Add CI check for invalid characters in file paths

[kaovilai]

Go's module zip rejects filenames containing certain characters (shell
special chars like " ' * < > ? ` |, path separators : , and non-letter
Unicode such as control/format characters). This caused a build failure
when a changelog file contained an invisible U+200E LEFT-TO-RIGHT MARK
(see PR #9552).

Add a GitHub Actions workflow that validates all tracked file paths on
every PR to catch these issues before they reach downstream consumers.

Also fixes 7 existing changelog filenames on main containing invisible U+200E characters.

Cherry-picks to release branches

• release-1.15: [release-1.15] Add CI check for invalid characters in file paths #9688
• release-1.16: [release-1.16] Add CI check for invalid characters in file paths #9689
• release-1.17: [release-1.17] Add CI check for invalid characters in file paths #9690
• release-1.18: [release-1.18] Add CI check for invalid characters in file paths #9691

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com

Note

Responses generated with Claude

[kaovilai]

should fail until #9552 merges

[Copilot]

Pull request overview

This PR adds a GitHub Actions workflow that validates file paths in pull requests to ensure they don't contain characters that are rejected by Go's module zip format. This preventive check addresses the issue encountered in PR #9552 where a changelog file contained an invisible U+200E LEFT-TO-RIGHT MARK character, causing build failures for downstream consumers.

Changes:

• Added new CI workflow pr-filepath-check.yml that runs on all pull requests
• Implements validation logic using Python to check for shell special characters, path separators, and non-letter Unicode characters
• Provides clear error messages with GitHub Actions annotations when invalid characters are detected

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The checkout action version should be consistent with other workflows in the repository. All other workflows use actions/checkout@v5, but this workflow uses @v6. For consistency, this should be changed to @v5 unless there's a specific requirement for v6.

Suggested change

	uses: actions/checkout@v6
	uses: actions/checkout@v5

[Copilot]

The comment on line 20 mentions that backslash \ should be rejected, but the bad_ascii set on line 35 does not include it. According to Go's module zip specification, backslash is indeed a rejected character. Add \\ to the bad_ascii set to match the documented behavior.

Suggested change

	bad_ascii = set('\"' + \"'\" + '*<>?\`|:')
	bad_ascii = set('\"' + \"'\" + '*<>?\\`|:')

[kaovilai]

The following files have characters that are invalid in Go module zip archives:

  changelogs/unreleased/9532-Lyndon-Li‎  — U+200E (LEFT-TO-RIGHT MARK)

To fix, rename the files to remove the problematic characters:

  mv "changelogs/unreleased/9532-Lyndon-Li‎" "changelogs/unreleased/9532-Lyndon-Li" && git add "changelogs/unreleased/9532-Lyndon-Li"
  # or: git mv "changelogs/unreleased/9532-Lyndon-Li‎" "changelogs/unreleased/9532-Lyndon-Li"

[kaovilai]

passes now

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 60.96%. Comparing base (eaef4ea) to head (cfc5826).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9553   +/-   ##
=======================================
  Coverage   60.96%   60.96%           
=======================================
  Files         384      384           
  Lines       36595    36595           
=======================================
  Hits        22310    22310           
  Misses      12676    12676           
  Partials     1609     1609           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kaovilai]

guys, filename is malforming again..

@Lyndon-Li what's going on with your changelog :/

https://github.com/vmware-tanzu/velero/blob/e4399771174a0269edbfee60f638460155010886/changelogs/unreleased/9634-Lyndon-Li%E2%80%8E%E2%80%8E