helm/helm
ci: add check to prevent invisible Unicode characters (ZWSP/bidi) in source
Closed
#32,137 opened on May 21, 2026
good first issuehelp wanted
Repository metrics
- Stars
- (29,815 stars)
- PR merge metrics
- (Avg merge 40d 17h) (48 merged PRs in 30d)
Description
Summary
PR #32134 removed three U+200B (zero-width space) characters from a comment in internal/plugin/plugin.go. The characters were invisible, had no effect on behavior, but caused Renovate to emit a repo-wide warning for every project that vendors helm.sh/helm/v4:
⚠️ WARN: Hidden Unicode characters have been discovered in file(s) in your repository...
Proposal
Add a CI step that fails if any invisible/dangerous Unicode codepoints are found in the source tree. A one-liner like:
grep -rP '[\x{200B}-\x{200D}\x{FEFF}\x{202A}-\x{202E}\x{2066}-\x{2069}]' --include='*.go' . && echo 'FAIL: invisible Unicode found' && exit 1 || true
This covers:
- U+200B–U+200D: zero-width spaces
- U+FEFF: BOM / zero-width no-break space
- U+202A–U+202E: bidirectional text controls
- U+2066–U+2069: bidirectional isolates (the "trojan source" class)
Alternatively, a golangci-lint plugin or a standalone tool such as bidichk could be wired into the existing lint pipeline.
Motivation
- Prevents the same class of issue from silently reappearing.
- Protects downstream
vendor/consumers from noisy Renovate warnings that can't be suppressed per-path. - Guards against "trojan source" style attacks (bidi overrides in code comments/strings).