actions/checkout
3
0
Fork 0
mirror of https://code.forgejo.org/actions/checkout.git synced 2026-06-22 21:00:31 +00:00
Code Activity

address copilot and reviewer feedback

Browse source
This commit is contained in:
Aiqiao Yan 2026-06-15 16:12:03 +00:00
parent b8447332b0
commit 12a489776f
3 changed files with 45 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

25
__test__/unsafe-pr-checkout-helper.test.ts
View file

@ -13,6 +13,7 @@ const PR_MERGE_SHA = '2222222222222222222222222222222222222222'
const SAFE_BASE_SHA = '3333333333333333333333333333333333333333'
const WORKFLOW_RUN_HEAD_COMMIT_SHA = '4444444444444444444444444444444444444444'
const BASE_QUALIFIED_REPO = 'some-owner/some-repo'
const FORK_QUALIFIED_REPO = 'another-repo/fork'
function setContext(eventName: string, payload: object): void {
;(github.context as {eventName: string}).eventName = eventName
@ -25,7 +26,7 @@ function forkPullRequestTargetPayload(): object {
pull_request: {
head: {
sha: PR_HEAD_SHA,
repo: {id: FORK_REPO_ID}
repo: {id: FORK_REPO_ID, full_name: FORK_QUALIFIED_REPO}
},
merge_commit_sha: PR_MERGE_SHA
}
@ -38,7 +39,7 @@ function sameRepoPullRequestTargetPayload(): object {
pull_request: {
head: {
sha: PR_HEAD_SHA,
repo: {id: BASE_REPO_ID}
repo: {id: BASE_REPO_ID, full_name: BASE_QUALIFIED_REPO}
},
merge_commit_sha: PR_MERGE_SHA
}
@ -51,7 +52,7 @@ function forkWorkflowRunPayload(): object {
workflow_run: {
event: 'pull_request',
head_commit: {id: WORKFLOW_RUN_HEAD_COMMIT_SHA},
head_repository: {id: FORK_REPO_ID}
head_repository: {id: FORK_REPO_ID, full_name: FORK_QUALIFIED_REPO}
}
}
}
@ -164,7 +165,7 @@ describe('unsafe-pr-checkout-helper', () => {
setContext('pull_request_target', forkPullRequestTargetPayload())
expect(() =>
assertSafePrCheckout({
qualifiedRepository: 'attacker/fork',
qualifiedRepository: FORK_QUALIFIED_REPO,
ref: 'refs/heads/main',
commit: '',
allowUnsafePrCheckout: false
@ -172,13 +173,25 @@ describe('unsafe-pr-checkout-helper', () => {
).toThrow()
})
it('allows pull_request_target checkout of an unrelated third-party repo', () => {
setContext('pull_request_target', forkPullRequestTargetPayload())
expect(() =>
assertSafePrCheckout({
qualifiedRepository: 'some-other/unrelated',
ref: 'refs/heads/main',
commit: '',
allowUnsafePrCheckout: false
})
).not.toThrow()
})
it('refuses pull_request_target ignoring repository case differences', () => {
setContext('pull_request_target', forkPullRequestTargetPayload())
expect(() =>
assertSafePrCheckout({
qualifiedRepository: 'SOME-OWNER/SOME-REPO',
qualifiedRepository: FORK_QUALIFIED_REPO.toUpperCase(),
ref: '',
commit: PR_HEAD_SHA,
commit: '',
allowUnsafePrCheckout: false
})
).toThrow()