fix: resolve code quality and security issues in 5 oldest files

[JiayangLai]

Summary

This PR fixes code quality and security issues in the 5 oldest code files in the repository:

Bug Fixes

1. pkg/markdown/convert.go - Fix nil map panic in IDGenerator

   • The used map was never initialized, causing a panic when Put() was called
   • Added NewIDGenerator() constructor to properly initialize the map

2. main.go - Fix redundant mkdirAll logic

   • os.MkdirAll already handles the case where the directory exists
   • Removed unnecessary os.Stat check

Security Fixes

3. .github/scripts/check-quality/main.go - Prevent memory exhaustion

   • Added io.LimitReader(1<<20) (1MB limit) to io.ReadAll calls
   • Prevents DoS via large response bodies from GitHub API

4. .github/scripts/check-pr-diff/main.go - Prevent command injection

   • Added isValidRef() function to validate GITHUB_BASE_REF and PR_HEAD_SHA
   • Validates that refs only contain alphanumeric, hyphen, underscore, and dot characters

Code Cleanup

5. pkg/slug/generator.go - Fix misleading FIXME comment
   • Corrected grammatically incorrect comment ("this is should be" → proper description)

Test Plan

• Run go build ./... to verify code compiles
• Run existing tests to ensure no regressions

🤖 Generated with Claude Code

[github-actions]

Automated Quality Checks

Skipped — this PR does not modify README.md, so package quality checks do not apply.

This is expected for maintenance, documentation, or workflow PRs.

[sentry]

Bug: The isValidRef() function incorrectly rejects branch names with slashes (/), causing diffs to silently fall back to the main branch as a base.
_{Severity: HIGH}

Suggested Fix

Update the isValidRef() function to allow the forward slash (/) character. Git branch names commonly use slashes for organization (e.g., feature/add-x). Since the script uses exec.Command, which separates arguments and prevents shell injection, this change is safe and will allow the script to correctly handle a common and valid branch naming convention.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: .github/scripts/check-pr-diff/main.go#L206-L212

Potential issue: The `isValidRef()` function is overly restrictive and rejects valid Git
branch names that contain a forward slash (`/`), such as `release/1.0`. When a pull
request targets a branch with a slash, the validation fails, causing the script to
silently fall back to using `main` as the base for comparison. This results in the `git
diff` command running against an incorrect base branch, leading to inaccurate PR
validation checks. The check may approve changes that should be flagged or reject valid
changes because it is not comparing against the correct code history.

_{Did we get this right? 👍 / 👎 to inform future reviews.}