## 15:46 UTC — Task

### What went wrong
- Interpolated `${{ inputs.package }}` directly into `actions/github-script` JavaScript, allowing malformed input to break or inject code.
- Fetched npm metadata with the raw package name instead of URL-encoding it.
- Assumed `data.repository.url` always existed and was a GitHub `.git` URL.
- Used a brittle repository URL regex that missed scoped/modern GitHub URL formats and failed without a clear error.

### How it was fixed
- Pass workflow input through `env.NPM_PACKAGE` and read it from `process.env` inside the script.
- Validate the package name with an npm package-name regex before using it.
- Use `encodeURIComponent(packageName)` in the npm registry URL.
- Check `response.ok` and throw explicit errors for failed registry fetches or unsupported repository URLs.

## 16:04 UTC — Task

### What went wrong
- PR title did not satisfy the repository's conventional title check before opening/updating the PR.

### How it was fixed
- Renamed PR #6833 to `ci: harden CITGM package workflow input handling` using `gh pr edit`, then watched checks until `pull-request-title-check` passed.