From 851fa753bb6a27531f5f0fde70abc4bbc12faf5f Mon Sep 17 00:00:00 2001 From: Michael Recachinas Date: Tue, 11 Aug 2026 10:56:33 -0400 Subject: [PATCH 1/3] Migrate advisory staging workflows off pull_request_target Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/create_staging_branch.yaml | 22 +--- .../create_staging_branch_writer.yaml | 101 ++++++++++++++++++ .../delete_staging_and_head_branches.yaml | 20 +--- ...lete_staging_and_head_branches_writer.yaml | 94 ++++++++++++++++ 4 files changed, 205 insertions(+), 32 deletions(-) create mode 100644 .github/workflows/create_staging_branch_writer.yaml create mode 100644 .github/workflows/delete_staging_and_head_branches_writer.yaml diff --git a/.github/workflows/create_staging_branch.yaml b/.github/workflows/create_staging_branch.yaml index 5be79da03e85..8c92e312bf42 100644 --- a/.github/workflows/create_staging_branch.yaml +++ b/.github/workflows/create_staging_branch.yaml @@ -1,30 +1,18 @@ name: Create PR staging branch on: - pull_request_target: + pull_request: branches: [main] types: [opened, synchronize, reopened, edited] paths: - "advisories/**" - workflow_dispatch: permissions: - contents: write # Required to create and push branches - pull-requests: write # Required to edit PR base branch + contents: read jobs: - ensure-base-is-staging: + signal: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - name: ensure base is staging - env: - PR_AUTHOR: ${{ github.event.pull_request.user.login }} - PR_NUMBER: ${{ github.event.pull_request.number }} - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - set -xeo pipefail - BRANCH_NAME="$PR_AUTHOR"/advisory-improvement-"$PR_NUMBER" - git checkout -b "$BRANCH_NAME" - git push origin "$BRANCH_NAME" - gh pr edit --repo ${{ github.repository }} $PR_NUMBER --base "$BRANCH_NAME" + - name: Record pull request signal + run: echo "Create staging branch signal received." diff --git a/.github/workflows/create_staging_branch_writer.yaml b/.github/workflows/create_staging_branch_writer.yaml new file mode 100644 index 000000000000..fff5573bf9a6 --- /dev/null +++ b/.github/workflows/create_staging_branch_writer.yaml @@ -0,0 +1,101 @@ +name: Create PR staging branch writer + +on: + workflow_run: + workflows: ["Create PR staging branch"] + types: [completed] + workflow_dispatch: + inputs: + pr_number: + description: Pull request number to process + required: true + type: number + +permissions: + contents: write + pull-requests: write + +jobs: + ensure-base-is-staging: + if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request') }} + runs-on: ubuntu-latest + steps: + - name: Ensure base is staging + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + REPOSITORY: ${{ github.repository }} + WORKFLOW_RUN_PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }} + DISPATCH_PR_NUMBER: ${{ inputs.pr_number }} + run: | + set -euo pipefail + + if [[ "${GITHUB_EVENT_NAME}" == "workflow_run" ]]; then + PR_NUMBER="${WORKFLOW_RUN_PR_NUMBER}" + else + PR_NUMBER="${DISPATCH_PR_NUMBER}" + fi + + if [[ -z "${PR_NUMBER}" || "${PR_NUMBER}" == "null" ]]; then + echo "No pull request number was provided; skipping." + exit 0 + fi + + pr_json="$(gh api "repos/${REPOSITORY}/pulls/${PR_NUMBER}")" + state="$(jq -r '.state' <<<"${pr_json}")" + base_ref="$(jq -r '.base.ref' <<<"${pr_json}")" + base_repo="$(jq -r '.base.repo.full_name' <<<"${pr_json}")" + pr_author="$(jq -r '.user.login' <<<"${pr_json}")" + + if [[ "${state}" != "open" ]]; then + echo "Pull request ${PR_NUMBER} is ${state}; skipping." + exit 0 + fi + + if [[ "${base_ref}" != "main" ]]; then + echo "Pull request ${PR_NUMBER} base is ${base_ref}, not main; skipping." + exit 0 + fi + + if [[ "${base_repo}" != "${REPOSITORY}" ]]; then + echo "Pull request ${PR_NUMBER} targets ${base_repo}, not ${REPOSITORY}; skipping." + exit 0 + fi + + if [[ ! "${pr_author}" =~ ^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?$ ]]; then + echo "::error::Unexpected pull request author login: ${pr_author}" + exit 1 + fi + + files="$(gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files?per_page=100" --jq '.[].filename')" + if ! grep -q '^advisories/' <<<"${files}"; then + echo "Pull request ${PR_NUMBER} does not modify advisories/; skipping." + exit 0 + fi + + branch_name="${pr_author}/advisory-improvement-${PR_NUMBER}" + if [[ ! "${branch_name}" =~ ^[A-Za-z0-9][A-Za-z0-9-]*/advisory-improvement-[0-9]+$ ]]; then + echo "::error::Unexpected staging branch name: ${branch_name}" + exit 1 + fi + + if gh api "repos/${REPOSITORY}/git/ref/heads/${branch_name}" --silent >/dev/null 2>&1; then + echo "Staging branch ${branch_name} already exists." + else + main_sha="$(gh api "repos/${REPOSITORY}/git/ref/heads/main" --jq '.object.sha')" + if gh api -X POST "repos/${REPOSITORY}/git/refs" \ + -f ref="refs/heads/${branch_name}" \ + -f sha="${main_sha}" \ + --silent; then + echo "Created staging branch ${branch_name} from main." + elif gh api "repos/${REPOSITORY}/git/ref/heads/${branch_name}" --silent >/dev/null 2>&1; then + echo "Staging branch ${branch_name} was created by another run." + else + echo "::error::Failed to create staging branch ${branch_name}." + exit 1 + fi + fi + + gh api -X PATCH "repos/${REPOSITORY}/pulls/${PR_NUMBER}" \ + -f base="${branch_name}" \ + --silent + echo "Retargeted pull request ${PR_NUMBER} to ${branch_name}." diff --git a/.github/workflows/delete_staging_and_head_branches.yaml b/.github/workflows/delete_staging_and_head_branches.yaml index 83ae08f812d6..4d952893313b 100644 --- a/.github/workflows/delete_staging_and_head_branches.yaml +++ b/.github/workflows/delete_staging_and_head_branches.yaml @@ -1,28 +1,18 @@ name: Delete PR staging and head branches on: - pull_request_target: + pull_request: branches: ["*/advisory-improvement-*"] types: [closed] paths: - "advisories/**" - workflow_dispatch: permissions: - contents: write # Required to delete branches + contents: read jobs: - delete-staging-and-head-branches: - if: ${{ !github.event.pull_request.head.repo.fork }} + signal: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 - - name: Delete staging and head branches - env: - STAGING_BRANCH: ${{ github.event.pull_request.base.ref }} - HEAD_BRANCH: ${{ github.event.pull_request.head.ref }} - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - set -xeo pipefail - git push origin --delete --force $STAGING_BRANCH - git push origin --delete --force $HEAD_BRANCH + - name: Record pull request signal + run: echo "Delete staging and head branches signal received." diff --git a/.github/workflows/delete_staging_and_head_branches_writer.yaml b/.github/workflows/delete_staging_and_head_branches_writer.yaml new file mode 100644 index 000000000000..40fb9713bcda --- /dev/null +++ b/.github/workflows/delete_staging_and_head_branches_writer.yaml @@ -0,0 +1,94 @@ +name: Delete PR staging and head branches writer + +on: + workflow_run: + workflows: ["Delete PR staging and head branches"] + types: [completed] + workflow_dispatch: + inputs: + pr_number: + description: Pull request number to process + required: true + type: number + +permissions: + contents: write + pull-requests: read + +jobs: + delete-staging-and-head-branches: + if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request') }} + runs-on: ubuntu-latest + steps: + - name: Delete staging and head branches + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + REPOSITORY: ${{ github.repository }} + WORKFLOW_RUN_PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }} + DISPATCH_PR_NUMBER: ${{ inputs.pr_number }} + run: | + set -euo pipefail + + is_expected_branch() { + [[ "$1" =~ ^[A-Za-z0-9][A-Za-z0-9-]*/advisory-improvement-[A-Za-z0-9._-]+$ ]] + } + + delete_branch() { + local branch="$1" + if gh api -X DELETE "repos/${REPOSITORY}/git/refs/heads/${branch}" --silent; then + echo "Deleted branch ${branch}." + elif gh api "repos/${REPOSITORY}/git/ref/heads/${branch}" --silent >/dev/null 2>&1; then + echo "::error::Failed to delete existing branch ${branch}." + exit 1 + else + echo "Branch ${branch} is already absent." + fi + } + + if [[ "${GITHUB_EVENT_NAME}" == "workflow_run" ]]; then + PR_NUMBER="${WORKFLOW_RUN_PR_NUMBER}" + else + PR_NUMBER="${DISPATCH_PR_NUMBER}" + fi + + if [[ -z "${PR_NUMBER}" || "${PR_NUMBER}" == "null" ]]; then + echo "No pull request number was provided; skipping." + exit 0 + fi + + pr_json="$(gh api "repos/${REPOSITORY}/pulls/${PR_NUMBER}")" + state="$(jq -r '.state' <<<"${pr_json}")" + base_ref="$(jq -r '.base.ref' <<<"${pr_json}")" + head_ref="$(jq -r '.head.ref' <<<"${pr_json}")" + head_repo="$(jq -r '.head.repo.full_name // empty' <<<"${pr_json}")" + + if [[ "${state}" != "closed" ]]; then + echo "Pull request ${PR_NUMBER} is ${state}, not closed; skipping." + exit 0 + fi + + if [[ "${head_repo}" != "${REPOSITORY}" ]]; then + echo "Pull request ${PR_NUMBER} head repo is ${head_repo}, not ${REPOSITORY}; skipping." + exit 0 + fi + + if ! is_expected_branch "${base_ref}"; then + echo "Pull request ${PR_NUMBER} base branch ${base_ref} is not an advisory improvement branch; skipping." + exit 0 + fi + + if ! is_expected_branch "${head_ref}"; then + echo "Pull request ${PR_NUMBER} head branch ${head_ref} is not an advisory improvement branch; skipping." + exit 0 + fi + + files="$(gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files?per_page=100" --jq '.[].filename')" + if ! grep -q '^advisories/' <<<"${files}"; then + echo "Pull request ${PR_NUMBER} does not modify advisories/; skipping." + exit 0 + fi + + delete_branch "${base_ref}" + if [[ "${head_ref}" != "${base_ref}" ]]; then + delete_branch "${head_ref}" + fi From 9d460dcc59112fc29800e269c6dcb882c1ebf907 Mon Sep 17 00:00:00 2001 From: Michael Recachinas Date: Tue, 11 Aug 2026 11:11:33 -0400 Subject: [PATCH 2/3] Fix pull_request workflow_run migration gaps Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/create_staging_branch.yaml | 13 ++- .../create_staging_branch_writer.yaml | 79 ++++++++++++++++++- ...lete_staging_and_head_branches_writer.yaml | 33 +++++--- 3 files changed, 110 insertions(+), 15 deletions(-) diff --git a/.github/workflows/create_staging_branch.yaml b/.github/workflows/create_staging_branch.yaml index 8c92e312bf42..24ccd31aa2dc 100644 --- a/.github/workflows/create_staging_branch.yaml +++ b/.github/workflows/create_staging_branch.yaml @@ -15,4 +15,15 @@ jobs: runs-on: ubuntu-latest steps: - name: Record pull request signal - run: echo "Create staging branch signal received." + env: + PR_NUMBER: ${{ github.event.pull_request.number }} + run: | + mkdir -p workflow-signal + printf '%s\n' "${PR_NUMBER}" > workflow-signal/pr_number.txt + - name: Upload pull request signal + uses: actions/upload-artifact@v4 + with: + name: create-staging-pr-number + path: workflow-signal/pr_number.txt + retention-days: 1 + if-no-files-found: error diff --git a/.github/workflows/create_staging_branch_writer.yaml b/.github/workflows/create_staging_branch_writer.yaml index fff5573bf9a6..e0a9d24ba1d1 100644 --- a/.github/workflows/create_staging_branch_writer.yaml +++ b/.github/workflows/create_staging_branch_writer.yaml @@ -12,6 +12,7 @@ on: type: number permissions: + actions: read contents: write pull-requests: write @@ -24,20 +25,90 @@ jobs: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} REPOSITORY: ${{ github.repository }} + WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }} + WORKFLOW_RUN_HEAD_SHA: ${{ github.event.workflow_run.head_sha }} + WORKFLOW_RUN_HEAD_REPOSITORY: ${{ github.event.workflow_run.head_repository.full_name }} WORKFLOW_RUN_PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }} DISPATCH_PR_NUMBER: ${{ inputs.pr_number }} run: | set -euo pipefail + is_pr_number() { + [[ "$1" =~ ^[0-9]+$ ]] + } + + recover_pr_number_from_artifact() { + local run_id="$1" + local artifact_id artifact_dir pr_number + + is_pr_number "${run_id}" || return 1 + + if ! artifact_id="$(gh api "repos/${REPOSITORY}/actions/runs/${run_id}/artifacts" \ + --jq '.artifacts[] | select(.name == "create-staging-pr-number" and .expired == false) | .id' | head -n 1)"; then + return 1 + fi + [[ -n "${artifact_id}" ]] || return 1 + + artifact_dir="workflow-run-artifacts/create-staging-${run_id}" + rm -rf "${artifact_dir}" + mkdir -p "${artifact_dir}" + if ! gh api "repos/${REPOSITORY}/actions/artifacts/${artifact_id}/zip" > "${artifact_dir}/artifact.zip"; then + rm -rf "${artifact_dir}" + return 1 + fi + if ! pr_number="$(unzip -p "${artifact_dir}/artifact.zip" pr_number.txt 2>/dev/null | tr -d '[:space:]')"; then + rm -rf "${artifact_dir}" + return 1 + fi + rm -rf "${artifact_dir}" + + is_pr_number "${pr_number}" || return 1 + printf '%s\n' "${pr_number}" + } + + recover_pr_number_from_head_sha() { + local head_sha="$1" + local head_repository="$2" + local pulls_json pr_number + + [[ "${head_sha}" =~ ^[0-9a-fA-F]{40}$ ]] || return 1 + + [[ "${head_repository}" != "null" ]] || head_repository="" + + if ! pulls_json="$(gh api -H "Accept: application/vnd.github+json" "repos/${REPOSITORY}/commits/${head_sha}/pulls")"; then + return 1 + fi + pr_number="$(jq -r --arg head_sha "${head_sha}" --arg head_repository "${head_repository}" ' + .[] + | select(.state == "open") + | select(.base.ref == "main") + | select(.head.sha == $head_sha) + | select($head_repository == "" or .head.repo.full_name == $head_repository) + | .number + ' <<<"${pulls_json}" | head -n 1)" + + is_pr_number "${pr_number}" || return 1 + printf '%s\n' "${pr_number}" + } + if [[ "${GITHUB_EVENT_NAME}" == "workflow_run" ]]; then - PR_NUMBER="${WORKFLOW_RUN_PR_NUMBER}" + if is_pr_number "${WORKFLOW_RUN_PR_NUMBER:-}"; then + PR_NUMBER="${WORKFLOW_RUN_PR_NUMBER}" + elif PR_NUMBER="$(recover_pr_number_from_artifact "${WORKFLOW_RUN_ID:-}")"; then + echo "Recovered pull request number ${PR_NUMBER} from signal artifact." + elif PR_NUMBER="$(recover_pr_number_from_head_sha "${WORKFLOW_RUN_HEAD_SHA:-}" "${WORKFLOW_RUN_HEAD_REPOSITORY:-}")"; then + echo "Recovered pull request number ${PR_NUMBER} from workflow_run head SHA." + else + echo "No pull request number could be recovered; skipping." + exit 0 + fi else PR_NUMBER="${DISPATCH_PR_NUMBER}" fi - if [[ -z "${PR_NUMBER}" || "${PR_NUMBER}" == "null" ]]; then - echo "No pull request number was provided; skipping." - exit 0 + if ! is_pr_number "${PR_NUMBER}"; then + echo "::error::Unexpected pull request number: ${PR_NUMBER}" + exit 1 fi pr_json="$(gh api "repos/${REPOSITORY}/pulls/${PR_NUMBER}")" diff --git a/.github/workflows/delete_staging_and_head_branches_writer.yaml b/.github/workflows/delete_staging_and_head_branches_writer.yaml index 40fb9713bcda..108ec7268ce6 100644 --- a/.github/workflows/delete_staging_and_head_branches_writer.yaml +++ b/.github/workflows/delete_staging_and_head_branches_writer.yaml @@ -29,10 +29,21 @@ jobs: run: | set -euo pipefail - is_expected_branch() { + is_staging_branch() { [[ "$1" =~ ^[A-Za-z0-9][A-Za-z0-9-]*/advisory-improvement-[A-Za-z0-9._-]+$ ]] } + is_safe_branch() { + local branch="$1" + [[ -n "${branch}" ]] || return 1 + [[ "${branch}" != "main" ]] || return 1 + [[ "${branch}" =~ ^[A-Za-z0-9._/-]+$ ]] || return 1 + [[ "${branch}" != /* ]] || return 1 + [[ "${branch}" != */ ]] || return 1 + [[ "${branch}" != *..* ]] || return 1 + [[ "${branch}" != *//* ]] || return 1 + } + delete_branch() { local branch="$1" if gh api -X DELETE "repos/${REPOSITORY}/git/refs/heads/${branch}" --silent; then @@ -59,7 +70,7 @@ jobs: pr_json="$(gh api "repos/${REPOSITORY}/pulls/${PR_NUMBER}")" state="$(jq -r '.state' <<<"${pr_json}")" base_ref="$(jq -r '.base.ref' <<<"${pr_json}")" - head_ref="$(jq -r '.head.ref' <<<"${pr_json}")" + head_ref="$(jq -r '.head.ref // empty' <<<"${pr_json}")" head_repo="$(jq -r '.head.repo.full_name // empty' <<<"${pr_json}")" if [[ "${state}" != "closed" ]]; then @@ -72,16 +83,11 @@ jobs: exit 0 fi - if ! is_expected_branch "${base_ref}"; then + if ! is_staging_branch "${base_ref}"; then echo "Pull request ${PR_NUMBER} base branch ${base_ref} is not an advisory improvement branch; skipping." exit 0 fi - if ! is_expected_branch "${head_ref}"; then - echo "Pull request ${PR_NUMBER} head branch ${head_ref} is not an advisory improvement branch; skipping." - exit 0 - fi - files="$(gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files?per_page=100" --jq '.[].filename')" if ! grep -q '^advisories/' <<<"${files}"; then echo "Pull request ${PR_NUMBER} does not modify advisories/; skipping." @@ -89,6 +95,13 @@ jobs: fi delete_branch "${base_ref}" - if [[ "${head_ref}" != "${base_ref}" ]]; then - delete_branch "${head_ref}" + if [[ "${head_ref}" == "${base_ref}" ]]; then + exit 0 fi + + if ! is_safe_branch "${head_ref}"; then + echo "Head branch ${head_ref} is not safe to delete; leaving it in place." + exit 0 + fi + + delete_branch "${head_ref}" From b9a13bb44de3683b1269938810a43ca1de0f9e35 Mon Sep 17 00:00:00 2001 From: Michael Recachinas Date: Wed, 12 Aug 2026 10:12:43 -0400 Subject: [PATCH 3/3] Harden staging workflow reconciliation Add trusted scheduled reconciliation for conflicted pull requests, bind workflow-run writes to PR head identity, and safely encode validated Git refs during cleanup. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 512eb347-ec89-4250-8bf1-87048974b01d --- .../create_staging_branch_writer.yaml | 224 +++++++++++------- ...lete_staging_and_head_branches_writer.yaml | 170 ++++++++----- 2 files changed, 256 insertions(+), 138 deletions(-) diff --git a/.github/workflows/create_staging_branch_writer.yaml b/.github/workflows/create_staging_branch_writer.yaml index e0a9d24ba1d1..d6dcb5b4f49c 100644 --- a/.github/workflows/create_staging_branch_writer.yaml +++ b/.github/workflows/create_staging_branch_writer.yaml @@ -4,6 +4,8 @@ on: workflow_run: workflows: ["Create PR staging branch"] types: [completed] + schedule: + - cron: "*/10 * * * *" workflow_dispatch: inputs: pr_number: @@ -18,7 +20,7 @@ permissions: jobs: ensure-base-is-staging: - if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request') }} + if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request') }} runs-on: ubuntu-latest steps: - name: Ensure base is staging @@ -26,6 +28,7 @@ jobs: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} REPOSITORY: ${{ github.repository }} WORKFLOW_RUN_ID: ${{ github.event.workflow_run.id }} + WORKFLOW_RUN_HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} WORKFLOW_RUN_HEAD_SHA: ${{ github.event.workflow_run.head_sha }} WORKFLOW_RUN_HEAD_REPOSITORY: ${{ github.event.workflow_run.head_repository.full_name }} WORKFLOW_RUN_PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }} @@ -39,15 +42,22 @@ jobs: recover_pr_number_from_artifact() { local run_id="$1" - local artifact_id artifact_dir pr_number + local artifact_count artifact_dir artifact_id artifact_json artifact_size entries pr_number is_pr_number "${run_id}" || return 1 - if ! artifact_id="$(gh api "repos/${REPOSITORY}/actions/runs/${run_id}/artifacts" \ - --jq '.artifacts[] | select(.name == "create-staging-pr-number" and .expired == false) | .id' | head -n 1)"; then + if ! artifact_json="$(gh api "repos/${REPOSITORY}/actions/runs/${run_id}/artifacts" \ + --jq '[.artifacts[] | select(.name == "create-staging-pr-number" and .expired == false)]')"; then return 1 fi - [[ -n "${artifact_id}" ]] || return 1 + artifact_count="$(jq -r 'length' <<<"${artifact_json}")" + [[ "${artifact_count}" == "1" ]] || return 1 + + artifact_id="$(jq -r '.[0].id' <<<"${artifact_json}")" + artifact_size="$(jq -r '.[0].size_in_bytes' <<<"${artifact_json}")" + is_pr_number "${artifact_id}" || return 1 + is_pr_number "${artifact_size}" || return 1 + (( artifact_size <= 4096 )) || return 1 artifact_dir="workflow-run-artifacts/create-staging-${run_id}" rm -rf "${artifact_dir}" @@ -56,7 +66,15 @@ jobs: rm -rf "${artifact_dir}" return 1 fi - if ! pr_number="$(unzip -p "${artifact_dir}/artifact.zip" pr_number.txt 2>/dev/null | tr -d '[:space:]')"; then + if ! entries="$(unzip -Z1 "${artifact_dir}/artifact.zip" 2>/dev/null)"; then + rm -rf "${artifact_dir}" + return 1 + fi + if [[ "${entries}" != "pr_number.txt" ]]; then + rm -rf "${artifact_dir}" + return 1 + fi + if ! pr_number="$(unzip -p "${artifact_dir}/artifact.zip" pr_number.txt 2>/dev/null | head -c 32)"; then rm -rf "${artifact_dir}" return 1 fi @@ -69,104 +87,142 @@ jobs: recover_pr_number_from_head_sha() { local head_sha="$1" local head_repository="$2" - local pulls_json pr_number + local matches pulls_json [[ "${head_sha}" =~ ^[0-9a-fA-F]{40}$ ]] || return 1 - - [[ "${head_repository}" != "null" ]] || head_repository="" + [[ -n "${head_repository}" && "${head_repository}" != "null" ]] || return 1 if ! pulls_json="$(gh api -H "Accept: application/vnd.github+json" "repos/${REPOSITORY}/commits/${head_sha}/pulls")"; then return 1 fi - pr_number="$(jq -r --arg head_sha "${head_sha}" --arg head_repository "${head_repository}" ' - .[] - | select(.state == "open") - | select(.base.ref == "main") - | select(.head.sha == $head_sha) - | select($head_repository == "" or .head.repo.full_name == $head_repository) - | .number - ' <<<"${pulls_json}" | head -n 1)" + matches="$(jq -r --arg head_sha "${head_sha}" --arg head_repository "${head_repository}" ' + [ + .[] + | select(.state == "open") + | select(.base.ref == "main") + | select(.head.sha == $head_sha) + | select(.head.repo.full_name == $head_repository) + | .number + ] + ' <<<"${pulls_json}")" + + [[ "$(jq -r 'length' <<<"${matches}")" == "1" ]] || return 1 + jq -r '.[0]' <<<"${matches}" + } - is_pr_number "${pr_number}" || return 1 - printf '%s\n' "${pr_number}" + encode_ref() { + jq -rn --arg value "$1" '$value | @uri' } - if [[ "${GITHUB_EVENT_NAME}" == "workflow_run" ]]; then - if is_pr_number "${WORKFLOW_RUN_PR_NUMBER:-}"; then - PR_NUMBER="${WORKFLOW_RUN_PR_NUMBER}" - elif PR_NUMBER="$(recover_pr_number_from_artifact "${WORKFLOW_RUN_ID:-}")"; then - echo "Recovered pull request number ${PR_NUMBER} from signal artifact." - elif PR_NUMBER="$(recover_pr_number_from_head_sha "${WORKFLOW_RUN_HEAD_SHA:-}" "${WORKFLOW_RUN_HEAD_REPOSITORY:-}")"; then - echo "Recovered pull request number ${PR_NUMBER} from workflow_run head SHA." - else - echo "No pull request number could be recovered; skipping." - exit 0 + process_pr() { + local advisory_file_pages base_ref base_repo branch_name encoded_branch head_ref head_repo head_sha + local main_sha pr_author pr_json pr_number="$1" state + + if ! is_pr_number "${pr_number}"; then + echo "::error::Unexpected pull request number: ${pr_number}" + return 1 fi - else - PR_NUMBER="${DISPATCH_PR_NUMBER}" - fi - if ! is_pr_number "${PR_NUMBER}"; then - echo "::error::Unexpected pull request number: ${PR_NUMBER}" - exit 1 - fi + pr_json="$(gh api "repos/${REPOSITORY}/pulls/${pr_number}")" + state="$(jq -r '.state' <<<"${pr_json}")" + base_ref="$(jq -r '.base.ref' <<<"${pr_json}")" + base_repo="$(jq -r '.base.repo.full_name' <<<"${pr_json}")" + pr_author="$(jq -r '.user.login' <<<"${pr_json}")" + head_sha="$(jq -r '.head.sha // empty' <<<"${pr_json}")" + head_repo="$(jq -r '.head.repo.full_name // empty' <<<"${pr_json}")" + head_ref="$(jq -r '.head.ref // empty' <<<"${pr_json}")" + + if [[ "${GITHUB_EVENT_NAME}" == "workflow_run" ]]; then + if [[ ! "${WORKFLOW_RUN_HEAD_SHA:-}" =~ ^[0-9a-fA-F]{40}$ || + -z "${WORKFLOW_RUN_HEAD_REPOSITORY:-}" || + "${WORKFLOW_RUN_HEAD_REPOSITORY}" == "null" || + -z "${WORKFLOW_RUN_HEAD_BRANCH:-}" || + "${WORKFLOW_RUN_HEAD_BRANCH}" == "null" ]]; then + echo "::error::The workflow run is missing trusted head identity metadata." + return 1 + fi + if [[ "${head_sha}" != "${WORKFLOW_RUN_HEAD_SHA}" || + "${head_repo}" != "${WORKFLOW_RUN_HEAD_REPOSITORY}" || + "${head_ref}" != "${WORKFLOW_RUN_HEAD_BRANCH}" ]]; then + echo "::error::Pull request ${pr_number} does not match the triggering workflow run." + return 1 + fi + fi - pr_json="$(gh api "repos/${REPOSITORY}/pulls/${PR_NUMBER}")" - state="$(jq -r '.state' <<<"${pr_json}")" - base_ref="$(jq -r '.base.ref' <<<"${pr_json}")" - base_repo="$(jq -r '.base.repo.full_name' <<<"${pr_json}")" - pr_author="$(jq -r '.user.login' <<<"${pr_json}")" + if [[ "${state}" != "open" ]]; then + echo "Pull request ${pr_number} is ${state}; skipping." + return 0 + fi - if [[ "${state}" != "open" ]]; then - echo "Pull request ${PR_NUMBER} is ${state}; skipping." - exit 0 - fi + if [[ "${base_ref}" != "main" ]]; then + echo "Pull request ${pr_number} base is ${base_ref}, not main; skipping." + return 0 + fi - if [[ "${base_ref}" != "main" ]]; then - echo "Pull request ${PR_NUMBER} base is ${base_ref}, not main; skipping." - exit 0 - fi + if [[ "${base_repo}" != "${REPOSITORY}" ]]; then + echo "Pull request ${pr_number} targets ${base_repo}, not ${REPOSITORY}; skipping." + return 0 + fi - if [[ "${base_repo}" != "${REPOSITORY}" ]]; then - echo "Pull request ${PR_NUMBER} targets ${base_repo}, not ${REPOSITORY}; skipping." - exit 0 - fi + advisory_file_pages="$(gh api --paginate "repos/${REPOSITORY}/pulls/${pr_number}/files?per_page=100" \ + --jq 'any(.[]; .filename | startswith("advisories/"))')" + if ! grep -qx 'true' <<<"${advisory_file_pages}"; then + echo "Pull request ${pr_number} does not modify advisories/; skipping." + return 0 + fi - if [[ ! "${pr_author}" =~ ^[A-Za-z0-9]([A-Za-z0-9-]*[A-Za-z0-9])?$ ]]; then - echo "::error::Unexpected pull request author login: ${pr_author}" - exit 1 - fi + branch_name="${pr_author}/advisory-improvement-${pr_number}" + if ! git check-ref-format "refs/heads/${branch_name}" >/dev/null; then + echo "::error::Unexpected staging branch name: ${branch_name}" + return 1 + fi + encoded_branch="$(encode_ref "${branch_name}")" - files="$(gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files?per_page=100" --jq '.[].filename')" - if ! grep -q '^advisories/' <<<"${files}"; then - echo "Pull request ${PR_NUMBER} does not modify advisories/; skipping." - exit 0 - fi + if gh api "repos/${REPOSITORY}/git/ref/heads/${encoded_branch}" --silent >/dev/null 2>&1; then + echo "Staging branch ${branch_name} already exists." + else + main_sha="$(gh api "repos/${REPOSITORY}/git/ref/heads/main" --jq '.object.sha')" + if gh api -X POST "repos/${REPOSITORY}/git/refs" \ + -f ref="refs/heads/${branch_name}" \ + -f sha="${main_sha}" \ + --silent; then + echo "Created staging branch ${branch_name} from main." + elif gh api "repos/${REPOSITORY}/git/ref/heads/${encoded_branch}" --silent >/dev/null 2>&1; then + echo "Staging branch ${branch_name} was created by another run." + else + echo "::error::Failed to create staging branch ${branch_name}." + return 1 + fi + fi - branch_name="${pr_author}/advisory-improvement-${PR_NUMBER}" - if [[ ! "${branch_name}" =~ ^[A-Za-z0-9][A-Za-z0-9-]*/advisory-improvement-[0-9]+$ ]]; then - echo "::error::Unexpected staging branch name: ${branch_name}" - exit 1 - fi + gh api -X PATCH "repos/${REPOSITORY}/pulls/${pr_number}" \ + -f base="${branch_name}" \ + --silent + echo "Retargeted pull request ${pr_number} to ${branch_name}." + } - if gh api "repos/${REPOSITORY}/git/ref/heads/${branch_name}" --silent >/dev/null 2>&1; then - echo "Staging branch ${branch_name} already exists." - else - main_sha="$(gh api "repos/${REPOSITORY}/git/ref/heads/main" --jq '.object.sha')" - if gh api -X POST "repos/${REPOSITORY}/git/refs" \ - -f ref="refs/heads/${branch_name}" \ - -f sha="${main_sha}" \ - --silent; then - echo "Created staging branch ${branch_name} from main." - elif gh api "repos/${REPOSITORY}/git/ref/heads/${branch_name}" --silent >/dev/null 2>&1; then - echo "Staging branch ${branch_name} was created by another run." + if [[ "${GITHUB_EVENT_NAME}" == "workflow_run" ]]; then + if is_pr_number "${WORKFLOW_RUN_PR_NUMBER:-}"; then + PR_NUMBERS="${WORKFLOW_RUN_PR_NUMBER}" + elif PR_NUMBERS="$(recover_pr_number_from_artifact "${WORKFLOW_RUN_ID:-}")"; then + echo "Recovered pull request number ${PR_NUMBERS} from signal artifact." + elif PR_NUMBERS="$(recover_pr_number_from_head_sha "${WORKFLOW_RUN_HEAD_SHA:-}" "${WORKFLOW_RUN_HEAD_REPOSITORY:-}")"; then + echo "Recovered pull request number ${PR_NUMBERS} from workflow_run head SHA." else - echo "::error::Failed to create staging branch ${branch_name}." - exit 1 + echo "No pull request number could be recovered; skipping." + exit 0 + fi + elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then + PR_NUMBERS="${DISPATCH_PR_NUMBER}" + else + PR_NUMBERS="$(gh api --paginate "repos/${REPOSITORY}/pulls?state=open&base=main&per_page=100" --jq '.[].number')" + if [[ -z "${PR_NUMBERS}" ]]; then + echo "No open pull requests targeting main need reconciliation." + exit 0 fi fi - gh api -X PATCH "repos/${REPOSITORY}/pulls/${PR_NUMBER}" \ - -f base="${branch_name}" \ - --silent - echo "Retargeted pull request ${PR_NUMBER} to ${branch_name}." + while IFS= read -r PR_NUMBER; do + [[ -n "${PR_NUMBER}" ]] || continue + process_pr "${PR_NUMBER}" + done <<<"${PR_NUMBERS}" diff --git a/.github/workflows/delete_staging_and_head_branches_writer.yaml b/.github/workflows/delete_staging_and_head_branches_writer.yaml index 108ec7268ce6..18e4bba7af5b 100644 --- a/.github/workflows/delete_staging_and_head_branches_writer.yaml +++ b/.github/workflows/delete_staging_and_head_branches_writer.yaml @@ -4,6 +4,8 @@ on: workflow_run: workflows: ["Delete PR staging and head branches"] types: [completed] + schedule: + - cron: "5-55/10 * * * *" workflow_dispatch: inputs: pr_number: @@ -17,7 +19,7 @@ permissions: jobs: delete-staging-and-head-branches: - if: ${{ github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request') }} + if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request') }} runs-on: ubuntu-latest steps: - name: Delete staging and head branches @@ -29,79 +31,139 @@ jobs: run: | set -euo pipefail - is_staging_branch() { - [[ "$1" =~ ^[A-Za-z0-9][A-Za-z0-9-]*/advisory-improvement-[A-Za-z0-9._-]+$ ]] + is_pr_number() { + [[ "$1" =~ ^[0-9]+$ ]] } - is_safe_branch() { + is_staging_branch_for_pr() { local branch="$1" - [[ -n "${branch}" ]] || return 1 - [[ "${branch}" != "main" ]] || return 1 - [[ "${branch}" =~ ^[A-Za-z0-9._/-]+$ ]] || return 1 - [[ "${branch}" != /* ]] || return 1 - [[ "${branch}" != */ ]] || return 1 - [[ "${branch}" != *..* ]] || return 1 - [[ "${branch}" != *//* ]] || return 1 + local pr_number="$2" + local prefix suffix + + is_pr_number "${pr_number}" || return 1 + git check-ref-format "refs/heads/${branch}" >/dev/null || return 1 + + suffix="/advisory-improvement-${pr_number}" + [[ "${branch}" == *"${suffix}" ]] || return 1 + prefix="${branch%"${suffix}"}" + [[ -n "${prefix}" && "${prefix}" != */* ]] + } + + is_deletable_branch() { + local branch="$1" + [[ -n "${branch}" && "${branch}" != "main" ]] || return 1 + git check-ref-format "refs/heads/${branch}" >/dev/null + } + + encode_ref() { + jq -rn --arg value "$1" '$value | @uri' } delete_branch() { local branch="$1" - if gh api -X DELETE "repos/${REPOSITORY}/git/refs/heads/${branch}" --silent; then + local encoded_branch + + encoded_branch="$(encode_ref "${branch}")" + if gh api -X DELETE "repos/${REPOSITORY}/git/refs/heads/${encoded_branch}" --silent; then echo "Deleted branch ${branch}." - elif gh api "repos/${REPOSITORY}/git/ref/heads/${branch}" --silent >/dev/null 2>&1; then + elif gh api "repos/${REPOSITORY}/git/ref/heads/${encoded_branch}" --silent >/dev/null 2>&1; then echo "::error::Failed to delete existing branch ${branch}." - exit 1 + return 1 else echo "Branch ${branch} is already absent." fi } - if [[ "${GITHUB_EVENT_NAME}" == "workflow_run" ]]; then - PR_NUMBER="${WORKFLOW_RUN_PR_NUMBER}" - else - PR_NUMBER="${DISPATCH_PR_NUMBER}" - fi + process_pr() { + local advisory_file_pages base_ref base_repo expected_staging_branch head_ref head_repo + local pr_json pr_number="$1" state + expected_staging_branch="${2:-}" - if [[ -z "${PR_NUMBER}" || "${PR_NUMBER}" == "null" ]]; then - echo "No pull request number was provided; skipping." - exit 0 - fi + if ! is_pr_number "${pr_number}"; then + echo "::error::Unexpected pull request number: ${pr_number}" + return 1 + fi - pr_json="$(gh api "repos/${REPOSITORY}/pulls/${PR_NUMBER}")" - state="$(jq -r '.state' <<<"${pr_json}")" - base_ref="$(jq -r '.base.ref' <<<"${pr_json}")" - head_ref="$(jq -r '.head.ref // empty' <<<"${pr_json}")" - head_repo="$(jq -r '.head.repo.full_name // empty' <<<"${pr_json}")" + pr_json="$(gh api "repos/${REPOSITORY}/pulls/${pr_number}")" + state="$(jq -r '.state' <<<"${pr_json}")" + base_ref="$(jq -r '.base.ref' <<<"${pr_json}")" + base_repo="$(jq -r '.base.repo.full_name' <<<"${pr_json}")" + head_ref="$(jq -r '.head.ref // empty' <<<"${pr_json}")" + head_repo="$(jq -r '.head.repo.full_name // empty' <<<"${pr_json}")" - if [[ "${state}" != "closed" ]]; then - echo "Pull request ${PR_NUMBER} is ${state}, not closed; skipping." - exit 0 - fi + if [[ "${state}" != "closed" ]]; then + echo "Pull request ${pr_number} is ${state}, not closed; skipping." + return 0 + fi - if [[ "${head_repo}" != "${REPOSITORY}" ]]; then - echo "Pull request ${PR_NUMBER} head repo is ${head_repo}, not ${REPOSITORY}; skipping." - exit 0 - fi + if [[ "${base_repo}" != "${REPOSITORY}" ]]; then + echo "Pull request ${pr_number} targets ${base_repo}, not ${REPOSITORY}; skipping." + return 0 + fi - if ! is_staging_branch "${base_ref}"; then - echo "Pull request ${PR_NUMBER} base branch ${base_ref} is not an advisory improvement branch; skipping." - exit 0 - fi + if [[ -n "${expected_staging_branch}" && "${base_ref}" != "${expected_staging_branch}" ]]; then + echo "Pull request ${pr_number} no longer targets ${expected_staging_branch}; skipping." + return 0 + fi - files="$(gh api --paginate "repos/${REPOSITORY}/pulls/${PR_NUMBER}/files?per_page=100" --jq '.[].filename')" - if ! grep -q '^advisories/' <<<"${files}"; then - echo "Pull request ${PR_NUMBER} does not modify advisories/; skipping." - exit 0 - fi + if ! is_staging_branch_for_pr "${base_ref}" "${pr_number}"; then + echo "Pull request ${pr_number} base branch ${base_ref} is not its advisory improvement branch; skipping." + return 0 + fi - delete_branch "${base_ref}" - if [[ "${head_ref}" == "${base_ref}" ]]; then - exit 0 - fi + if [[ "${head_repo}" != "${REPOSITORY}" ]]; then + echo "Pull request ${pr_number} head repo is ${head_repo}, not ${REPOSITORY}; skipping." + return 0 + fi - if ! is_safe_branch "${head_ref}"; then - echo "Head branch ${head_ref} is not safe to delete; leaving it in place." - exit 0 - fi + advisory_file_pages="$(gh api --paginate "repos/${REPOSITORY}/pulls/${pr_number}/files?per_page=100" \ + --jq 'any(.[]; .filename | startswith("advisories/"))')" + if ! grep -qx 'true' <<<"${advisory_file_pages}"; then + echo "Pull request ${pr_number} does not modify advisories/; skipping." + return 0 + fi + + delete_branch "${base_ref}" + if [[ "${head_ref}" == "${base_ref}" ]]; then + return 0 + fi + + if ! is_deletable_branch "${head_ref}"; then + echo "Head branch ${head_ref} is not a valid deletable Git branch; leaving it in place." + return 0 + fi + + delete_branch "${head_ref}" + } + + collect_reconciliation_targets() { + local branch branches - delete_branch "${head_ref}" + branches="$(gh api --paginate "repos/${REPOSITORY}/branches?per_page=100" --jq '.[].name')" + while IFS= read -r branch; do + if [[ "${branch}" =~ ^[^/]+/advisory-improvement-([0-9]+)$ ]] && + git check-ref-format "refs/heads/${branch}" >/dev/null; then + printf '%s\t%s\n' "${BASH_REMATCH[1]}" "${branch}" + fi + done <<<"${branches}" + } + + if [[ "${GITHUB_EVENT_NAME}" == "workflow_run" ]]; then + PR_NUMBER="${WORKFLOW_RUN_PR_NUMBER}" + if ! is_pr_number "${PR_NUMBER:-}"; then + echo "No pull request number was provided; skipping." + exit 0 + fi + process_pr "${PR_NUMBER}" + elif [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then + process_pr "${DISPATCH_PR_NUMBER}" + else + TARGETS="$(collect_reconciliation_targets)" + if [[ -z "${TARGETS}" ]]; then + echo "No staging branches need reconciliation." + exit 0 + fi + while IFS=$'\t' read -r PR_NUMBER STAGING_BRANCH; do + process_pr "${PR_NUMBER}" "${STAGING_BRANCH}" + done <<<"${TARGETS}" + fi