mirror of
https://github.com/go-gitea/gitea.git
synced 2026-08-14 19:22:52 +00:00
Zettat123
1c92062c69
Backport #38886 For a `pull_request_target` (PRT) run, Gitea loads the top-level workflow from the trusted base branch, but any local reusable workflow it calls (`uses: ./...`) was read from the PR **head** commit, which the fork author controls. **Record the source commit where the content is read.** `DetectedWorkflow` now carries a `SourceCommitSHA` filled in next to `Content`, so the PRT detection pass at the base commit records the base SHA automatically. **Defense in depth.** `loadReusableWorkflowSource` pins the PR base commit for a PRT run's local `uses: ./...` rather than trusting the stored SHA. This also covers runs recorded before this change, whose rows still hold the head SHA and would otherwise resolve from the fork on rerun. Existing run rows are not migrated. Co-authored-by: bircni <bircni@icloud.com>
74 lines
2.0 KiB
Go
74 lines
2.0 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package actions
|
|
|
|
import (
|
|
"testing"
|
|
|
|
actions_model "gitea.dev/models/actions"
|
|
actions_module "gitea.dev/modules/actions"
|
|
"gitea.dev/modules/json"
|
|
api "gitea.dev/modules/structs"
|
|
webhook_module "gitea.dev/modules/webhook"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestPullRequestTargetBaseSHA(t *testing.T) {
|
|
prPayload := func(baseSHA string) string {
|
|
payload, err := json.Marshal(api.PullRequestPayload{
|
|
PullRequest: &api.PullRequest{
|
|
Base: &api.PRBranchInfo{Sha: baseSHA},
|
|
},
|
|
})
|
|
require.NoError(t, err)
|
|
return string(payload)
|
|
}
|
|
|
|
t.Run("pull_request_target with base SHA", func(t *testing.T) {
|
|
run := &actions_model.ActionRun{
|
|
Event: webhook_module.HookEventPullRequest,
|
|
TriggerEvent: actions_module.GithubEventPullRequestTarget,
|
|
EventPayload: prPayload("base-sha"),
|
|
}
|
|
got, ok := pullRequestTargetBaseSHA(run)
|
|
assert.True(t, ok)
|
|
assert.Equal(t, "base-sha", got)
|
|
})
|
|
|
|
t.Run("non pull_request_target trigger", func(t *testing.T) {
|
|
run := &actions_model.ActionRun{
|
|
Event: webhook_module.HookEventPullRequest,
|
|
TriggerEvent: actions_module.GithubEventPullRequest,
|
|
EventPayload: prPayload("base-sha"),
|
|
}
|
|
got, ok := pullRequestTargetBaseSHA(run)
|
|
assert.False(t, ok)
|
|
assert.Empty(t, got)
|
|
})
|
|
|
|
t.Run("missing base SHA", func(t *testing.T) {
|
|
run := &actions_model.ActionRun{
|
|
Event: webhook_module.HookEventPullRequest,
|
|
TriggerEvent: actions_module.GithubEventPullRequestTarget,
|
|
EventPayload: prPayload(""),
|
|
}
|
|
got, ok := pullRequestTargetBaseSHA(run)
|
|
assert.False(t, ok)
|
|
assert.Empty(t, got)
|
|
})
|
|
|
|
t.Run("invalid payload", func(t *testing.T) {
|
|
run := &actions_model.ActionRun{
|
|
Event: webhook_module.HookEventPullRequest,
|
|
TriggerEvent: actions_module.GithubEventPullRequestTarget,
|
|
EventPayload: "{",
|
|
}
|
|
got, ok := pullRequestTargetBaseSHA(run)
|
|
assert.False(t, ok)
|
|
assert.Empty(t, got)
|
|
})
|
|
}
|