fix(governance): audit merged PRs after branch cleanup
This commit is contained in:
@@ -243,13 +243,25 @@ def validate_pull_request(
|
||||
pr: dict[str, Any], task: RemoteTask
|
||||
) -> list[AuditFinding]:
|
||||
findings: list[AuditFinding] = []
|
||||
if not task.work_branch or pull_request_head(pr) != task.work_branch:
|
||||
body = pr.get("body")
|
||||
body = body if isinstance(body, str) else ""
|
||||
head = pull_request_head(pr)
|
||||
head_matches = bool(task.work_branch) and head == task.work_branch
|
||||
if (
|
||||
not head_matches
|
||||
and bool(pr.get("merged"))
|
||||
and re.fullmatch(r"refs/pull/\d+/head", head)
|
||||
and bool(task.work_branch)
|
||||
and task.work_branch in body
|
||||
):
|
||||
# Gitea rewrites head.ref after a merged source branch is deleted. The
|
||||
# immutable PR body still records the claimed work branch.
|
||||
head_matches = True
|
||||
if not head_matches:
|
||||
findings.append(
|
||||
AuditFinding(task.number, "pull-request", "PR head 与 claim 工作分支不一致。")
|
||||
)
|
||||
body = pr.get("body")
|
||||
body = body if isinstance(body, str) else ""
|
||||
required_values = [f"docs/tasks/{task.task_id}.md"]
|
||||
required_values = [f"docs/tasks/{task.task_id}.md", task.work_branch or ""]
|
||||
if task.context_ref:
|
||||
required_values.append(task.context_ref)
|
||||
required_values.extend(task.write_paths or [])
|
||||
|
||||
Reference in New Issue
Block a user