Commit a3df50d
tools: ensure the PR was not pushed before merging
When using Squash and Merge feature, it would allow to a malicious
actor to push unreviewed code to their PR while the CQ is running and
bypass the usual checks.
This commit adds a check to refuse to land if the head of the PR
branch is different from the one validated by ncu.
PR-URL: #40747
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Voltrex <mohammadkeyvanzade94@gmail.com>1 parent ea968d5 commit a3df50d
1 file changed
Lines changed: 2 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -110,7 +110,8 @@ for pr in "$@"; do | |||
| 110 | 110 | jq -n \ | |
| 111 | 111 | --arg title "$(git log -1 --pretty='format:%s')" \ | |
| 112 | 112 | --arg body "$(git log -1 --pretty='format:%b')" \ | |
| 113 | - '{merge_method:"squash",commit_title:$title,commit_message:$body}' > output.json | ||
| 113 | + --arg head "$(grep 'Fetched commits as' output | cut -d. -f3 | xargs git rev-parse)" \ | ||
| 114 | + '{merge_method:"squash",commit_title:$title,commit_message:$body,sha:$head}' > output.json | ||
| 114 | 115 | cat output.json | |
| 115 | 116 | gitHubCurl "$(mergeUrl "$pr")" PUT --data @output.json > output | |
| 116 | 117 | cat output | |
0 commit comments