|
9 | 9 | runs-on: ubuntu-latest |
10 | 10 | if: github.repository == 'vitejs/vite' && github.event.issue.pull_request && startsWith(github.event.comment.body, '/ecosystem-ci run') |
11 | 11 | permissions: |
12 | | - issues: write # to add / delete reactions |
| 12 | + issues: write # to add / delete reactions, post comments |
13 | 13 | pull-requests: write # to read PR data, and to add labels |
14 | 14 | actions: read # to check workflow status |
15 | 15 | contents: read # to clone the repo |
|
66 | 66 | repo: context.repo.repo, |
67 | 67 | pull_number: context.issue.number |
68 | 68 | }) |
| 69 | +
|
| 70 | + const commentCreatedAt = new Date(context.payload.comment.created_at) |
| 71 | + const commitPushedAt = new Date(pr.head.repo.pushed_at) |
| 72 | +
|
| 73 | + console.log(`Comment created at: ${commentCreatedAt.toISOString()}`) |
| 74 | + console.log(`PR last pushed at: ${commitPushedAt.toISOString()}`) |
| 75 | +
|
| 76 | + // Check if any commits were pushed after the comment was created |
| 77 | + if (commitPushedAt > commentCreatedAt) { |
| 78 | + const errorMsg = [ |
| 79 | + '⚠️ Security warning: PR was updated after the trigger command was posted.', |
| 80 | + '', |
| 81 | + `Comment posted at: ${commentCreatedAt.toISOString()}`, |
| 82 | + `PR last pushed at: ${commitPushedAt.toISOString()}`, |
| 83 | + '', |
| 84 | + 'This could indicate an attempt to inject code after approval.', |
| 85 | + 'Please review the latest changes and re-run /ecosystem-ci run if they are acceptable.' |
| 86 | + ].join('\n') |
| 87 | +
|
| 88 | + core.setFailed(errorMsg) |
| 89 | +
|
| 90 | + await github.rest.issues.createComment({ |
| 91 | + owner: context.repo.owner, |
| 92 | + repo: context.repo.repo, |
| 93 | + issue_number: context.issue.number, |
| 94 | + body: errorMsg |
| 95 | + }) |
| 96 | +
|
| 97 | + throw new Error('PR was pushed to after comment was created') |
| 98 | + } |
| 99 | +
|
69 | 100 | core.setOutput('head_sha', pr.head.sha) |
70 | 101 | return { |
71 | 102 | num: context.issue.number, |
@@ -228,7 +259,7 @@ jobs: |
228 | 259 | prNumber: '' + prData.num, |
229 | 260 | branchName: prData.branchName, |
230 | 261 | repo: prData.repo, |
231 | | - commit: process.env.COLLISION === 'false' ? prData.commit : '', |
| 262 | + commit: prData.commit, |
232 | 263 | suite: suite === '' ? '-' : suite |
233 | 264 | } |
234 | 265 | }) |
0 commit comments