@joshuafolkken/kit 1.1229.0 → 1.1370.0

package/scripts/lines/line-targets.ts

@@ -1,7 +1,8 @@
+import { existsSync } from 'node:fs'
 import path from 'node:path'
 import { git_spawn } from '#scripts/git/git-spawn'
 
-// The no-argument half of joshuafolkken/kit#1809. `josh lines <path>` answers for a file someone
+// The no-argument half of `josh lines`. `josh lines <path>` answers for a file someone
 // already named; a file near the limit that nobody has named yet is invisible until the gate reports
 // it. This enumerates the repository's own lint-target files so the no-argument scan can report every
 // one of them near the limit at once, before the first edit rather than after it.
@@ -51,13 +52,16 @@ function split_names(output: string): ReadonlyArray<string> {
 
 // The names resolve against the repository `root`, never the process cwd: `--full-name` prints them
 // relative to the root wherever the command runs, so resolving against cwd would double the prefix
-// and drop every file when the command is invoked from a subdirectory.
+// and drop every file when the command is invoked from a subdirectory. `--cached` still lists a file
+// deleted from the working tree but not yet staged, so a path no longer on disk is dropped — every
+// consumer reads or lints the file, and a deletion in flight would otherwise fail them.
 async function lint_target_files(root: string): Promise<ReadonlyArray<string>> {
 	const output = await git_spawn.read([...LS_FILES_FLAGS, WHOLE_TREE_PATHSPEC])
 
 	return split_names(output)
 		.filter((name) => is_lint_target(name))
 		.map((name) => path.resolve(root, name))
+		.filter((file_path) => existsSync(file_path))
 }
 
 const line_targets = {

package/scripts/lines/lines-command.ts

@@ -5,7 +5,7 @@ import { git_command } from '#scripts/git/git-command'
 import { line_budget, type FileBudget, type LineBudget } from './line-budget'
 import { line_targets } from './line-targets'
 
-// `josh lines` — the ask-before-writing half of joshuafolkken/kit#1425. `pnpm josh lint` reports the
+// `josh lines` — ask before writing. `pnpm josh lint` reports the
 // file line limit only once it has been broken, and by then the writing is finished and the splitting
 // that follows is rework. This answers the same question before the first edit: how many code lines
 // each target file already has, and how many are left.
@@ -33,7 +33,7 @@ const NONE_NEAR = 'no files near the limit'
 // at all. It deliberately does not name eslint, because the last of those is not eslint's doing.
 const NOT_A_FILE = 'not counted: not a regular file'
 const NOT_COUNTED = 'not counted: no line count for this path'
-// The third reason, and the one that replaced a wrong number (joshuafolkken/kit#1454). This project's
+// The third reason, and the one that replaced a wrong number. This project's
 // eslint enforces no `max-lines` here, so there is nothing to report a budget against — and the
 // alternative to saying so is quoting kit's limit for someone else's project, which is the defect. It
 // names no cause because there are several: the rule is turned off for this path, no configuration
@@ -63,7 +63,7 @@ function row(relative_path: string, entry: FileBudget): string {
 // The threshold is printed with the rows rather than left implicit: a reader who sees "near the limit"
 // on one file and nothing on the next needs the boundary to know which side a third one is on.
 //
-// **It is read off the budgets rather than from a limit of this command's own** (joshuafolkken/kit#1454).
+// **It is read off the budgets rather than from a limit of this command's own**.
 // Each file's limit is whatever that project's eslint enforces for it, so there is a line count to
 // print here only where every counted file agrees on one; where they do not — or where none was
 // resolved — the boundary is stated as the share it has always been, and each row carries its own

package/scripts/lint/cspell-cached.ts

@@ -6,7 +6,7 @@ import { lane_cache_run } from '#scripts/lane/lane-cache-run'
 import { buffered_process, FAIL_EXIT_CODE } from '#scripts/lib/buffered-process'
 
 const ARGV_START = 2
-// `--no-progress` turns off cspell's per-file `N/1607 <path> cached` line (joshuafolkken/kit#2296).
+// `--no-progress` turns off cspell's per-file `N/1607 <path> cached` line.
 // Those lines ran to 1,607 of them — the whole output past the 8,000-character tool cap — so a gate
 // that failed on one unknown word buried the failure under progress and a run could read only the
 // first of several failures. The summary and the issue lines it prints are untouched; only the

package/scripts/lint/cycle-recheck.ts

@@ -0,0 +1,122 @@
+import { FAIL_EXIT_CODE, type BufferedProcessResult } from '#scripts/lib/buffered-process'
+import type { ESLint } from 'eslint'
+
+// `import/no-cycle` reads other files, and the lint cache keys a verdict on the linted file's own
+// content. So once a cycle is closed by editing one side of it, the untouched side keeps its cached
+// `Dependency cycle detected` until its own content changes (joshuafolkken/kit#3641). The opposite
+// error cannot happen: a new cycle always contains the file that gained the import, and that file is
+// re-linted.
+//
+// A lint run therefore re-reads a cached red that names the rule: the files reported for it are
+// linted once more without the cache, and their fresh results replace the cached ones. A run that
+// reports no cycle never reaches this, so the green path costs what it did.
+//
+// That holds for a run narrowed to one change's files as much as for the whole tree: the change can
+// hold both sides of a cycle, and the side a later edit leaves alone keeps its cached report.
+//
+// The cached run is asked again through the Node API rather than read off the first run's report:
+// that report is the stylish text, and taking a file out of it means re-deriving its problem
+// counts. The second asking is answered from the cache the first one just wrote.
+const NO_CYCLE_RULE = 'import/no-cycle'
+const FORMATTER = 'stylish'
+const UNCACHED_SUFFIX = '.uncached'
+
+interface Linters {
+	cached: ESLint
+	fresh: ESLint
+}
+
+interface CycleRecheckOptions {
+	cache_file: string
+	// What the run linted — the whole tree, or one change's files — so the cached run is asked the
+	// question it was asked the first time.
+	patterns: ReadonlyArray<string>
+	// What the fixture test varies: the directory linted and the configuration it is linted with.
+	eslint_options?: ESLint.Options
+}
+
+// The exit code is eslint's "finished and reported problems", not any failure: a run that could not
+// finish — a configuration that does not load, a rule that threw — exits 2 and may name the rule
+// too, and asking it again throws the same error here, ahead of both buffered reports.
+function is_cycle_reported(result: BufferedProcessResult): boolean {
+	return result.exit_code === FAIL_EXIT_CODE && result.output.includes(NO_CYCLE_RULE)
+}
+
+function has_cycle_message(result: ESLint.LintResult): boolean {
+	return result.messages.some((message) => message.ruleId === NO_CYCLE_RULE)
+}
+
+function cached_options(options: CycleRecheckOptions): ESLint.Options {
+	return {
+		...options.eslint_options,
+		cache: true,
+		cacheStrategy: 'content',
+		cacheLocation: options.cache_file,
+	}
+}
+
+// A linter that runs without a cache deletes the cache file it would have used, and that defaults to
+// the very file the lint run keeps. So the uncached linter is pointed at a sibling path nothing
+// ever writes: the re-reading must not cost the next run its whole cache.
+function fresh_options(options: CycleRecheckOptions): ESLint.Options {
+	return {
+		...options.eslint_options,
+		cache: false,
+		cacheLocation: `${options.cache_file}${UNCACHED_SUFFIX}`,
+	}
+}
+
+// `eslint` is loaded here, only past the cycle report: it is an optional peer a basic-profile
+// consumer may not have, and this module is imported by the entry of every `josh lint`, which has to
+// reach its skip notice there.
+async function create_linters(options: CycleRecheckOptions): Promise<Linters> {
+	const eslint = await import('eslint')
+
+	return {
+		cached: new eslint.ESLint(cached_options(options)),
+		fresh: new eslint.ESLint(fresh_options(options)),
+	}
+}
+
+async function lint_fresh(
+	linter: ESLint,
+	cached: ReadonlyArray<ESLint.LintResult>,
+): Promise<Map<string, ESLint.LintResult>> {
+	const suspects = cached.filter((result) => has_cycle_message(result))
+	if (suspects.length === 0) return new Map()
+	const fresh = await linter.lintFiles(suspects.map((result) => result.filePath))
+
+	return new Map(fresh.map((result) => [result.filePath, result]))
+}
+
+async function report(
+	linter: ESLint,
+	results: Array<ESLint.LintResult>,
+): Promise<Pick<BufferedProcessResult, 'output' | 'exit_code'>> {
+	const formatter = await linter.loadFormatter(FORMATTER)
+	const is_failed = results.some((result) => result.errorCount > 0)
+
+	return { output: await formatter.format(results), exit_code: is_failed ? FAIL_EXIT_CODE : 0 }
+}
+
+async function verify(
+	result: BufferedProcessResult,
+	options: CycleRecheckOptions,
+): Promise<BufferedProcessResult> {
+	if (!is_cycle_reported(result)) return result
+	const started_at = performance.now()
+	const linters = await create_linters(options)
+	const cached = await linters.cached.lintFiles([...options.patterns])
+	const fresh = await lint_fresh(linters.fresh, cached)
+	const verified = await report(
+		linters.fresh,
+		cached.map((entry) => fresh.get(entry.filePath) ?? entry),
+	)
+
+	return { ...verified, elapsed_ms: result.elapsed_ms + performance.now() - started_at }
+}
+
+const cycle_recheck = { verify }
+
+export type { CycleRecheckOptions }
+export { cycle_recheck, NO_CYCLE_RULE }

package/scripts/lint/format.ts

@@ -19,8 +19,7 @@ async function run_step(args: ReadonlyArray<string>, directory: string): Promise
 
 // prettier first, deliberately: `eslint --fix` exits 1 whenever a non-autofixable error remains, so
 // putting it first would mean one unused variable anywhere in the tree stops prettier from running.
-// A basic project without Prettier or ESLint is skipped with the same reason `josh lint` prints
-// (joshuafolkken/kit#2693, joshuafolkken/kit#2606).
+// A basic project without Prettier or ESLint is skipped with the same reason `josh lint` prints.
 async function run_unless_skipped(
 	check: string,
 	reason: string | undefined,

package/scripts/lint/lint-parallel.ts

@@ -8,22 +8,35 @@ import {
 	FAIL_EXIT_CODE,
 	type BufferedProcessResult,
 } from '#scripts/lib/buffered-process'
+import { cycle_recheck, type CycleRecheckOptions } from './cycle-recheck'
 
 const PRETTIER_ARGS = ['exec', 'prettier', '--check', '.'] as const
 // This — not the `lint:eslint` map entry — is the eslint invocation `josh gate` reaches, so the
-// cache flags come from the same constant the ignore rules are asserted against
-// (joshuafolkken/kit#1256). A copy here would keep writing the old location the day that constant
+// cache flags come from the same constant the ignore rules are asserted against.
+// A copy here would keep writing the old location the day that constant
 // moves, with every test still green.
-const ESLINT_ARGS = ['exec', 'eslint', '.', ...ESLINT_CACHE_FLAGS] as const
+const WHOLE_TREE = '.'
+const ESLINT_ARGS = ['exec', 'eslint', WHOLE_TREE, ...ESLINT_CACHE_FLAGS] as const
+const WHOLE_TREE_RECHECK: CycleRecheckOptions = {
+	cache_file: ESLINT_CACHE_FILE,
+	patterns: [WHOLE_TREE],
+}
 
-async function run_eslint(
-	eslint_args: ReadonlyArray<string>,
-	cache_file: string,
-): Promise<BufferedProcessResult> {
-	return await lane_cache_run.run(
-		cache_file,
-		async () => await buffered_process.run_buffered_process(eslint_args),
-	)
+// What one eslint run is made of: the child's arguments, and what re-reading a cached cycle report
+// (joshuafolkken/kit#3641) needs to ask the same question again — the cache file and the targets.
+interface EslintRun {
+	args: ReadonlyArray<string>
+	recheck: CycleRecheckOptions
+}
+
+// The finished report is re-read before it is returned, inside the lane's cache sharing, because
+// the re-reading uses that same cache file.
+async function run_eslint(eslint: EslintRun): Promise<BufferedProcessResult> {
+	return await lane_cache_run.run(eslint.recheck.cache_file, async () => {
+		const result = await buffered_process.run_buffered_process(eslint.args)
+
+		return await cycle_recheck.verify(result, eslint.recheck)
+	})
 }
 
 function write_output(result: BufferedProcessResult): void {
@@ -46,13 +59,12 @@ async function run_prettier(
 
 async function run_checked_eslint(
 	directory: string,
-	eslint_args: ReadonlyArray<string>,
-	cache_file: string,
+	eslint: EslintRun,
 ): Promise<BufferedProcessResult> {
 	const reason = project_checks.eslint_skip_reason(directory)
 	if (reason !== undefined) return skipped('eslint', reason)
 
-	return await run_eslint(eslint_args, cache_file)
+	return await run_eslint(eslint)
 }
 
 function lint_exit_code(prettier: BufferedProcessResult, eslint: BufferedProcessResult): number {
@@ -63,19 +75,22 @@ function lint_exit_code(prettier: BufferedProcessResult, eslint: BufferedProcess
 
 // The two checks are run from here whether they were pointed at the whole tree or at one change's
 // files, so `josh lint:related` reaches prettier and eslint through the same buffering, the same
-// "one failure does not abort the other" reading, and the same exit code (joshuafolkken/kit#1298) —
+// "one failure does not abort the other" reading, and the same exit code —
 // and through the same basic-project skip, so a narrowed run never reaches a tool the whole-tree
-// run would have skipped (joshuafolkken/kit#2709). The skip reasons answer nothing for a full
+// run would have skipped. The skip reasons answer nothing for a full
 // project, so the one path serves both profiles.
+//
+// A narrowed run re-reads a cached cycle report too (joshuafolkken/kit#3641): one change's files can
+// hold both sides of a cycle, and closing it by editing one leaves the other's cached report standing.
 async function run_lint_checks(
 	prettier_args: ReadonlyArray<string>,
 	eslint_args: ReadonlyArray<string>,
-	eslint_cache_file: string = ESLINT_CACHE_FILE,
+	recheck: CycleRecheckOptions,
 ): Promise<number> {
 	const directory = process.cwd()
 	const [prettier, eslint] = await Promise.all([
 		run_prettier(directory, prettier_args),
-		run_checked_eslint(directory, eslint_args, eslint_cache_file),
+		run_checked_eslint(directory, { args: eslint_args, recheck }),
 	])
 
 	write_output(prettier)
@@ -85,7 +100,7 @@ async function run_lint_checks(
 }
 
 async function run_lint_parallel_checks(): Promise<number> {
-	return await run_lint_checks(PRETTIER_ARGS, ESLINT_ARGS)
+	return await run_lint_checks(PRETTIER_ARGS, ESLINT_ARGS, WHOLE_TREE_RECHECK)
 }
 
 // `process.exitCode` rather than `process.exit()`: both reports are buffered and written here in

package/scripts/lint/lint-related-scope.ts

@@ -5,12 +5,14 @@ import {
 	type ScopeInputs,
 	type ScopeVocabulary,
 } from '#scripts/git/changed-file-scope'
-import { ESLINT_RELATED_CACHE_FLAGS } from '#scripts/josh/josh-command-types'
+import {
+	ESLINT_RELATED_CACHE_FILE,
+	ESLINT_RELATED_CACHE_FLAGS,
+} from '#scripts/josh/josh-command-types'
+import type { CycleRecheckOptions } from './cycle-recheck'
 
-// joshuafolkken/kit#1298: `josh lint` read the whole repository on every call, and an
-// implementation loop calls it after every few edits. Measured across four runs with
-// `pnpm josh time`, that came to 47–188 seconds per run — 18% of #1292's 1,043-second
-// implementation phase, spent re-reading files the change never touched.
+// `josh lint` reads the whole repository on every call, and an implementation loop calls it after
+// every few edits — re-reading files the change never touched.
 //
 // **This narrowing is added in front of the whole check, never in place of it.** `josh gate` still
 // runs `josh lint` over everything before the commit: a formatting rule can be broken by a file the
@@ -96,17 +98,14 @@ function prettier_arguments(files: ReadonlyArray<string>): ReadonlyArray<string>
 	return [...PRETTIER_ARGS, ...files]
 }
 
-// The cache file is this command's own rather than the gate's, because the two run at the same time
-// (joshuafolkken/kit#1347). `josh gate` lints the whole tree beside the review while an
+// The cache file is this command's own rather than the gate's, because the two run at the same time.
+// `josh gate` lints the whole tree beside the review while an
 // implementation loop calls this command between edits, and each eslint run rewrites its cache file
-// whole from the copy it loaded at start-up — so on one file the run that finished last discarded
-// the other's entries, and a narrowed run finishing during a whole-tree run rolled the cache back to
-// its pre-gate state.
-//
-// **The earlier comment here claimed the opposite and was reasoning about the wrong thing.** It said
-// sharing let a narrowed run warm the gate's cache, since eslint leaves the entries a run did not
-// visit alone; that holds for pruning and says nothing about two writers. It is the same judgement
-// joshuafolkken/kit#1332 made for the edit hook, applied to the second place it was needed.
+// whole from the copy it loaded at start-up — so on one file the run that finished last would
+// discard the other's entries, and a narrowed run finishing during a whole-tree run would roll the
+// cache back to its pre-gate state. Sharing would let a narrowed run warm the gate's cache only for
+// pruning, which says nothing about two writers. It is the same judgement the edit hook's own cache
+// file makes.
 //
 // **What is narrowed is still only the target list, never the gate.** `josh gate` runs `josh lint`
 // over the whole tree before any commit; this file decides which files a repeat call reads.
@@ -114,8 +113,19 @@ function eslint_arguments(files: ReadonlyArray<string>): ReadonlyArray<string> {
 	return [...ESLINT_ARGS, ...files, ...ESLINT_RELATED_CACHE_FLAGS, ...ESLINT_SCOPED_FLAGS]
 }
 
+// What re-reading a cached cycle report (`cycle-recheck.ts`) needs to ask the narrowed run's question
+// again: the same targets, the same cache file, and the Node API's spelling of `--no-warn-ignored`.
+function cycle_recheck_options(files: ReadonlyArray<string>): CycleRecheckOptions {
+	return {
+		cache_file: ESLINT_RELATED_CACHE_FILE,
+		patterns: files,
+		eslint_options: { warnIgnored: false },
+	}
+}
+
 const lint_related_scope = {
 	COMMAND_LABEL,
+	cycle_recheck_options,
 	NOTHING_LINTABLE_REASON,
 	describe_scope,
 	eslint_arguments,

package/scripts/lint/lint-related.ts

@@ -4,13 +4,12 @@ import { fileURLToPath } from 'node:url'
 import { document_byte_check } from '#scripts/document/document-byte-check'
 import { scoped_green } from '#scripts/gate/scoped-green'
 import { changed_file_scope, type ChangedFileScope } from '#scripts/git/changed-file-scope'
-import { ESLINT_RELATED_CACHE_FILE } from '#scripts/josh/josh-command-types'
 import { review_stamps } from '#scripts/review/review-stamps'
 import { lint_parallel } from './lint-parallel'
 import { lint_related_scope } from './lint-related-scope'
 
-// `josh lint:related` — the lint check an implementation loop runs between edits
-// (joshuafolkken/kit#1298). The narrowing itself is `lint-related-scope.ts` over the shared
+// `josh lint:related` — the lint check an implementation loop runs between edits.
+// The narrowing itself is `lint-related-scope.ts` over the shared
 // decision in `changed-file-scope.ts`; this is the process around it — how the run reaches the same
 // two child processes `josh lint` runs.
 
@@ -37,20 +36,20 @@ async function lint_exit_code(scope: ChangedFileScope): Promise<number> {
 	return await lint_parallel.run_lint_checks(
 		lint_related_scope.prettier_arguments(scope.files),
 		lint_related_scope.eslint_arguments(scope.files),
-		ESLINT_RELATED_CACHE_FILE,
+		lint_related_scope.cycle_recheck_options(scope.files),
 	)
 }
 
 // The byte check over the same scope the lint just ran: the resolved file list when narrowed, and
 // the whole budget when lint fell back to the whole tree — so the byte check is a superset in the
-// fallback exactly as lint is, never an empty list that would pass silently (joshuafolkken/kit#2176).
+// fallback exactly as lint is, never an empty list that would pass silently.
 function byte_check_exit_code(scope: ChangedFileScope, root: string): number {
 	if (scope.mode === 'all') return document_byte_check.check_all(root)
 
 	return document_byte_check.check_files(root, scope.files)
 }
 
-// The lint result folded together with the fast byte-ceiling check (joshuafolkken/kit#2176): the
+// The lint result folded together with the fast byte-ceiling check: the
 // same check the gate's `document-byte-budget.test.ts` runs, brought forward to this between-edits
 // path so a mandated documentation update over its ceiling surfaces in seconds. It reads no change
 // of its own — it takes the files this run already resolved, so the git contract is the lint
@@ -68,7 +67,7 @@ async function scoped_exit_code(scope: ChangedFileScope, root: string): Promise<
 // whole one, and a fallback says which of the two it was rather than looking like a narrow run
 // that found nothing.
 //
-// **A green run leaves a record of the tree it was green on** (joshuafolkken/kit#1511), so
+// **A green run leaves a record of the tree it was green on**, so
 // `josh review:brief` can tell a tree this check has read from one it has not. What the record means,
 // and the three states in which it is withheld, are `scoped-green.ts`.
 async function run_related_lint(command_arguments: ReadonlyArray<string>): Promise<number> {

package/scripts/managed-marker/index.ts

@@ -1,5 +1,5 @@
 // The public surface a downstream distribution package imports to stamp the workflows it writes.
 // Exported rather than left internal because the alternative is every distributor re-implementing
 // the header, and a second implementation that spells the token differently or stacks a duplicate
-// silently breaks the check that reads it (joshuafolkken/kit#844).
+// silently breaks the check that reads it.
 export { managed_marker_logic } from './managed-marker-logic'

package/scripts/managed-marker/managed-marker-logic.ts

@@ -4,8 +4,7 @@ import { is_workflow_destination } from '#scripts/claude/workflow-destination'
 // answer has to survive being copied on: a consumer of a consumer receives `ci.yml` from kit and
 // `dast.yml` from app-kit, and neither distributor knows what the other manages. So the answer is
 // written into the artifact rather than kept in a list beside it — every distributor stamps its own
-// output, and the auto-merge workflow reads the stamp off the very file it is asking about
-// (joshuafolkken/kit#844).
+// output, and the auto-merge workflow reads the stamp off the very file it is asking about.
 //
 // A list cannot reach that far. kit's write time is the only moment kit controls, and at that moment
 // it knows nothing of what app-kit distributes; whichever sync ran last would decide the list, and

package/scripts/notify/git-notify.ts

@@ -1,3 +1,5 @@
+import { issue_cite } from '#scripts/issue/issue-cite'
+
 type NotifyTarget = 'pr' | 'issue' | 'both'
 
 interface GitNotifyConfig {
@@ -35,14 +37,13 @@ function parse_notify_mentions(raw_mentions: string | undefined): Array<string>
 }
 
 // The `\n` escape the inline `--notify-message` form needs is expanded by `cli_body` at the point the
-// flag is read, not here (joshuafolkken/kit#1198). Expanding again would rewrite a literal backslash-n
+// flag is read, not here. Expanding again would rewrite a literal backslash-n
 // that `--notify-message-file` legitimately carries — a file already holds real newlines, so an
 // escape sequence in one is the author's text rather than a quoting workaround.
 //
-// **Trimming moved up with it, and for the same reason.** This function used to read
-// `raw.trim().replaceAll(…)` — trim first, expand second. Keeping the trim here after the expansion
-// had moved reversed that order, so `--notify-message "…\n"` lost the newline its own escape had just
-// produced. `trim` survives only as the emptiness test, where the whitespace is being counted rather
+// **Trimming happens with the expansion, and for the same reason.** Trimming here, after the
+// expansion, would make `--notify-message "…\n"` lose the newline its own escape had just produced.
+// `trim` survives only as the emptiness test, where the whitespace is being counted rather
 // than removed.
 function resolve_notify_message(raw_message: string | undefined): string {
 	if (raw_message === undefined || raw_message.trim().length === 0) return DEFAULT_NOTIFY_MESSAGE
@@ -66,7 +67,7 @@ function build_notify_config(input: {
 }
 
 // **`notes` is what the run has to say about itself beyond the message it was handed**, and today
-// that is the managed config-file report (joshuafolkken/kit#1592). It is a separate field rather than
+// that is the managed config-file report. It is a separate field rather than
 // text folded into `message`, because the message is the person's own completion summary and the
 // notes are the command's — folding them together would leave a caller unable to tell which half it
 // wrote. **A run with nothing to note adds no line at all**, blank separator included, so the
@@ -87,7 +88,8 @@ function build_completion_comment_body(input: {
 	notes?: ReadonlyArray<string>
 }): string {
 	const base_lines = [`✅ ${input.message}`]
-	const issue_lines = input.issue_number === undefined ? [] : [`Issue: #${input.issue_number}`]
+	const issue_lines =
+		input.issue_number === undefined ? [] : [`Issue: ${issue_cite.plain(input.issue_number)}`]
 	const pr_lines = input.pr_url === undefined ? [] : [`PR: ${input.pr_url}`]
 	const note_lines = note_section(input.notes)
 	const mention_lines = input.mentions.length === 0 ? [] : ['', input.mentions.join(' ')]