fix(github): guard backfill GraphQL helpers' repoFullName parsing (#9351)

* fix: close the remaining 5 pre-existing test failures on main

Follows #9276, which fixed 8 files / 12 cases and left these 4 files / 5 cases
still red on main (and therefore red on every open PR). Each diagnosed to its
introducing commit; two are real source gaps, two are stale sibling tests a
deliberate behavior change never updated.

SOURCE fixes:
- selfhost/metrics.ts: register two counters emitted since #9243 and #9245 but
  never added to DEFAULT_METRIC_META, so renderMetrics() emitted them as bare
  undocumented samples with no HELP/TYPE — exactly what that drift guard exists
  to catch. Both commits even name the counter in their own body text; a pure
  registration miss, not a behavior decision.

TEST fixes (source verified correct in both cases):
- selfhost-pg-retention: the fake Postgres still matched the pre-#9083 ctid
  semi-join, so every DELETE fell through to rowCount 0. #9083 deliberately
  moved retention to an index-backed PK range delete with ORDER BY (the fix for
  prune-retention blowing its timeout and stalling permanently); it updated the
  SQLite twin but not the Postgres one. Regex now captures whichever key column
  is in play, keeping BOTH the mapped-PK and ctid-fallback paths exercised.
- salvageability: #9085 made an absent blocker confidence degrade to
  CONFIDENCE_WHEN_UNSTATED (0.5) instead of 1.0, so it is sub-floor against the
  0.93 default and the low-confidence hold owns the case. It renamed both
  sibling assertions in rules.test.ts but missed this third consumption site.
  Both calls kept — they are the only coverage of the default-floor arm and the
  nullish-confidence arm respectively.
- worker-entry-boundary: false positive, not a real dependency leak. The check
  grepped whole-file text, so #9230's user-facing string "crossed the
  visual-diff threshold" failed a green tree over a sentence, in a file
  worker-reachable since #4120 that imports none of these deps. Narrowed to scan
  module specifiers (reusing the file's own parseImportSpecifiers) — the only
  way a Node-only dep can actually reach the bundle. Added a discriminating test
  so it cannot pass vacuously; verified by injecting a real `import sharp` and
  confirming it fails, naming the file and specifier.

* fix(github): guard backfill GraphQL helpers' repoFullName parsing

fetchLiveCiAggregateViaGraphQl, fetchLivePullRequestReviewDecision, and
fetchLiveReviewThreadBlockers parsed repoFullName with a bare split/truthiness
check, so extra segments and whitespace-padded slugs reached GraphQL queries.
Add a local parseBackfillRepoFullName helper mirroring #8311's segment-count and
whitespace guard, preserving each call site's fail-soft return contract.

Closes #9317

---------

Co-authored-by: JSONbored <49853598+JSONbored@users.noreply.github.com>

Author: philluiz2323

src/github/backfill.ts

@@ -3276,6 +3276,19 @@ export function isStatusRollupGraphQlEnabled(env: { GITHUB_STATUS_ROLLUP_GRAPHQL
   return /^(1|true|yes|on)$/i.test(env.GITHUB_STATUS_ROLLUP_GRAPHQL ?? "");
 }
 
+// Mirrors parseRepoFullName in labels.ts / assignees.ts (#8311): backfill keeps its own local copy rather than
+// importing a shared one. Returns null for malformed input so each GraphQL read helper preserves its existing
+// fail-soft return contract (null / undefined / []).
+function parseBackfillRepoFullName(repoFullName: string): { owner: string; name: string } | null {
+  const parts = repoFullName.split("/");
+  const owner = parts[0];
+  const name = parts[1];
+  if (parts.length !== 2 || !owner || !name || /\s/.test(repoFullName)) {
+    return null;
+  }
+  return { owner, name };
+}
+
 /**
  * GraphQL equivalent of {@link fetchLiveCiAggregate}: ONE bounded query returns the head commit's statusCheckRollup
  * (check-runs AND classic statuses, unified) plus its check-suites — replacing the paginated /check-runs + /status
@@ -3295,8 +3308,9 @@ export async function fetchLiveCiAggregateViaGraphQl(
   advisoryCheckRuns?: ReadonlyArray<{ name: string; appSlug: string }> | null,
 ): Promise<LiveCiAggregate | null> {
   if (!headSha || !token) return null;
-  const [owner, name] = repoFullName.split("/");
-  if (!owner || !name) return null;
+  const parsed = parseBackfillRepoFullName(repoFullName);
+  if (!parsed) return null;
+  const { owner, name } = parsed;
   const query = `query LoopOverLiveCiRollup { repository(owner: ${JSON.stringify(owner)}, name: ${JSON.stringify(name)}) { object(oid: ${JSON.stringify(headSha)}) { ... on Commit { statusCheckRollup { contexts(first: 100) { nodes { __typename ... on CheckRun { name conclusion status startedAt detailsUrl title summary checkSuite { databaseId app { slug } } } ... on StatusContext { context state description targetUrl } } pageInfo { hasNextPage } } } checkSuites(first: 100) { nodes { status app { slug } } pageInfo { hasNextPage } } } } } }`;
   const result = await githubGraphQl<{
     data?: {
@@ -4058,8 +4072,9 @@ export async function fetchLivePullRequestReviewDecision(
   admissionKey?: GitHubRateLimitAdmissionKey,
 ): Promise<string | undefined> {
   if (!token) return undefined;
-  const [owner, name] = repoFullName.split("/");
-  if (!owner || !name) return undefined;
+  const parsed = parseBackfillRepoFullName(repoFullName);
+  if (!parsed) return undefined;
+  const { owner, name } = parsed;
   const query = `query { repository(owner: ${JSON.stringify(owner)}, name: ${JSON.stringify(name)}) { pullRequest(number: ${prNumber}) { reviewDecision } } }`;
   const result = await githubGraphQl<{ data?: { repository?: { pullRequest?: { reviewDecision?: string | null } | null } | null }; errors?: unknown[] }>(
     env,
@@ -4130,8 +4145,9 @@ export async function fetchLiveReviewThreadBlockers(
   admissionKey?: GitHubRateLimitAdmissionKey,
 ): Promise<ReviewThreadBlocker[]> {
   if (!token) return [];
-  const [owner, name] = repoFullName.split("/");
-  if (!owner || !name) return [];
+  const parsed = parseBackfillRepoFullName(repoFullName);
+  if (!parsed) return [];
+  const { owner, name } = parsed;
   const threads: Array<GitHubReviewThreadNode | null> = [];
   let cursor: string | null = null;
   const seenCursors = new Set<string>();

test/unit/backfill-2.test.ts

@@ -1660,6 +1660,18 @@ describe("GitHub backfill", () => {
   // (`liveReviewDecision ?? pr.reviewDecision`), so a PR approved at backfill time and later flipped to
   // CHANGES_REQUESTED still read as APPROVED -> approvalsSatisfied -> merge. The sentinel is a real VALUE
   // precisely so it survives that `??` and the stale stored decision can never be substituted.
+  describe("fetchLivePullRequestReviewDecision — repoFullName guard (#9317)", () => {
+    it("returns undefined for extra-segment and whitespace-padded slugs before any GraphQL call", async () => {
+      const env = createTestEnv({ GITHUB_PUBLIC_TOKEN: "public-token" });
+      const fetchSpy = vi.fn(async () => Response.json({ data: { repository: { pullRequest: { reviewDecision: "APPROVED" } } } }));
+      vi.stubGlobal("fetch", fetchSpy);
+      for (const repoFullName of ["owner/repo/extra", "owner/ repo", " owner/repo"]) {
+        expect(await fetchLivePullRequestReviewDecision(env, repoFullName, 7, "public-token")).toBeUndefined();
+      }
+      expect(fetchSpy).not.toHaveBeenCalled();
+    });
+  });
+
   describe("fetchLivePullRequestReviewDecision — partial-response guard (#9052)", () => {
     it("returns the unreadable sentinel on a 200-with-errors response, so the stale stored decision cannot win the ?? fallback", async () => {
       const env = createTestEnv({ GITHUB_PUBLIC_TOKEN: "public-token" });
@@ -2528,6 +2540,10 @@ describe("GitHub backfill", () => {
       expect(fetchSpy).not.toHaveBeenCalled();
       await expect(fetchLiveReviewThreadBlockers(env, "malformed", 1, "public-token")).resolves.toEqual([]);
       expect(fetchSpy).not.toHaveBeenCalled();
+      for (const repoFullName of ["owner/repo/extra", "owner/ repo", " owner/repo"]) {
+        await expect(fetchLiveReviewThreadBlockers(env, repoFullName, 1, "public-token")).resolves.toEqual([]);
+      }
+      expect(fetchSpy).not.toHaveBeenCalled();
       await expect(fetchLiveReviewThreadBlockers(env, "JSONbored/gittensory", 1, "public-token")).resolves.toEqual([]);
       expect(fetchSpy).toHaveBeenCalledTimes(1);
     });

test/unit/graphql-status-rollup.test.ts

@@ -76,6 +76,16 @@ describe("fetchLiveCiAggregateViaGraphQl — verdicts", () => {
     expect(await fetchLiveCiAggregateViaGraphQl(env, "no-slash", SHA, TOKEN)).toBeNull();
   });
 
+  // #9317: segment-count + whitespace guard, matching pr-actions.ts/assignees.ts/labels.ts (#8311).
+  it("returns null for extra-segment and whitespace-padded repo slugs before any GraphQL call (#9317)", async () => {
+    const fetchSpy = vi.fn(async () => Response.json(graphqlBody({ runs: [{ name: "build", conclusion: "SUCCESS", status: "COMPLETED" }] })));
+    vi.stubGlobal("fetch", fetchSpy);
+    for (const repoFullName of ["owner/repo/extra", "owner/ repo", " owner/repo"]) {
+      expect(await fetchLiveCiAggregateViaGraphQl(env, repoFullName, SHA, TOKEN)).toBeNull();
+    }
+    expect(fetchSpy).not.toHaveBeenCalled();
+  });
+
   it("returns null on a GraphQL error or an unexpected/absent commit (→ REST fallback)", async () => {
     stubGraphql(graphqlBody(), { status: 500 });
     expect(await fetchLiveCiAggregateViaGraphQl(env, REPO, SHA, TOKEN)).toBeNull();