com/github/gh-aw-firewall/actions/runs/23964770751/job/69902358339

[Copilot]

Pull request overview

This PR updates the Security Guard workflow’s “Fetch PR changed files” step to avoid a GitHub Actions GITHUB_OUTPUT delimiter error caused by bash -eo pipefail aborting on SIGPIPE when truncating large PR diffs.

Changes:

• Swallow the pipeline failure from gh api ... | head -c 8000 by appending || true so the closing delimiter is always written.
• Apply the same change to both the source workflow (.md) and the compiled workflow (.lock.yml).

Show a summary per file

File	Description
.github/workflows/security-guard.md	Adds `
.github/workflows/security-guard.lock.yml	Mirrors the same `

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 2

[Copilot]

| head -c 8000 || true prevents the delimiter-missing failure, but it also suppresses all non-zero exits from the pipeline (e.g., gh api auth/permission/rate-limit failures), which can cause the workflow to proceed with an empty/incomplete PR_FILES output and silently degrade the security review.

Consider handling only the expected SIGPIPE/pipefail case (exit 141) while still closing the delimiter, and re-failing the step for any other error (e.g., by temporarily disabling errexit around the pipeline, capturing the pipeline/PIPESTATUS exit code, then deciding whether to ignore or exit).

See below for a potential fix:

      pipeline_status=0
      pipe_status=()
      {
        echo "PR_FILES<<${DELIM}"
        set +e
        gh api "repos/${GH_REPO}/pulls/${PR_NUMBER}/files" \
          --paginate --jq '.[] | "### " + .filename + " (+" + (.additions|tostring) + "/-" + (.deletions|tostring) + ")\n" + (.patch // "") + "\n"' \
          | head -c 8000
        pipeline_status=$?
        pipe_status=("${PIPESTATUS[@]}")
        set -e
        echo "${DELIM}"
      } >> "$GITHUB_OUTPUT"
      if [ "$pipeline_status" -ne 0 ]; then
        if [ "${#pipe_status[@]}" -eq 2 ] && [ "${pipe_status[0]}" -eq 141 ] && [ "${pipe_status[1]}" -eq 0 ]; then
          :
        else
          exit "$pipeline_status"
        fi
      fi

[Copilot]

The added || true fixes the missing-delimiter error, but it also masks genuine gh api failures (auth/permission/rate-limit/network), letting the job continue with an empty/truncated PR_FILES output.

Recommend adjusting the script to ignore only the expected SIGPIPE/pipefail exit (141) while still emitting the closing delimiter, and to fail the step for other non-zero statuses.

Suggested change

	run: "DELIM=\"GHAW_PR_FILES_$(date +%s)\"\n{\n echo \"PR_FILES<<${DELIM}\"\n gh api \"repos/${GH_REPO}/pulls/${PR_NUMBER}/files\" \\\n --paginate --jq '.[] | \"### \" + .filename + \" (+\" + (.additions|tostring) + \"/-\" + (.deletions|tostring) + \")\\n\" + (.patch // \"\") + \"\\n\"' \\\n | head -c 8000 || true\n echo \"${DELIM}\"\n} >> \"$GITHUB_OUTPUT\"\n"
	run: |
	DELIM="GHAW_PR_FILES_$(date +%s)"
	{
	echo "PR_FILES<<${DELIM}"
	set +e
	gh api "repos/${GH_REPO}/pulls/${PR_NUMBER}/files" \
	--paginate --jq '.[] | "### " + .filename + " (+" + (.additions|tostring) + "/-" + (.deletions|tostring) + ")\n" + (.patch // "") + "\n"' \
	| head -c 8000
	status=$?
	set -e
	echo "${DELIM}"
	} >> "$GITHUB_OUTPUT"
	if [ "$status" -ne 0 ] && [ "$status" -ne 141 ]; then
	exit "$status"
	fi