Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit cba8eaf

Browse filesBrowse files
aduh95BethGriggs
aduh95
authored and
BethGriggs
committed
tools: ensure the PR was not pushed before merging
When using Squash and Merge feature, it would allow to a malicious actor to push unreviewed code to their PR while the CQ is running and bypass the usual checks. This commit adds a check to refuse to land if the head of the PR branch is different from the one validated by ncu. PR-URL: #40747 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Voltrex <mohammadkeyvanzade94@gmail.com>
1 parent 58de6ce commit cba8eaf
Copy full SHA for cba8eaf

File tree

Expand file treeCollapse file tree

1 file changed

+2
-1
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

1 file changed

+2
-1
lines changed
Open diff view settings
Collapse file

‎tools/actions/commit-queue.sh‎

Copy file name to clipboardExpand all lines: tools/actions/commit-queue.sh
+2-1Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,8 @@ for pr in "$@"; do
110110
jq -n \
111111
--arg title "$(git log -1 --pretty='format:%s')" \
112112
--arg body "$(git log -1 --pretty='format:%b')" \
113-
'{merge_method:"squash",commit_title:$title,commit_message:$body}' > output.json
113+
--arg head "$(grep 'Fetched commits as' output | cut -d. -f3 | xargs git rev-parse)" \
114+
'{merge_method:"squash",commit_title:$title,commit_message:$body,sha:$head}' > output.json
114115
cat output.json
115116
gitHubCurl "$(mergeUrl "$pr")" PUT --data @output.json > output
116117
cat output

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.