jerry/buzz
1
0
Fork 0
mirror of https://github.com/block/buzz.git synced 2026-10-27 04:30:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(release): require exact-head approval for desktop tags (#3973)

Browse Source 
## Summary
- require an exact-head trusted approval before desktop auto-tagging
- remove rule-suite authorization that `GITHUB_TOKEN` cannot access
- pin review pagination to `page=1` and test the deployed `gh` control
flow

## Why
The previous verifier unconditionally queried repository rule-suite
endpoints with `github.token`. Those endpoints require Administration:
read, which Actions `GITHUB_TOKEN` cannot receive. Its paginated list
request also duplicated page one when no explicit page was supplied.

This deliberately removes admin-bypass authorization rather than
introducing a second credential during release recovery. Desktop release
PRs must now have GitHub's overall `APPROVED` decision and a
MEMBER/OWNER/COLLABORATOR approval attached to the exact candidate SHA.

## Validation
- `scripts/test-desktop-release-authorization.sh`
- `scripts/test-release-ref-contract.sh`
- `bash -n scripts/verify-desktop-release-merge.sh
scripts/verify-desktop-release-authorization.sh
scripts/test-desktop-release-authorization.sh
scripts/test-release-ref-contract.sh`
- `git diff --check origin/main...HEAD`

The new flow test uses a stub `gh` executable, asserts the exact
`page=1` request, fails any rule-suite API call, and rejects stale-SHA,
untrusted-author, changes-requested review, and non-approved
aggregate-decision cases.

Signed-off-by: Wes <wesbillman@users.noreply.github.com>
Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>
This commit is contained in:
Wes
2026-07-31 12:33:54 -06:00
committed by GitHub
parent db7e84d4f8
commit 54c8ef30a9
7 changed files with 93 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
scripts/test-release-ref-contract.sh
View File

@@ -64,24 +64,15 @@ grep -Fq 'git/refs' "$auto_tag"
grep -Fq 'TAG_PREFIX="desktop-v"' "$auto_tag"
grep -Fq 'target_sha=${{ github.event.pull_request.merge_commit_sha }}' "$auto_tag"
grep -Fq 'scripts/verify-desktop-release-merge.sh' "$auto_tag"
bypass_filter="$repo_root/scripts/desktop-release-bypass-authorized.jq"
bypass_fixture="$repo_root/scripts/fixtures/desktop-release-rule-suite-bypass.json"
jq -e --argjson ruleset_id 13596885 -f "$bypass_filter" "$bypass_fixture" >/dev/null || {
echo "real squash-bypass fixture was rejected" >&2
"$repo_root/scripts/test-desktop-release-authorization.sh"
if rg -q 'rule-suites|desktop-release-bypass-authorized|MERGED_BY' \
"$repo_root/scripts/verify-desktop-release-merge.sh" \
"$repo_root/scripts/verify-desktop-release-authorization.sh" \
"$auto_tag"; then
echo "desktop auto-tag still depends on unavailable rule-suite authorization" >&2
exit 1
}
for mutation in \
'.result = "pass"' \
'(.rule_evaluations[] | select(.rule_type == "pull_request")).result = "pass"' \
'(.rule_evaluations[] | select(.rule_type == "pull_request")).rule_source.id = 0' \
'(.rule_evaluations[] | select(.rule_type == "pull_request")).enforcement = "evaluate"' \
'del(.rule_evaluations[] | select(.rule_type == "pull_request"))'; do
if jq "$mutation" "$bypass_fixture" | jq -e --argjson ruleset_id 13596885 -f "$bypass_filter" >/dev/null; then
echo "bypass filter accepted invalid fixture mutation: $mutation" >&2
exit 1
fi
done
fi
review_filter="$repo_root/scripts/review-decision-approved.jq"
for fixture in \
'{"reviewDecision":"CHANGES_REQUESTED"}' \