Repository: dotnet/runtime
File: .github/skills/vmr-codeflow-status/scripts/Get-CodeflowStatus.ps1 (PowerShell)

Code before:
    else {
        # No branch-derived snapshot — PR body only
        $commitCount = if ($prCommits) { $prCommits.Count } else { 0 }
        if ($commitCount -eq 1 -and $prCommits[0].messageHeadline -match "^Initial commit for subscription") {
            Write-Host "  ℹ️  PR has only an initial subscription commit — PR body snapshot ($(Get-ShortSha $vmrCommit)) not yet verifiable" -ForegroundColor DarkGray
        }
        else {
            Write-Host "  ⚠️  Could not verify PR body snapshot ($(Get-ShortSha $vmrCommit)) from branch" -ForegroundColor Yellow
        }
    }
}

# --- Step 3: Check source freshness ---
$freshnessLabel = if ($isForwardFlow) { "Source Freshness" } else { "VMR Freshness" }
Write-Section $freshnessLabel

$sourceHeadSha = $null
$aheadBy = 0
$behindBy = 0
$compareStatus = $null

if ($vmrCommit -and $vmrBranch) {
    # Get current branch HEAD (URL-encode branch name for path segments with /)
    $encodedBranch = [uri]::EscapeDataString($vmrBranch)
    $branchHead = Invoke-GitHubApi "/repos/$freshnessRepo/commits/$encodedBranch"
    if ($branchHead) {
        $sourceHeadSha = $branchHead.sha
        $sourceHeadDate = $branchHead.commit.committer.date
        $snapshotSource = if ($usedBranchSnapshot) {
            if ($versionDetailsVmrCommit -and $vmrCommit.StartsWith($versionDetailsVmrCommit)) { "from Version.Details.xml" }
            elseif ($commitMsgVmrCommit) { "from branch commit" }
            else { "from branch" }
        } else { "from PR body" }
        Write-Status "PR snapshot" "$(Get-ShortSha $vmrCommit) ($snapshotSource)"
        Write-Status "$freshnessRepoLabel HEAD" "$(Get-ShortSha $sourceHeadSha) ($sourceHeadDate)"

        if ($vmrCommit -eq $sourceHeadSha) {
            Write-Host "  ✅ PR is up to date with $freshnessRepoLabel branch" -ForegroundColor Green
        }
        else {
            # Compare to find how many commits differ
            $compare = Invoke-GitHubApi "/repos/$freshnessRepo/compare/$vmrCommit...$sourceHeadSha"
            if ($compare) {
                $aheadBy = $compare.ahead_by
                $behindBy = $compare.behind_by
                $compareStatus = $compare.status

                switch ($compareStatus) {
                    'identical' {
                        Write-Host "  ✅ PR is up to date with $freshnessRepoLabel branch" -ForegroundColor Green
                    }

Review comment (security):
`$vmrCommit.StartsWith($versionDetailsVmrCommit)` is case-sensitive by default. Since earlier comparisons use `OrdinalIgnoreCase`, this can mislabel the snapshot source when the SHA casing differs. Use an explicit `StringComparison.OrdinalIgnoreCase` (or normalize SHAs) for consistent behavior.

Code after:
    else {
        # No branch-derived snapshot — PR body only
        $commitCount = if ($prCommits) { $prCommits.Count } else { 0 }
        if ($commitCount -eq 1 -and $prCommits[0].messageHeadline -match "^Initial commit for subscription") {
            Write-Host "  ℹ️  PR has only an initial subscription commit — PR body snapshot ($(Get-ShortSha $vmrCommit)) not yet verifiable" -ForegroundColor DarkGray
        }
        else {
            Write-Host "  ⚠️  Could not verify PR body snapshot ($(Get-ShortSha $vmrCommit)) from branch" -ForegroundColor Yellow
        }
    }
}

# --- Step 3: Check source freshness ---
$freshnessLabel = if ($isForwardFlow) { "Source Freshness" } else { "VMR Freshness" }
Write-Section $freshnessLabel

$sourceHeadSha = $null
$aheadBy = 0
$behindBy = 0
$compareStatus = $null

if ($vmrCommit -and $vmrBranch) {
    # Get current branch HEAD (URL-encode branch name for path segments with /)
    $encodedBranch = [uri]::EscapeDataString($vmrBranch)
    $branchHead = Invoke-GitHubApi "/repos/$freshnessRepo/commits/$encodedBranch"
    if ($branchHead) {
        $sourceHeadSha = $branchHead.sha
        $sourceHeadDate = $branchHead.commit.committer.date
        $snapshotSource = if ($usedBranchSnapshot) {
            if ($versionDetailsVmrCommit -and $vmrCommit.StartsWith($versionDetailsVmrCommit, [StringComparison]::OrdinalIgnoreCase)) { "from Version.Details.xml" }
            elseif ($commitMsgVmrCommit) { "from branch commit" }
            else { "from branch" }
        } else { "from PR body" }
        Write-Status "PR snapshot" "$(Get-ShortSha $vmrCommit) ($snapshotSource)"
        Write-Status "$freshnessRepoLabel HEAD" "$(Get-ShortSha $sourceHeadSha) ($sourceHeadDate)"

        if ($vmrCommit -eq $sourceHeadSha) {
            Write-Host "  ✅ PR is up to date with $freshnessRepoLabel branch" -ForegroundColor Green
        }
        else {
            # Compare to find how many commits differ
            $compare = Invoke-GitHubApi "/repos/$freshnessRepo/compare/$vmrCommit...$sourceHeadSha"
            if ($compare) {
                $aheadBy = $compare.ahead_by
                $behindBy = $compare.behind_by
                $compareStatus = $compare.status

                switch ($compareStatus) {
                    'identical' {
                        Write-Host "  ✅ PR is up to date with $freshnessRepoLabel branch" -ForegroundColor Green
                    }