Repository navigation
Conversation
Historical PR bases can predate the companion helper. Bind this existing pull_request_target checkout to its executing trusted workflow revision, retaining the original permissions and assignment policy. Refs Gentleman-Programming#1974 Risk: item 2 (privileged workflow code provenance); item 5 (GitHub Actions).
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely describes the main change: loading the assignment helper from the trusted workflow revision. |
| Linked Issues check | |
Issue #1974 requires the existing pull_request_target assignment workflow to load its trusted helper when the historical PR base lacks that file, while preserving trust and assignment boundaries. Th… |
| Out of Scope Changes check | |
The diff contains only the workflow checkout-source correction, focused regression and contract assertions, and the affected contributor documentation. The tests support issue #1974. The documentation… |
Full details: Linked Issues check
-
Explanation
Issue
#1974requires the existingpull_request_targetassignment workflow to load its trusted helper when the historical PR base lacks that file, while preserving trust and assignment boundaries. The workflow now checks out.github/scripts/issue-auto-assign.mjsat${{ github.workflow_sha }}and keeps sparse checkout,persist-credentials: false, pinned actions, permissions, event types, and assignment logic unchanged. The regression test models an absent old-base helper, verifies the workflow revision supplies it, and rejects PR-head selection. The trust test still rejects base/head checkout and preserves the executable boundary. The documentation update matches the approved provenance and proof limits.
Full details: Out of Scope Changes check
-
Explanation
The diff contains only the workflow checkout-source correction, focused regression and contract assertions, and the affected contributor documentation. The tests support issue
#1974. The documentation explains the same trusted provenance and validation limits. No unrelated workflow, permission, settings, assignment-policy, PR#1954, merge, or production-assignment change is present.
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
bf6f322
1 participant
🔗 Linked Issue
Closes #1974
Lifecycle Evidence
dnlrsls; current-main reproduction, root cause, design and non-goals are recorded there.2ab47d3f..743f6ff6approved across risk/readability/reliability; exact acknowledgement completed (lineagereview-7135769c52adc998).🏷️ PR Type
type:bug— Bug fixtype:feature— New featuretype:question— Question requiring tracked worktype:docs— Documentation onlytype:refactor— Code refactoringtype:chore— Maintenancetype:breaking-change— Breaking change📝 Summary
pull_request_targetworkflow revision, not a PR's historical base that may predate it.📂 Changes
.github/workflows/issue-auto-assign.ymlgithub.workflow_shaand clarify the checkout step name.github/scripts/issue-auto-assign.test.mjsCONTRIBUTING.md🧪 Test Plan
main2ab47d3f2dcf12596e400718e8c278529c0abb88: read-only immutable-tree reproduction exits 1 as expected; selected historical base lacks the helper although the trusted workflow revision contains it. Evidence in fix(ci): linked-issue assignment fails for PRs with older bases #1974.node --test --test-name-pattern=old-base .github/scripts/issue-auto-assign.test.mjs— exit 1, specifically missing helper in selected historical revision.node --test .github/scripts/issue-auto-assign.test.mjs— exit 0, 30/30 passed.node --test .github/scripts/issue-*.test.mjs— exit 0, 348/348 passed.node --test .github/scripts/merge-queue.test.mjs .github/scripts/label-policy.test.mjs .github/scripts/transient-artifacts.test.mjs .github/scripts/pr-size-notice.test.mjs— exit 0, 40/40 passed.git diff --check— passed; exactly three tracked paths, 35 additions/8 deletions.--test-reporter=tap --test-name-pattern='old-base|workflow trust'on.github/scripts/issue-auto-assign.test.mjs— 2/2 passed, exit 0, stderr empty.No Go behavior changed; broad Go, E2E, plugin, lint and Windows coverage is delegated to hosted CI, not claimed from local Node checks.
actionlint/zizmorwere unavailable locally and were not installed.🤖 Automated Checks
Pending at publication; the Checks tab for exact head
743f6ff6a4695969651ef78892ba2c132ad50b90is the authoritative hosted result. Required contexts remain unchanged:✅ Contributor Checklist
type:*label (type:bug), confirmed by API after creation.743f6ff6a4695969651ef78892ba2c132ad50b90with noCo-Authored-Bytrailer.💬 Notes for Reviewers
Risk: item 2 (trusted code provenance in an issues-write workflow); item 5 (CI).
workflow_shais appropriate because this existing event ispull_request_target, not a universal trust marker. No PR-head execution, fallback/bootstrap, helper implementation, assignment-policy, permission or required-check changes.Local fixtures and hosted checks on this introducing PR do not prove old-base execution of its candidate trusted workflow. The correction becomes active only after trusted integration; a hosted old-base occurrence remains unproven. No #1954 rerun, assignment probe, merge or force push is included.
Summary by CodeRabbit
Bug Fixes
Documentation