From e9651489af039bd0669aee0c8c9069cecfcc5690 Mon Sep 17 00:00:00 2001
From: Mario Campos <mario-campos@github.com>
Date: Thu, 29 Oct 2026 10:44:10 -0500
Subject: [PATCH] Avoid non-null assertion operators by asserting arguments

---
 pr-checks/post-comment.test.ts | 49 ++++++++++++++++++++++++++++++++++
 pr-checks/post-comment.ts      | 18 +++++++++++--
 2 files changed, 65 insertions(+), 2 deletions(-)

diff --git a/pr-checks/post-comment.test.ts b/pr-checks/post-comment.test.ts
index 960e7a0f0..7e02c4900 100644
--- a/pr-checks/post-comment.test.ts
+++ b/pr-checks/post-comment.test.ts
@@ -54,6 +54,27 @@ describe("parseOptions", async () => {
     });
   });
 
+  await it("rejects a missing --body", () => {
+    assert.throws(
+      () => parseOptions(withoutFlag("--body")),
+      /Missing required flag --body/,
+    );
+  });
+
+  await it("rejects an empty --body", () => {
+    assert.throws(
+      () => parseOptions(withFlag("--body", "")),
+      /The value for --body cannot be empty/,
+    );
+  });
+
+  await it("rejects a whitespace-only --body", () => {
+    assert.throws(
+      () => parseOptions(withFlag("--body", " \t\n")),
+      /The value for --body cannot be empty/,
+    );
+  });
+
   await it("rejects a missing --marker", () => {
     assert.throws(
       () => parseOptions(withoutFlag("--marker")),
@@ -74,6 +95,34 @@ describe("parseOptions", async () => {
       /The value for --marker cannot be empty/,
     );
   });
+
+  await it("rejects a missing --repository", () => {
+    assert.throws(
+      () => parseOptions(withoutFlag("--repository")),
+      /Missing required flag --repository/,
+    );
+  });
+
+  await it("rejects an empty --repository", () => {
+    assert.throws(
+      () => parseOptions(withFlag("--repository", "")),
+      /The value for --repository cannot be empty/,
+    );
+  });
+
+  await it("rejects a whitespace-only --repository", () => {
+    assert.throws(
+      () => parseOptions(withFlag("--repository", " \t\n")),
+      /The value for --repository cannot be empty/,
+    );
+  });
+
+  await it("rejects an invalid --repository value", () => {
+    assert.throws(
+      () => parseOptions(withFlag("--repository", "github/codeql/action")),
+      /Invalid --repository value/,
+    );
+  });
 });
 
 describe("resolveToken", async () => {
diff --git a/pr-checks/post-comment.ts b/pr-checks/post-comment.ts
index 7f805d1ee..e254221eb 100644
--- a/pr-checks/post-comment.ts
+++ b/pr-checks/post-comment.ts
@@ -52,15 +52,29 @@ export function parseOptions(argv?: string[]): Options {
     strict: true,
   });
 
+  assert(values.body !== undefined, "Missing required flag --body.");
+  assert(values.body.trim() !== "", "The value for --body cannot be empty.");
   assert(values.marker !== undefined, "Missing required flag --marker.");
   assert(
     values.marker.trim() !== "",
     "The value for --marker cannot be empty.",
   );
-  const [owner, repo] = values.repository!.split("/");
+  assert(
+    values.repository !== undefined,
+    "Missing required flag --repository.",
+  );
+  assert(
+    values.repository.trim() !== "",
+    "The value for --repository cannot be empty.",
+  );
+  assert(
+    /^[\w.-]+\/[\w.-]+$/.test(values.repository),
+    "Invalid --repository value.",
+  );
 
+  const [owner, repo] = values.repository.split("/");
   return {
-    body: values.body!,
+    body: values.body,
     marker: values.marker,
     issueId: Number(values["issue-id"]),
     repository: { owner, repo },