Skip to content

Commit

Permalink
tools: ensure the PR was not pushed before merging
Browse files Browse the repository at this point in the history
When using Squash and Merge feature, it would allow to a malicious
actor to push unreviewed code to their PR while the CQ is running and
bypass the usual checks.
This commit adds a check to refuse to land if the head of the PR
branch is different from the one validated by ncu.

PR-URL: #40747
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Voltrex <mohammadkeyvanzade94@gmail.com>
  • Loading branch information
aduh95 authored and targos committed Nov 8, 2021
1 parent ea968d5 commit a3df50d
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion tools/actions/commit-queue.sh
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,8 @@ for pr in "$@"; do
jq -n \
--arg title "$(git log -1 --pretty='format:%s')" \
--arg body "$(git log -1 --pretty='format:%b')" \
'{merge_method:"squash",commit_title:$title,commit_message:$body}' > output.json
--arg head "$(grep 'Fetched commits as' output | cut -d. -f3 | xargs git rev-parse)" \
'{merge_method:"squash",commit_title:$title,commit_message:$body,sha:$head}' > output.json
cat output.json
gitHubCurl "$(mergeUrl "$pr")" PUT --data @output.json > output
cat output
Expand Down

0 comments on commit a3df50d

Please sign in to comment.