ci(final-check): sanitise the report where it is posted

The check job runs the PR's code with sudo on the runner, so the body it
outputs cannot be trusted to be clean. The comment job now drops every @
and breaks issue references and issue/PR links before posting, and caps
the body below GitHub's comment limit.

The health check allows TECHENGINEBOT_TOKEN for TechEngine, game-catalog
and cpu-engineering-samples too, whose label-triggered final checks read it.

Author: Seungpyo1007

.github/workflows/final-check.yml

@@ -189,7 +189,16 @@ jobs:
           github-token: ${{ secrets.TECHENGINEBOT_TOKEN }}
           script: |
             const marker = '<!-- techmachine-final-check -->';
-            const body = process.env.BODY || '';
+            // The check job ran the PR's code, so its report is untrusted here:
+            // drop every @ and break issue references and issue/PR links, so the
+            // comment can neither mention anyone nor cross-reference anything.
+            const zw = '​';
+            const body = (process.env.BODY || '')
+              .replace(/@/g, '')
+              .replace(/(?<!&)#(?=\d+\b)/g, `#${zw}`)
+              .replace(/\bgh-(?=\d+\b)/gi, `$&${zw}`)
+              .replace(/\/(issues|pull|discussions)\/(?=\d)/g, `/$1/${zw}`)
+              .slice(0, 65000);
             if (!body.startsWith(marker)) {
               core.setFailed('The check job produced no report; nothing posted.');
               return;

machine/repos.json

@@ -14,20 +14,29 @@
       "name": "GetTechAPI/TechEngine",
       "branches": [
         "main"
+      ],
+      "allowed_secrets": [
+        "TECHENGINEBOT_TOKEN"
       ]
     },
     {
       "name": "GetTechAPI/game-catalog",
       "branches": [
         "develop",
         "main"
+      ],
+      "allowed_secrets": [
+        "TECHENGINEBOT_TOKEN"
       ]
     },
     {
       "name": "GetTechAPI/cpu-engineering-samples",
       "branches": [
         "develop",
         "main"
+      ],
+      "allowed_secrets": [
+        "TECHENGINEBOT_TOKEN"
       ]
     }
   ],