Function neutralizeBotTriggers

actions/setup/js/sanitize_content_core.cjs:790–806

* Neutralizes bot trigger phrases by wrapping them in backticks. * The first `maxBotMentions` unquoted trigger references are left unchanged; * any occurrences beyond that threshold are wrapped in backticks. * Already-quoted entries are never re-quoted. * @param {string} s - The string to proces

(s, maxBotMentions = MAX_BOT_TRIGGER_REFERENCES)

 * @returns {string} The string with excess bot triggers neutralized
 */
function neutralizeBotTriggers(s, maxBotMentions = MAX_BOT_TRIGGER_REFERENCES) {
  // Match unquoted bot trigger phrases like "fixes #123", "closes #asdfs", etc.
  // The negative lookbehind (?<!`) skips already-quoted entries.
  const pattern = /(?<!`)\b(fixes?|closes?|resolves?|fix|close|resolve)\s+#(\w+)/gi;
  const matches = s.match(pattern);
  if (!matches || matches.length <= maxBotMentions) {
    return s;
  }
  let count = 0;
  return s.replace(pattern, (match, action, ref) => {
    count++;
    if (count <= maxBotMentions) {
      return match;
    }
    return `\`${action} #${ref}\``;
  });
}

/**
 * Neutralizes template syntax delimiters to prevent potential template injection