Repository navigation
fix(ci): reject PR runs after retargeting or target force-push - #3442
Open
ShryukGrandhi wants to merge 1 commit into
Open
ShryukGrandhi wants to merge 1 commit into
ShryukGrandhi wants to merge 1 commit into
Conversation
Bind the PR plan to its target ref and require the live target branch to still contain the tested merge base. Normal target advancement is still accepted. Signed-off-by: ShryukGrandhi <85529990+ShryukGrandhi@users.noreply.github.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #3442 +/- ##
============================================
+ Coverage 57.27% 58.20% +0.93%
+ Complexity 6577 3086 -3491
============================================
Files 776 779 +3
Lines 68881 69335 +454
Branches 9431 9550 +119
============================================
+ Hits 39449 40356 +907
+ Misses 25804 25300 -504
- Partials 3628 3679 +51
*This pull request uses carry forward flags. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
bitflicker64
approved these changes
Oct 31, 2026
bitflicker64
left a comment
bitflicker64
left a comment
Contributor
There was a problem hiding this comment.
Blocking: no. Score: 9/10. Summary: require_current_pr() now binds the plan to base.ref and rejects a target whose history no longer contains the tested base, while target advancement still passes; test_ci_policy.py passes 27/27 at this head.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose of the PR
require_current_pr()checked the PR head and the target repository, but not the target branch name or whether the tested base was still part of the target's history. A run planned againstmasterwas still accepted after the PR was retargeted to another branch in the same repository, or after the target branch was force-pushed to unrelated history.Main Changes
target, frompull_request.base.ref). PR events without it are rejected as missing identity.require_current_pr()rejects the run when the livebase.refdiffers from the planned target.compare/<tested base>...<target>) and accepts onlyaheadoridentical. That allows normal target advancement and rejects a rewritten or rewound target. The livebase.shais not used here because GitHub does not update it when the target branch moves.docs/ci.mdfreshness section updated.Verifying these changes
python3 .github/scripts/test_ci_policy.py: all 27 tests pass.ci-policy.pychange reverted, the two updated tests fail.Does this PR potentially affect the following parts?
gh apicompare call, which is covered by the existingcontents: readpermission.Documentation Status
Doc - TODO: required documentation is pending; complete it before merging.Doc - Done: documentation is included here or linked below.Doc - No Need: no user-visible documentation is affected.Documentation files in this PR or paired hugegraph-doc PR:
Visual overview
The freshness check now binds the planned target branch name to the live PR target and verifies that the current target history contains the tested base (compare status ahead or identical). Normal target advancement remains allowed; retargeting or loss of the tested base is rejected. A force-push is not rejected merely because it is a force-push. Existing head/source/repository checks and the conservative planning metadata-outage fallback remain in place. This is a mechanism illustration, not evidence that this PR’s CI, performance, or release acceptance passed. Reviewed: 2026-10-31.