From 1ea8d7347da9c5f1d3ad1d5ea4bf81855d32a538 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Thu, 25 Dec 2025 00:25:53 +0000
Subject: [PATCH 1/2] Fix incomplete multi-character sanitization in HTML
 comment removal
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses CodeQL alerts #85, #86, #87 (js/incomplete-multi-character-sanitization)

The vulnerability occurs when using .replace() to remove multi-character
patterns like HTML comments - a single pass can reintroduce dangerous
sequences. For example, "<!--<!--comment-->-->" becomes "<!---->" after
one replacement, still containing comment markers.

Fix: Apply replacement repeatedly until no more matches are found.
This ensures all nested/overlapping patterns are fully removed.

Modified files:
- actions/setup/js/sanitize_content_core.cjs: removeXmlComments()
- actions/setup/js/runtime_import.cjs: removeXMLComments()

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 actions/setup/js/runtime_import.cjs        | 8 +++++++-
 actions/setup/js/sanitize_content_core.cjs | 8 +++++++-
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/actions/setup/js/runtime_import.cjs b/actions/setup/js/runtime_import.cjs
index fbced3eaa7..3b5781ef5f 100644
--- a/actions/setup/js/runtime_import.cjs
+++ b/actions/setup/js/runtime_import.cjs
@@ -24,7 +24,13 @@ function hasFrontMatter(content) {
  */
 function removeXMLComments(content) {
   // Remove XML/HTML comments: <!-- ... -->
-  return content.replace(/<!--[\s\S]*?-->/g, "");
+  // Apply repeatedly to handle nested/overlapping patterns that could reintroduce comment markers
+  let previous;
+  do {
+    previous = content;
+    content = content.replace(/<!--[\s\S]*?-->/g, "");
+  } while (content !== previous);
+  return content;
 }
 
 /**
diff --git a/actions/setup/js/sanitize_content_core.cjs b/actions/setup/js/sanitize_content_core.cjs
index cc9c207688..a3e0863aca 100644
--- a/actions/setup/js/sanitize_content_core.cjs
+++ b/actions/setup/js/sanitize_content_core.cjs
@@ -278,7 +278,13 @@ function neutralizeAllMentions(s) {
  */
 function removeXmlComments(s) {
   // Remove <!-- comment --> and malformed <!--! comment --!>
-  return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+  // Apply repeatedly to handle nested/overlapping patterns that could reintroduce comment markers
+  let previous;
+  do {
+    previous = s;
+    s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+  } while (s !== previous);
+  return s;
 }
 
 /**

From e286d8f4894f0e568dad35123dcf90cc1e5ee118 Mon Sep 17 00:00:00 2001
From: Copilot <198982749+Copilot@users.noreply.github.com>
Date: Wed, 24 Dec 2025 17:16:32 -0800
Subject: [PATCH 2/2] Fix incomplete multi-character sanitization in source
 files (pkg/workflow/js) (#7581)

---
 .../agent-performance-analyzer.lock.yml       | 14 +++++++++++--
 .github/workflows/ai-moderator.lock.yml       | 14 +++++++++++--
 .github/workflows/archie.lock.yml             | 14 +++++++++++--
 .github/workflows/artifacts-summary.lock.yml  | 14 +++++++++++--
 .github/workflows/audit-workflows.lock.yml    | 14 +++++++++++--
 .github/workflows/blog-auditor.lock.yml       | 14 +++++++++++--
 .github/workflows/brave.lock.yml              | 14 +++++++++++--
 .../breaking-change-checker.lock.yml          | 14 +++++++++++--
 .github/workflows/campaign-generator.lock.yml | 14 +++++++++++--
 .github/workflows/campaign-manager.lock.yml   | 14 +++++++++++--
 .github/workflows/changeset.lock.yml          | 14 +++++++++++--
 .github/workflows/ci-coach.lock.yml           | 14 +++++++++++--
 .github/workflows/ci-doctor.lock.yml          | 14 +++++++++++--
 .../cli-consistency-checker.lock.yml          | 14 +++++++++++--
 .../workflows/cli-version-checker.lock.yml    | 14 +++++++++++--
 .github/workflows/cloclo.lock.yml             | 14 +++++++++++--
 .../workflows/close-old-discussions.lock.yml  | 14 +++++++++++--
 .../commit-changes-analyzer.lock.yml          | 14 +++++++++++--
 .../workflows/copilot-agent-analysis.lock.yml | 14 +++++++++++--
 .../copilot-pr-merged-report.lock.yml         | 14 +++++++++++--
 .../copilot-pr-nlp-analysis.lock.yml          | 14 +++++++++++--
 .../copilot-pr-prompt-analysis.lock.yml       | 14 +++++++++++--
 .../copilot-session-insights.lock.yml         | 14 +++++++++++--
 .github/workflows/craft.lock.yml              | 14 +++++++++++--
 .../daily-assign-issue-to-user.lock.yml       | 14 +++++++++++--
 .github/workflows/daily-choice-test.lock.yml  | 14 +++++++++++--
 .github/workflows/daily-code-metrics.lock.yml | 14 +++++++++++--
 .../daily-copilot-token-report.lock.yml       | 14 +++++++++++--
 .github/workflows/daily-doc-updater.lock.yml  | 14 +++++++++++--
 .github/workflows/daily-fact.lock.yml         | 14 +++++++++++--
 .github/workflows/daily-file-diet.lock.yml    | 14 +++++++++++--
 .../workflows/daily-firewall-report.lock.yml  | 14 +++++++++++--
 .../workflows/daily-issues-report.lock.yml    | 14 +++++++++++--
 .../daily-malicious-code-scan.lock.yml        | 14 +++++++++++--
 .../daily-multi-device-docs-tester.lock.yml   | 14 +++++++++++--
 .github/workflows/daily-news.lock.yml         | 14 +++++++++++--
 .../daily-performance-summary.lock.yml        | 14 +++++++++++--
 .../workflows/daily-repo-chronicle.lock.yml   | 14 +++++++++++--
 .github/workflows/daily-team-status.lock.yml  | 14 +++++++++++--
 .../workflows/daily-workflow-updater.lock.yml | 14 +++++++++++--
 .github/workflows/deep-report.lock.yml        | 14 +++++++++++--
 .../workflows/dependabot-go-checker.lock.yml  | 14 +++++++++++--
 .github/workflows/dev-hawk.lock.yml           | 14 +++++++++++--
 .github/workflows/dev.lock.yml                | 14 +++++++++++--
 .../developer-docs-consolidator.lock.yml      | 14 +++++++++++--
 .github/workflows/dictation-prompt.lock.yml   | 14 +++++++++++--
 .github/workflows/docs-noob-tester.lock.yml   | 14 +++++++++++--
 .../duplicate-code-detector.lock.yml          | 14 +++++++++++--
 .../example-permissions-warning.lock.yml      |  7 ++++++-
 .../example-workflow-analyzer.lock.yml        | 14 +++++++++++--
 .github/workflows/firewall-escape.lock.yml    |  7 ++++++-
 .github/workflows/firewall.lock.yml           |  7 ++++++-
 .../github-mcp-structural-analysis.lock.yml   | 14 +++++++++++--
 .../github-mcp-tools-report.lock.yml          | 14 +++++++++++--
 .../workflows/glossary-maintainer.lock.yml    | 14 +++++++++++--
 .github/workflows/go-fan.lock.yml             | 14 +++++++++++--
 ...ze-reduction-project64.campaign.g.lock.yml | 14 +++++++++++--
 .github/workflows/go-logger.lock.yml          | 14 +++++++++++--
 .../workflows/go-pattern-detector.lock.yml    | 14 +++++++++++--
 .github/workflows/grumpy-reviewer.lock.yml    | 14 +++++++++++--
 .github/workflows/hourly-ci-cleaner.lock.yml  | 14 +++++++++++--
 .../workflows/human-ai-collaboration.lock.yml | 14 +++++++++++--
 .github/workflows/incident-response.lock.yml  | 14 +++++++++++--
 .../workflows/instructions-janitor.lock.yml   | 14 +++++++++++--
 .github/workflows/intelligence.lock.yml       | 14 +++++++++++--
 .github/workflows/issue-arborist.lock.yml     | 14 +++++++++++--
 .github/workflows/issue-classifier.lock.yml   | 16 ++++++++++++---
 .github/workflows/issue-monster.lock.yml      | 14 +++++++++++--
 .github/workflows/issue-triage-agent.lock.yml | 14 +++++++++++--
 .github/workflows/jsweep.lock.yml             | 14 +++++++++++--
 .../workflows/layout-spec-maintainer.lock.yml | 14 +++++++++++--
 .github/workflows/lockfile-stats.lock.yml     | 14 +++++++++++--
 .github/workflows/mcp-inspector.lock.yml      | 14 +++++++++++--
 .github/workflows/mergefest.lock.yml          | 14 +++++++++++--
 .github/workflows/metrics-collector.lock.yml  |  7 ++++++-
 .../workflows/notion-issue-summary.lock.yml   | 14 +++++++++++--
 .github/workflows/org-health-report.lock.yml  | 14 +++++++++++--
 .github/workflows/org-wide-rollout.lock.yml   | 14 +++++++++++--
 .github/workflows/pdf-summary.lock.yml        | 14 +++++++++++--
 .github/workflows/plan.lock.yml               | 14 +++++++++++--
 ...ayground-org-project-update-issue.lock.yml | 14 +++++++++++--
 .../playground-snapshots-refresh.lock.yml     | 14 +++++++++++--
 .github/workflows/poem-bot.lock.yml           | 14 +++++++++++--
 .github/workflows/portfolio-analyst.lock.yml  | 14 +++++++++++--
 .../workflows/pr-nitpick-reviewer.lock.yml    | 14 +++++++++++--
 .../prompt-clustering-analysis.lock.yml       | 14 +++++++++++--
 .github/workflows/python-data-charts.lock.yml | 14 +++++++++++--
 .github/workflows/q.lock.yml                  | 14 +++++++++++--
 .github/workflows/release.lock.yml            | 20 ++++++++++++++-----
 .github/workflows/repo-tree-map.lock.yml      | 14 +++++++++++--
 .../repository-quality-improver.lock.yml      | 14 +++++++++++--
 .github/workflows/research.lock.yml           | 14 +++++++++++--
 .github/workflows/safe-output-health.lock.yml | 14 +++++++++++--
 .../schema-consistency-checker.lock.yml       | 14 +++++++++++--
 .github/workflows/scout.lock.yml              | 14 +++++++++++--
 .../workflows/security-compliance.lock.yml    | 14 +++++++++++--
 .github/workflows/security-fix-pr.lock.yml    | 14 +++++++++++--
 .../semantic-function-refactor.lock.yml       | 14 +++++++++++--
 .../workflows/slide-deck-maintainer.lock.yml  | 14 +++++++++++--
 .github/workflows/smoke-claude.lock.yml       | 14 +++++++++++--
 .../workflows/smoke-codex-firewall.lock.yml   | 14 +++++++++++--
 .github/workflows/smoke-codex.lock.yml        | 14 +++++++++++--
 .../smoke-copilot-no-firewall.lock.yml        | 14 +++++++++++--
 .../smoke-copilot-playwright.lock.yml         | 14 +++++++++++--
 .../smoke-copilot-safe-inputs.lock.yml        | 14 +++++++++++--
 .github/workflows/smoke-copilot.lock.yml      | 14 +++++++++++--
 .github/workflows/smoke-detector.lock.yml     | 14 +++++++++++--
 .../smoke-srt-custom-config.lock.yml          |  7 ++++++-
 .github/workflows/smoke-srt.lock.yml          | 14 +++++++++++--
 .github/workflows/spec-kit-execute.lock.yml   | 14 +++++++++++--
 .github/workflows/spec-kit-executor.lock.yml  | 14 +++++++++++--
 .github/workflows/speckit-dispatcher.lock.yml | 14 +++++++++++--
 .../workflows/stale-repo-identifier.lock.yml  | 16 ++++++++++++---
 .../workflows/static-analysis-report.lock.yml | 14 +++++++++++--
 .github/workflows/sub-issue-closer.lock.yml   | 14 +++++++++++--
 .github/workflows/super-linter.lock.yml       | 16 ++++++++++++---
 .../workflows/technical-doc-writer.lock.yml   | 14 +++++++++++--
 .github/workflows/tidy.lock.yml               | 14 +++++++++++--
 .github/workflows/typist.lock.yml             | 14 +++++++++++--
 .github/workflows/unbloat-docs.lock.yml       | 14 +++++++++++--
 .github/workflows/video-analyzer.lock.yml     | 14 +++++++++++--
 .../workflows/weekly-issue-summary.lock.yml   | 14 +++++++++++--
 .github/workflows/workflow-generator.lock.yml | 14 +++++++++++--
 .../workflow-health-manager.lock.yml          | 14 +++++++++++--
 pkg/workflow/js/runtime_import.cjs            |  8 +++++++-
 pkg/workflow/js/sanitize_content_core.cjs     |  8 +++++++-
 126 files changed, 1478 insertions(+), 251 deletions(-)

diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml
index 35f0f5c31b..f6eb211745 100644
--- a/.github/workflows/agent-performance-analyzer.lock.yml
+++ b/.github/workflows/agent-performance-analyzer.lock.yml
@@ -2716,7 +2716,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3172,7 +3177,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/ai-moderator.lock.yml b/.github/workflows/ai-moderator.lock.yml
index fa3b7b0f5c..74e68c13e5 100644
--- a/.github/workflows/ai-moderator.lock.yml
+++ b/.github/workflows/ai-moderator.lock.yml
@@ -2232,7 +2232,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2687,7 +2692,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml
index aa5bf11857..f0179e6ef7 100644
--- a/.github/workflows/archie.lock.yml
+++ b/.github/workflows/archie.lock.yml
@@ -2321,7 +2321,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2791,7 +2796,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml
index 31fc329874..873626ea3b 100644
--- a/.github/workflows/artifacts-summary.lock.yml
+++ b/.github/workflows/artifacts-summary.lock.yml
@@ -2126,7 +2126,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2595,7 +2600,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/audit-workflows.lock.yml b/.github/workflows/audit-workflows.lock.yml
index 7e8c073cde..3fff2eb72b 100644
--- a/.github/workflows/audit-workflows.lock.yml
+++ b/.github/workflows/audit-workflows.lock.yml
@@ -2418,7 +2418,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2947,7 +2952,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml
index cb66f19ad1..e0e6e60f59 100644
--- a/.github/workflows/blog-auditor.lock.yml
+++ b/.github/workflows/blog-auditor.lock.yml
@@ -2337,7 +2337,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2898,7 +2903,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/brave.lock.yml b/.github/workflows/brave.lock.yml
index 5e1cced4ac..8b015f4c31 100644
--- a/.github/workflows/brave.lock.yml
+++ b/.github/workflows/brave.lock.yml
@@ -2216,7 +2216,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2676,7 +2681,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml
index 097420cc9f..5848636b34 100644
--- a/.github/workflows/breaking-change-checker.lock.yml
+++ b/.github/workflows/breaking-change-checker.lock.yml
@@ -2242,7 +2242,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2716,7 +2721,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/campaign-generator.lock.yml b/.github/workflows/campaign-generator.lock.yml
index e5909d3606..0877e4c81f 100644
--- a/.github/workflows/campaign-generator.lock.yml
+++ b/.github/workflows/campaign-generator.lock.yml
@@ -2157,7 +2157,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2613,7 +2618,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/campaign-manager.lock.yml b/.github/workflows/campaign-manager.lock.yml
index 087ef219c5..b736593839 100644
--- a/.github/workflows/campaign-manager.lock.yml
+++ b/.github/workflows/campaign-manager.lock.yml
@@ -2577,7 +2577,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3033,7 +3038,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/changeset.lock.yml b/.github/workflows/changeset.lock.yml
index 456b3ece60..f7b2042e41 100644
--- a/.github/workflows/changeset.lock.yml
+++ b/.github/workflows/changeset.lock.yml
@@ -2363,7 +2363,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2815,7 +2820,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml
index f007ecc55b..33f741253a 100644
--- a/.github/workflows/ci-coach.lock.yml
+++ b/.github/workflows/ci-coach.lock.yml
@@ -2942,7 +2942,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3396,7 +3401,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml
index bdd341c744..7d12657426 100644
--- a/.github/workflows/ci-doctor.lock.yml
+++ b/.github/workflows/ci-doctor.lock.yml
@@ -2335,7 +2335,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2792,7 +2797,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml
index a88e604398..d29829330e 100644
--- a/.github/workflows/cli-consistency-checker.lock.yml
+++ b/.github/workflows/cli-consistency-checker.lock.yml
@@ -2258,7 +2258,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2712,7 +2717,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml
index 1653ed224f..1ba98def4c 100644
--- a/.github/workflows/cli-version-checker.lock.yml
+++ b/.github/workflows/cli-version-checker.lock.yml
@@ -2431,7 +2431,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2960,7 +2965,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml
index d82d5192ce..20c37fc6bb 100644
--- a/.github/workflows/cloclo.lock.yml
+++ b/.github/workflows/cloclo.lock.yml
@@ -2564,7 +2564,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3136,7 +3141,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/close-old-discussions.lock.yml b/.github/workflows/close-old-discussions.lock.yml
index 6f0e47e203..7c0e04346a 100644
--- a/.github/workflows/close-old-discussions.lock.yml
+++ b/.github/workflows/close-old-discussions.lock.yml
@@ -2234,7 +2234,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2687,7 +2692,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/commit-changes-analyzer.lock.yml b/.github/workflows/commit-changes-analyzer.lock.yml
index 54d74d73dd..cb14e159f7 100644
--- a/.github/workflows/commit-changes-analyzer.lock.yml
+++ b/.github/workflows/commit-changes-analyzer.lock.yml
@@ -2292,7 +2292,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2817,7 +2822,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/copilot-agent-analysis.lock.yml b/.github/workflows/copilot-agent-analysis.lock.yml
index e126ecc30e..3ea4ae87fe 100644
--- a/.github/workflows/copilot-agent-analysis.lock.yml
+++ b/.github/workflows/copilot-agent-analysis.lock.yml
@@ -2654,7 +2654,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3204,7 +3209,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml
index c5e70277ec..d0cb598e38 100644
--- a/.github/workflows/copilot-pr-merged-report.lock.yml
+++ b/.github/workflows/copilot-pr-merged-report.lock.yml
@@ -3507,7 +3507,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3962,7 +3967,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
index cca365e8b9..50dd45965c 100644
--- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
@@ -2973,7 +2973,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3430,7 +3435,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
index 4d3685e1cd..7658fb8aef 100644
--- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
@@ -2468,7 +2468,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2922,7 +2927,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/copilot-session-insights.lock.yml b/.github/workflows/copilot-session-insights.lock.yml
index b3362438ca..81a9598c1d 100644
--- a/.github/workflows/copilot-session-insights.lock.yml
+++ b/.github/workflows/copilot-session-insights.lock.yml
@@ -3408,7 +3408,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3936,7 +3941,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml
index 301811becc..654e7ed01f 100644
--- a/.github/workflows/craft.lock.yml
+++ b/.github/workflows/craft.lock.yml
@@ -2402,7 +2402,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2857,7 +2862,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml
index b9ef939e95..62d8686a85 100644
--- a/.github/workflows/daily-assign-issue-to-user.lock.yml
+++ b/.github/workflows/daily-assign-issue-to-user.lock.yml
@@ -2049,7 +2049,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2505,7 +2510,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-choice-test.lock.yml b/.github/workflows/daily-choice-test.lock.yml
index 4198ccacc9..09e6bbf4d9 100644
--- a/.github/workflows/daily-choice-test.lock.yml
+++ b/.github/workflows/daily-choice-test.lock.yml
@@ -1945,7 +1945,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2463,7 +2468,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-code-metrics.lock.yml b/.github/workflows/daily-code-metrics.lock.yml
index bf308e2acb..f42e3908b3 100644
--- a/.github/workflows/daily-code-metrics.lock.yml
+++ b/.github/workflows/daily-code-metrics.lock.yml
@@ -2165,7 +2165,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2690,7 +2695,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-copilot-token-report.lock.yml b/.github/workflows/daily-copilot-token-report.lock.yml
index a0fb099515..cbe4384a70 100644
--- a/.github/workflows/daily-copilot-token-report.lock.yml
+++ b/.github/workflows/daily-copilot-token-report.lock.yml
@@ -3070,7 +3070,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3527,7 +3532,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml
index d0414da3b0..4d47288e35 100644
--- a/.github/workflows/daily-doc-updater.lock.yml
+++ b/.github/workflows/daily-doc-updater.lock.yml
@@ -2246,7 +2246,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2797,7 +2802,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-fact.lock.yml b/.github/workflows/daily-fact.lock.yml
index 6de1187f50..737774b09f 100644
--- a/.github/workflows/daily-fact.lock.yml
+++ b/.github/workflows/daily-fact.lock.yml
@@ -2049,7 +2049,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2501,7 +2506,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml
index b8ae78b0d4..569d9ff156 100644
--- a/.github/workflows/daily-file-diet.lock.yml
+++ b/.github/workflows/daily-file-diet.lock.yml
@@ -3011,7 +3011,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3468,7 +3473,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml
index fc061f9a92..aeac9ee539 100644
--- a/.github/workflows/daily-firewall-report.lock.yml
+++ b/.github/workflows/daily-firewall-report.lock.yml
@@ -2539,7 +2539,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2996,7 +3001,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-issues-report.lock.yml b/.github/workflows/daily-issues-report.lock.yml
index 362c181f9d..a901ffff4f 100644
--- a/.github/workflows/daily-issues-report.lock.yml
+++ b/.github/workflows/daily-issues-report.lock.yml
@@ -3154,7 +3154,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3610,7 +3615,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-malicious-code-scan.lock.yml b/.github/workflows/daily-malicious-code-scan.lock.yml
index ab17890afd..6205352875 100644
--- a/.github/workflows/daily-malicious-code-scan.lock.yml
+++ b/.github/workflows/daily-malicious-code-scan.lock.yml
@@ -2368,7 +2368,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2836,7 +2841,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml
index ceeb00fa31..909cb08c95 100644
--- a/.github/workflows/daily-multi-device-docs-tester.lock.yml
+++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml
@@ -2218,7 +2218,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2785,7 +2790,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml
index b0e31954a1..2535ec3c04 100644
--- a/.github/workflows/daily-news.lock.yml
+++ b/.github/workflows/daily-news.lock.yml
@@ -2862,7 +2862,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3321,7 +3326,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml
index 73570d9d19..c002d7abff 100644
--- a/.github/workflows/daily-performance-summary.lock.yml
+++ b/.github/workflows/daily-performance-summary.lock.yml
@@ -4304,7 +4304,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -4761,7 +4766,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml
index 3147c66245..0bdb5994b6 100644
--- a/.github/workflows/daily-repo-chronicle.lock.yml
+++ b/.github/workflows/daily-repo-chronicle.lock.yml
@@ -2785,7 +2785,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3242,7 +3247,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml
index 9c67775a57..4723eea917 100644
--- a/.github/workflows/daily-team-status.lock.yml
+++ b/.github/workflows/daily-team-status.lock.yml
@@ -2133,7 +2133,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2589,7 +2594,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml
index 75481fe7eb..b89de9c903 100644
--- a/.github/workflows/daily-workflow-updater.lock.yml
+++ b/.github/workflows/daily-workflow-updater.lock.yml
@@ -2182,7 +2182,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2664,7 +2669,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/deep-report.lock.yml b/.github/workflows/deep-report.lock.yml
index 0a050f3967..6766ced1b1 100644
--- a/.github/workflows/deep-report.lock.yml
+++ b/.github/workflows/deep-report.lock.yml
@@ -2632,7 +2632,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3088,7 +3093,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml
index b88e0d2d8e..8e61eca967 100644
--- a/.github/workflows/dependabot-go-checker.lock.yml
+++ b/.github/workflows/dependabot-go-checker.lock.yml
@@ -2527,7 +2527,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2981,7 +2986,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml
index 5b4cd1188f..fa0344eafe 100644
--- a/.github/workflows/dev-hawk.lock.yml
+++ b/.github/workflows/dev-hawk.lock.yml
@@ -2296,7 +2296,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2766,7 +2771,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml
index 86deb20065..22aef76965 100644
--- a/.github/workflows/dev.lock.yml
+++ b/.github/workflows/dev.lock.yml
@@ -1994,7 +1994,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2451,7 +2456,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml
index 999ffa86c0..c8bd9e76a5 100644
--- a/.github/workflows/developer-docs-consolidator.lock.yml
+++ b/.github/workflows/developer-docs-consolidator.lock.yml
@@ -2798,7 +2798,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3350,7 +3355,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml
index c9ef1e1b71..09576f6b80 100644
--- a/.github/workflows/dictation-prompt.lock.yml
+++ b/.github/workflows/dictation-prompt.lock.yml
@@ -2109,7 +2109,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2563,7 +2568,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml
index 3e5d0fe5ae..de4535cdfb 100644
--- a/.github/workflows/docs-noob-tester.lock.yml
+++ b/.github/workflows/docs-noob-tester.lock.yml
@@ -2267,7 +2267,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2724,7 +2729,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/duplicate-code-detector.lock.yml b/.github/workflows/duplicate-code-detector.lock.yml
index 713c6d3d16..1a7a0aed4c 100644
--- a/.github/workflows/duplicate-code-detector.lock.yml
+++ b/.github/workflows/duplicate-code-detector.lock.yml
@@ -2293,7 +2293,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2746,7 +2751,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/example-permissions-warning.lock.yml b/.github/workflows/example-permissions-warning.lock.yml
index a5f39ee943..a9cdc40fd4 100644
--- a/.github/workflows/example-permissions-warning.lock.yml
+++ b/.github/workflows/example-permissions-warning.lock.yml
@@ -476,7 +476,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
diff --git a/.github/workflows/example-workflow-analyzer.lock.yml b/.github/workflows/example-workflow-analyzer.lock.yml
index 5836b117ed..058e971ff8 100644
--- a/.github/workflows/example-workflow-analyzer.lock.yml
+++ b/.github/workflows/example-workflow-analyzer.lock.yml
@@ -2048,7 +2048,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2566,7 +2571,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml
index e391bb3ec6..cfc2c9142b 100644
--- a/.github/workflows/firewall-escape.lock.yml
+++ b/.github/workflows/firewall-escape.lock.yml
@@ -687,7 +687,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
diff --git a/.github/workflows/firewall.lock.yml b/.github/workflows/firewall.lock.yml
index 70b4020bf7..57c750d465 100644
--- a/.github/workflows/firewall.lock.yml
+++ b/.github/workflows/firewall.lock.yml
@@ -543,7 +543,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
diff --git a/.github/workflows/github-mcp-structural-analysis.lock.yml b/.github/workflows/github-mcp-structural-analysis.lock.yml
index 174d11815e..4c29c7cea6 100644
--- a/.github/workflows/github-mcp-structural-analysis.lock.yml
+++ b/.github/workflows/github-mcp-structural-analysis.lock.yml
@@ -2761,7 +2761,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3289,7 +3294,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml
index f527af3e1a..b134e55ea6 100644
--- a/.github/workflows/github-mcp-tools-report.lock.yml
+++ b/.github/workflows/github-mcp-tools-report.lock.yml
@@ -2614,7 +2614,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3161,7 +3166,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
index b50fb7f15c..7573f423bd 100644
--- a/.github/workflows/glossary-maintainer.lock.yml
+++ b/.github/workflows/glossary-maintainer.lock.yml
@@ -2764,7 +2764,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3245,7 +3250,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/go-fan.lock.yml b/.github/workflows/go-fan.lock.yml
index 9d1b77c57c..d5ded3306d 100644
--- a/.github/workflows/go-fan.lock.yml
+++ b/.github/workflows/go-fan.lock.yml
@@ -2402,7 +2402,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2948,7 +2953,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/go-file-size-reduction-project64.campaign.g.lock.yml b/.github/workflows/go-file-size-reduction-project64.campaign.g.lock.yml
index cd0a7982b0..8fbe301936 100644
--- a/.github/workflows/go-file-size-reduction-project64.campaign.g.lock.yml
+++ b/.github/workflows/go-file-size-reduction-project64.campaign.g.lock.yml
@@ -2291,7 +2291,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2747,7 +2752,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml
index 6e38b40b63..b63b2641be 100644
--- a/.github/workflows/go-logger.lock.yml
+++ b/.github/workflows/go-logger.lock.yml
@@ -2320,7 +2320,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2875,7 +2880,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/go-pattern-detector.lock.yml b/.github/workflows/go-pattern-detector.lock.yml
index 5829fc362e..75ac57f494 100644
--- a/.github/workflows/go-pattern-detector.lock.yml
+++ b/.github/workflows/go-pattern-detector.lock.yml
@@ -2206,7 +2206,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2725,7 +2730,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml
index ad7caa2e98..aed651b04d 100644
--- a/.github/workflows/grumpy-reviewer.lock.yml
+++ b/.github/workflows/grumpy-reviewer.lock.yml
@@ -2326,7 +2326,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2783,7 +2788,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml
index 22f7187d92..79e5798996 100644
--- a/.github/workflows/hourly-ci-cleaner.lock.yml
+++ b/.github/workflows/hourly-ci-cleaner.lock.yml
@@ -2439,7 +2439,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2893,7 +2898,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/human-ai-collaboration.lock.yml b/.github/workflows/human-ai-collaboration.lock.yml
index 287e2759b5..95a427e598 100644
--- a/.github/workflows/human-ai-collaboration.lock.yml
+++ b/.github/workflows/human-ai-collaboration.lock.yml
@@ -2568,7 +2568,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3024,7 +3029,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/incident-response.lock.yml b/.github/workflows/incident-response.lock.yml
index 7f67d19e40..2c509cab89 100644
--- a/.github/workflows/incident-response.lock.yml
+++ b/.github/workflows/incident-response.lock.yml
@@ -2696,7 +2696,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3173,7 +3178,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml
index b741c36b3a..b5f27fb9aa 100644
--- a/.github/workflows/instructions-janitor.lock.yml
+++ b/.github/workflows/instructions-janitor.lock.yml
@@ -2204,7 +2204,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2755,7 +2760,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/intelligence.lock.yml b/.github/workflows/intelligence.lock.yml
index f9592ca4e7..03ea2053a6 100644
--- a/.github/workflows/intelligence.lock.yml
+++ b/.github/workflows/intelligence.lock.yml
@@ -3243,7 +3243,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3700,7 +3705,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/issue-arborist.lock.yml b/.github/workflows/issue-arborist.lock.yml
index f74e95d549..5e63958b42 100644
--- a/.github/workflows/issue-arborist.lock.yml
+++ b/.github/workflows/issue-arborist.lock.yml
@@ -2363,7 +2363,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2816,7 +2821,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/issue-classifier.lock.yml b/.github/workflows/issue-classifier.lock.yml
index bbbbaa0e75..86c01e6d76 100644
--- a/.github/workflows/issue-classifier.lock.yml
+++ b/.github/workflows/issue-classifier.lock.yml
@@ -2051,7 +2051,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2206,7 +2211,7 @@ jobs:
           path: /tmp/gh-aw/aw_info.json
           if-no-files-found: warn
       - name: Run AI Inference
-        uses: actions/ai-inference@334892bb203895caaed82ec52d23c1ed9385151e # v2.0.4
+        uses: actions/ai-inference@334892bb203895caaed82ec52d23c1ed9385151e # v1
         env:
           GH_AW_MCP_CONFIG: /tmp/gh-aw/mcp-config/mcp-servers.json
           GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
@@ -2497,7 +2502,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml
index 2834647ccf..e3f7b84f83 100644
--- a/.github/workflows/issue-monster.lock.yml
+++ b/.github/workflows/issue-monster.lock.yml
@@ -2261,7 +2261,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2717,7 +2722,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index d4c3aab56c..450b5bbae2 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -2047,7 +2047,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2503,7 +2508,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml
index 720f9589a3..65959c8697 100644
--- a/.github/workflows/jsweep.lock.yml
+++ b/.github/workflows/jsweep.lock.yml
@@ -2266,7 +2266,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2751,7 +2756,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml
index 92c0804721..c0f7be1774 100644
--- a/.github/workflows/layout-spec-maintainer.lock.yml
+++ b/.github/workflows/layout-spec-maintainer.lock.yml
@@ -2299,7 +2299,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2782,7 +2787,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/lockfile-stats.lock.yml b/.github/workflows/lockfile-stats.lock.yml
index abc7a58eb6..b977af5a45 100644
--- a/.github/workflows/lockfile-stats.lock.yml
+++ b/.github/workflows/lockfile-stats.lock.yml
@@ -2406,7 +2406,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2942,7 +2947,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 35f7df8464..1c8ff47293 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -2527,7 +2527,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3078,7 +3083,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml
index d67d657c87..bf66275ac8 100644
--- a/.github/workflows/mergefest.lock.yml
+++ b/.github/workflows/mergefest.lock.yml
@@ -2395,7 +2395,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2889,7 +2894,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/metrics-collector.lock.yml b/.github/workflows/metrics-collector.lock.yml
index 345bfe0f6c..a7c463bbc6 100644
--- a/.github/workflows/metrics-collector.lock.yml
+++ b/.github/workflows/metrics-collector.lock.yml
@@ -798,7 +798,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
diff --git a/.github/workflows/notion-issue-summary.lock.yml b/.github/workflows/notion-issue-summary.lock.yml
index b7e5f6e773..1a7f92a30b 100644
--- a/.github/workflows/notion-issue-summary.lock.yml
+++ b/.github/workflows/notion-issue-summary.lock.yml
@@ -2025,7 +2025,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2487,7 +2492,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/org-health-report.lock.yml b/.github/workflows/org-health-report.lock.yml
index 9f1a7c0ed6..a0ebb48606 100644
--- a/.github/workflows/org-health-report.lock.yml
+++ b/.github/workflows/org-health-report.lock.yml
@@ -2899,7 +2899,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3356,7 +3361,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/org-wide-rollout.lock.yml b/.github/workflows/org-wide-rollout.lock.yml
index e0e3488d39..99a7f1997d 100644
--- a/.github/workflows/org-wide-rollout.lock.yml
+++ b/.github/workflows/org-wide-rollout.lock.yml
@@ -2724,7 +2724,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3201,7 +3206,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml
index 4c14b3b66f..7bc689f692 100644
--- a/.github/workflows/pdf-summary.lock.yml
+++ b/.github/workflows/pdf-summary.lock.yml
@@ -2314,7 +2314,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2773,7 +2778,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml
index c55249656d..e4abe36248 100644
--- a/.github/workflows/plan.lock.yml
+++ b/.github/workflows/plan.lock.yml
@@ -2362,7 +2362,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2819,7 +2824,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/playground-org-project-update-issue.lock.yml b/.github/workflows/playground-org-project-update-issue.lock.yml
index 90c1b36513..ed14ee3728 100644
--- a/.github/workflows/playground-org-project-update-issue.lock.yml
+++ b/.github/workflows/playground-org-project-update-issue.lock.yml
@@ -2065,7 +2065,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2522,7 +2527,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/playground-snapshots-refresh.lock.yml b/.github/workflows/playground-snapshots-refresh.lock.yml
index ee989f544d..4162f0ae72 100644
--- a/.github/workflows/playground-snapshots-refresh.lock.yml
+++ b/.github/workflows/playground-snapshots-refresh.lock.yml
@@ -2057,7 +2057,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2537,7 +2542,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml
index c419c44e2c..497dc04d1a 100644
--- a/.github/workflows/poem-bot.lock.yml
+++ b/.github/workflows/poem-bot.lock.yml
@@ -2725,7 +2725,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3206,7 +3211,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml
index e3c911ceb3..ca58767c88 100644
--- a/.github/workflows/portfolio-analyst.lock.yml
+++ b/.github/workflows/portfolio-analyst.lock.yml
@@ -2890,7 +2890,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3347,7 +3352,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml
index 94e905c48c..c65dad649c 100644
--- a/.github/workflows/pr-nitpick-reviewer.lock.yml
+++ b/.github/workflows/pr-nitpick-reviewer.lock.yml
@@ -2636,7 +2636,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3093,7 +3098,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/prompt-clustering-analysis.lock.yml b/.github/workflows/prompt-clustering-analysis.lock.yml
index 64e5d09089..2cfed6bd71 100644
--- a/.github/workflows/prompt-clustering-analysis.lock.yml
+++ b/.github/workflows/prompt-clustering-analysis.lock.yml
@@ -2858,7 +2858,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3383,7 +3388,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml
index 20d31dc827..eeb546f60d 100644
--- a/.github/workflows/python-data-charts.lock.yml
+++ b/.github/workflows/python-data-charts.lock.yml
@@ -3191,7 +3191,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3648,7 +3653,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index f8fcec7d4c..77e7868567 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -2665,7 +2665,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3129,7 +3134,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
index da587dae86..f5a0cc548d 100644
--- a/.github/workflows/release.lock.yml
+++ b/.github/workflows/release.lock.yml
@@ -2197,7 +2197,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2651,7 +2656,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
@@ -6021,13 +6031,13 @@ jobs:
       - name: Download Go modules
         run: go mod download
       - name: Generate SBOM (SPDX format)
-        uses: anchore/sbom-action@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0.20.11
+        uses: anchore/sbom-action@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0.20.10
         with:
           artifact-name: sbom.spdx.json
           format: spdx-json
           output-file: sbom.spdx.json
       - name: Generate SBOM (CycloneDX format)
-        uses: anchore/sbom-action@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0.20.11
+        uses: anchore/sbom-action@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0.20.10
         with:
           artifact-name: sbom.cdx.json
           format: cyclonedx-json
@@ -6234,7 +6244,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Release with gh-extension-precompile
-        uses: cli/gh-extension-precompile@9e2237c30f869ad3bcaed6a4be2cd43564dd421b # v2.1.0
+        uses: cli/gh-extension-precompile@9e2237c30f869ad3bcaed6a4be2cd43564dd421b # v2
         with:
           build_script_override: scripts/build-release.sh
           go_version_file: go.mod
diff --git a/.github/workflows/repo-tree-map.lock.yml b/.github/workflows/repo-tree-map.lock.yml
index 8fde8dc901..f83003bd33 100644
--- a/.github/workflows/repo-tree-map.lock.yml
+++ b/.github/workflows/repo-tree-map.lock.yml
@@ -2143,7 +2143,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2597,7 +2602,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml
index 828d77fb6c..7569eac62b 100644
--- a/.github/workflows/repository-quality-improver.lock.yml
+++ b/.github/workflows/repository-quality-improver.lock.yml
@@ -2694,7 +2694,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3148,7 +3153,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/research.lock.yml b/.github/workflows/research.lock.yml
index a159216f44..4d742de551 100644
--- a/.github/workflows/research.lock.yml
+++ b/.github/workflows/research.lock.yml
@@ -2105,7 +2105,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2565,7 +2570,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/safe-output-health.lock.yml b/.github/workflows/safe-output-health.lock.yml
index 8142542fe1..5d54002ec3 100644
--- a/.github/workflows/safe-output-health.lock.yml
+++ b/.github/workflows/safe-output-health.lock.yml
@@ -2528,7 +2528,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3067,7 +3072,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/schema-consistency-checker.lock.yml b/.github/workflows/schema-consistency-checker.lock.yml
index 6ce59d0b4b..043a8bdb59 100644
--- a/.github/workflows/schema-consistency-checker.lock.yml
+++ b/.github/workflows/schema-consistency-checker.lock.yml
@@ -2350,7 +2350,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2878,7 +2883,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml
index 023c3167eb..10824147f7 100644
--- a/.github/workflows/scout.lock.yml
+++ b/.github/workflows/scout.lock.yml
@@ -2488,7 +2488,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3043,7 +3048,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml
index 0b0b795c55..81eb4f605c 100644
--- a/.github/workflows/security-compliance.lock.yml
+++ b/.github/workflows/security-compliance.lock.yml
@@ -2388,7 +2388,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2844,7 +2849,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/security-fix-pr.lock.yml b/.github/workflows/security-fix-pr.lock.yml
index 3f7c501888..414c1e0393 100644
--- a/.github/workflows/security-fix-pr.lock.yml
+++ b/.github/workflows/security-fix-pr.lock.yml
@@ -2237,7 +2237,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2765,7 +2770,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/semantic-function-refactor.lock.yml b/.github/workflows/semantic-function-refactor.lock.yml
index d5328ecf37..dab6970b30 100644
--- a/.github/workflows/semantic-function-refactor.lock.yml
+++ b/.github/workflows/semantic-function-refactor.lock.yml
@@ -2546,7 +2546,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3089,7 +3094,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml
index 6e32e52f8d..17cbcb6af5 100644
--- a/.github/workflows/slide-deck-maintainer.lock.yml
+++ b/.github/workflows/slide-deck-maintainer.lock.yml
@@ -2354,7 +2354,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2845,7 +2850,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index 3de88874bf..c9a866d7a0 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -2394,7 +2394,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2944,7 +2949,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/smoke-codex-firewall.lock.yml b/.github/workflows/smoke-codex-firewall.lock.yml
index ee548b0b8e..a0be7219dd 100644
--- a/.github/workflows/smoke-codex-firewall.lock.yml
+++ b/.github/workflows/smoke-codex-firewall.lock.yml
@@ -2195,7 +2195,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2648,7 +2653,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml
index 2ef0e7e0fc..e508a64635 100644
--- a/.github/workflows/smoke-codex.lock.yml
+++ b/.github/workflows/smoke-codex.lock.yml
@@ -2299,7 +2299,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2752,7 +2757,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/smoke-copilot-no-firewall.lock.yml b/.github/workflows/smoke-copilot-no-firewall.lock.yml
index 3aa1bd86be..c1e5987675 100644
--- a/.github/workflows/smoke-copilot-no-firewall.lock.yml
+++ b/.github/workflows/smoke-copilot-no-firewall.lock.yml
@@ -3521,7 +3521,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3980,7 +3985,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/smoke-copilot-playwright.lock.yml b/.github/workflows/smoke-copilot-playwright.lock.yml
index b88abe4dab..ee6883ae3f 100644
--- a/.github/workflows/smoke-copilot-playwright.lock.yml
+++ b/.github/workflows/smoke-copilot-playwright.lock.yml
@@ -3633,7 +3633,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -4090,7 +4095,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/smoke-copilot-safe-inputs.lock.yml b/.github/workflows/smoke-copilot-safe-inputs.lock.yml
index 6635782779..0655587bd5 100644
--- a/.github/workflows/smoke-copilot-safe-inputs.lock.yml
+++ b/.github/workflows/smoke-copilot-safe-inputs.lock.yml
@@ -3341,7 +3341,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3796,7 +3801,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index 384ed1bf77..38d411de1c 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -2349,7 +2349,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2803,7 +2808,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/smoke-detector.lock.yml b/.github/workflows/smoke-detector.lock.yml
index df49539395..1ca9648d3e 100644
--- a/.github/workflows/smoke-detector.lock.yml
+++ b/.github/workflows/smoke-detector.lock.yml
@@ -2469,7 +2469,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2991,7 +2996,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/smoke-srt-custom-config.lock.yml b/.github/workflows/smoke-srt-custom-config.lock.yml
index 46224f7af0..1fe931fec2 100644
--- a/.github/workflows/smoke-srt-custom-config.lock.yml
+++ b/.github/workflows/smoke-srt-custom-config.lock.yml
@@ -484,7 +484,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
diff --git a/.github/workflows/smoke-srt.lock.yml b/.github/workflows/smoke-srt.lock.yml
index 80232583af..0b06429097 100644
--- a/.github/workflows/smoke-srt.lock.yml
+++ b/.github/workflows/smoke-srt.lock.yml
@@ -1969,7 +1969,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2638,7 +2643,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/spec-kit-execute.lock.yml b/.github/workflows/spec-kit-execute.lock.yml
index ff806adf67..59b1d2ba0d 100644
--- a/.github/workflows/spec-kit-execute.lock.yml
+++ b/.github/workflows/spec-kit-execute.lock.yml
@@ -2454,7 +2454,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2944,7 +2949,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/spec-kit-executor.lock.yml b/.github/workflows/spec-kit-executor.lock.yml
index 9d788af6d2..be0d6cb336 100644
--- a/.github/workflows/spec-kit-executor.lock.yml
+++ b/.github/workflows/spec-kit-executor.lock.yml
@@ -2329,7 +2329,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2819,7 +2824,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/speckit-dispatcher.lock.yml b/.github/workflows/speckit-dispatcher.lock.yml
index 35dd1041f9..dcc4c508d1 100644
--- a/.github/workflows/speckit-dispatcher.lock.yml
+++ b/.github/workflows/speckit-dispatcher.lock.yml
@@ -2580,7 +2580,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3058,7 +3063,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml
index f1fe7c40a4..a2dc0fc246 100644
--- a/.github/workflows/stale-repo-identifier.lock.yml
+++ b/.github/workflows/stale-repo-identifier.lock.yml
@@ -176,7 +176,7 @@ jobs:
           ORGANIZATION: ${{ env.ORGANIZATION }}
         id: stale-repos
         name: Run stale_repos tool
-        uses: github/stale-repos@a21e55567b83cf3c3f3f9085d3038dc6cee02598 # v3.0.2
+        uses: github/stale-repos@a21e55567b83cf3c3f3f9085d3038dc6cee02598 # v3
       - env:
           INACTIVE_REPOS: ${{ steps.stale-repos.outputs.inactiveRepos }}
         name: Save stale repos output
@@ -2925,7 +2925,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3382,7 +3387,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/static-analysis-report.lock.yml b/.github/workflows/static-analysis-report.lock.yml
index 781c37fa7c..b24912db94 100644
--- a/.github/workflows/static-analysis-report.lock.yml
+++ b/.github/workflows/static-analysis-report.lock.yml
@@ -2439,7 +2439,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2962,7 +2967,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml
index 882f5131d8..fbf753bd7f 100644
--- a/.github/workflows/sub-issue-closer.lock.yml
+++ b/.github/workflows/sub-issue-closer.lock.yml
@@ -2195,7 +2195,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2651,7 +2656,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml
index 129ba416e5..27afaf48be 100644
--- a/.github/workflows/super-linter.lock.yml
+++ b/.github/workflows/super-linter.lock.yml
@@ -2260,7 +2260,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2714,7 +2719,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
@@ -6151,7 +6161,7 @@ jobs:
           persist-credentials: false
       - name: Super-linter
         id: super-linter
-        uses: super-linter/super-linter@47984f49b4e87383eed97890fe2dca6063bbd9c3 # v8.3.1
+        uses: super-linter/super-linter@47984f49b4e87383eed97890fe2dca6063bbd9c3 # v8.2.1
         env:
           CREATE_LOG_FILE: "true"
           DEFAULT_BRANCH: main
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
index d8b255fac2..61e2aa508b 100644
--- a/.github/workflows/technical-doc-writer.lock.yml
+++ b/.github/workflows/technical-doc-writer.lock.yml
@@ -2584,7 +2584,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3045,7 +3050,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml
index af1a0cf169..f3557d2772 100644
--- a/.github/workflows/tidy.lock.yml
+++ b/.github/workflows/tidy.lock.yml
@@ -2216,7 +2216,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2696,7 +2701,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/typist.lock.yml b/.github/workflows/typist.lock.yml
index 0388f6b09c..8d8a3b174d 100644
--- a/.github/workflows/typist.lock.yml
+++ b/.github/workflows/typist.lock.yml
@@ -2544,7 +2544,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3087,7 +3092,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml
index 37377b8dd1..d82e9fa730 100644
--- a/.github/workflows/unbloat-docs.lock.yml
+++ b/.github/workflows/unbloat-docs.lock.yml
@@ -2487,7 +2487,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3075,7 +3080,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml
index 7d7e1512ae..781d65b906 100644
--- a/.github/workflows/video-analyzer.lock.yml
+++ b/.github/workflows/video-analyzer.lock.yml
@@ -2345,7 +2345,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2815,7 +2820,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml
index efdb32490c..e830a6e3c5 100644
--- a/.github/workflows/weekly-issue-summary.lock.yml
+++ b/.github/workflows/weekly-issue-summary.lock.yml
@@ -2716,7 +2716,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3173,7 +3178,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml
index df7f73adc6..3819d86e6d 100644
--- a/.github/workflows/workflow-generator.lock.yml
+++ b/.github/workflows/workflow-generator.lock.yml
@@ -2175,7 +2175,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -2631,7 +2636,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml
index 07226c8c61..5f45df04f5 100644
--- a/.github/workflows/workflow-health-manager.lock.yml
+++ b/.github/workflows/workflow-health-manager.lock.yml
@@ -2562,7 +2562,12 @@ jobs:
               return content.trimStart().startsWith("---\n") || content.trimStart().startsWith("---\r\n");
             }
             function removeXMLComments(content) {
-              return content.replace(/<!--[\s\S]*?-->/g, "");
+              let previous;
+              do {
+                previous = content;
+                content = content.replace(/<!--[\s\S]*?-->/g, "");
+              } while (content !== previous);
+              return content;
             }
             function hasGitHubActionsMacros(content) {
               return /\$\{\{[\s\S]*?\}\}/.test(content);
@@ -3018,7 +3023,12 @@ jobs:
               });
             }
             function removeXmlComments(s) {
-              return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              let previous;
+              do {
+                previous = s;
+                s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+              } while (s !== previous);
+              return s;
             }
             function convertXmlTags(s) {
               const allowedTags = ["b", "blockquote", "br", "code", "details", "em", "h1", "h2", "h3", "h4", "h5", "h6", "hr", "i", "li", "ol", "p", "pre", "strong", "sub", "summary", "sup", "table", "tbody", "td", "th", "thead", "tr", "ul"];
diff --git a/pkg/workflow/js/runtime_import.cjs b/pkg/workflow/js/runtime_import.cjs
index fbced3eaa7..3b5781ef5f 100644
--- a/pkg/workflow/js/runtime_import.cjs
+++ b/pkg/workflow/js/runtime_import.cjs
@@ -24,7 +24,13 @@ function hasFrontMatter(content) {
  */
 function removeXMLComments(content) {
   // Remove XML/HTML comments: <!-- ... -->
-  return content.replace(/<!--[\s\S]*?-->/g, "");
+  // Apply repeatedly to handle nested/overlapping patterns that could reintroduce comment markers
+  let previous;
+  do {
+    previous = content;
+    content = content.replace(/<!--[\s\S]*?-->/g, "");
+  } while (content !== previous);
+  return content;
 }
 
 /**
diff --git a/pkg/workflow/js/sanitize_content_core.cjs b/pkg/workflow/js/sanitize_content_core.cjs
index cc9c207688..a3e0863aca 100644
--- a/pkg/workflow/js/sanitize_content_core.cjs
+++ b/pkg/workflow/js/sanitize_content_core.cjs
@@ -278,7 +278,13 @@ function neutralizeAllMentions(s) {
  */
 function removeXmlComments(s) {
   // Remove <!-- comment --> and malformed <!--! comment --!>
-  return s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+  // Apply repeatedly to handle nested/overlapping patterns that could reintroduce comment markers
+  let previous;
+  do {
+    previous = s;
+    s = s.replace(/<!--[\s\S]*?-->/g, "").replace(/<!--[\s\S]*?--!>/g, "");
+  } while (s !== previous);
+  return s;
 }
 
 /**