Skip to content

Commit df67fb6

Browse files
lawrencecchenlawrencecchen
committed
fix: clarify CLA execution and source bindings
1 parent f14e9e0 commit df67fb6

1 file changed

Lines changed: 22 additions & 19 deletions

File tree

‎.github/scripts/rerun-failed-cla.sh‎

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -298,7 +298,7 @@ assert_exact_pr_association() {
298298
jq -e \
299299
--arg repo "${GH_REPO}" \
300300
--arg pr "${PR_NUMBER}" \
301-
--arg sha "${expected_sha}" \
301+
--arg source_sha "${expected_sha}" \
302302
--arg base "${TARGET_BASE_REF}" \
303303
--arg base_sha "${base_sha}" \
304304
--arg head_ref "${head_ref}" \
@@ -315,7 +315,7 @@ assert_exact_pr_association() {
315315
(.base.sha | type == "string") and
316316
.base.sha == $base_sha and
317317
.head.ref == $head_ref and
318-
.head.sha == $sha and
318+
.head.sha == $source_sha and
319319
.head.repo.full_name == $head_repo and
320320
(.head.repo.id | type == "number") and
321321
.head.repo.id == $head_repo_id
@@ -378,7 +378,7 @@ validate_live_open_head_association() {
378378
open_prs_json="$(jq -c '[.]' <<<"${open_prs_page}")"
379379
if ! matching_open_prs_json="$(jq -c \
380380
--arg repo "${GH_REPO}" \
381-
--arg sha "${head_sha}" \
381+
--arg source_sha "${head_sha}" \
382382
--arg base_sha "${base_sha}" \
383383
--arg base "${TARGET_BASE_REF}" \
384384
--arg head_ref "${head_ref}" \
@@ -396,7 +396,7 @@ validate_live_open_head_association() {
396396
(.base.sha | type == "string") and
397397
.base.sha == $base_sha and
398398
.head.ref == $head_ref and
399-
.head.sha == $sha and
399+
.head.sha == $source_sha and
400400
.head.repo.full_name == $head_repo and
401401
(.head.repo.id | type == "number") and
402402
.head.repo.id == $head_repo_id
@@ -421,7 +421,7 @@ validate_exact_pr_snapshot() {
421421
jq -e \
422422
--arg repo "${GH_REPO}" \
423423
--argjson number "${PR_NUMBER}" \
424-
--arg sha "${head_sha}" \
424+
--arg source_sha "${head_sha}" \
425425
--arg base_sha "${base_sha}" \
426426
--arg base "${TARGET_BASE_REF}" \
427427
--arg head_ref "${head_ref}" \
@@ -436,7 +436,7 @@ validate_exact_pr_snapshot() {
436436
.base.repo.id == $base_repo_id and
437437
(.base.sha | type == "string") and
438438
.base.sha == $base_sha and
439-
.head.sha == $sha and
439+
.head.sha == $source_sha and
440440
.head.ref == $head_ref and
441441
.head.repo.full_name == $head_repo and
442442
.head.repo.id == $head_repo_id and
@@ -480,7 +480,10 @@ workflow_id="$(jq -r --arg path "${WORKFLOW_PATH}" '[.[] | .workflows[]? | selec
480480
# newest one. Every candidate is tied to the exact workflow path and event.
481481
# When GitHub includes pull_requests on a run, bind the candidate to the exact
482482
# PR object, including its source head and live base SHAs. GitHub can return an
483-
# empty array for pull_request_target runs. Those candidates are accepted when
483+
# `.head_sha` on a workflow run is the Actions execution SHA, not necessarily
484+
# the Pull Request source SHA; it is validated against the exact run and check
485+
# below. The source SHA is read only from the live Pull Request association.
486+
# Empty arrays for pull_request_target runs are accepted when
484487
# their source repository metadata is complete; the exact run and live PR are
485488
# re-read below, and a non-base execution is additionally bound to its source
486489
# head check before any rerun. Missing metadata cannot identify which fork
@@ -548,7 +551,7 @@ fi
548551
if ! candidate_list_json="$(jq -c \
549552
--arg path "${WORKFLOW_PATH}" \
550553
--arg event "${TARGET_EVENT}" \
551-
--arg sha "${head_sha}" \
554+
--arg source_sha "${head_sha}" \
552555
--arg base_sha "${base_sha}" \
553556
--arg workflow_id "${workflow_id}" \
554557
--arg pr "${PR_NUMBER}" \
@@ -585,7 +588,7 @@ if ! candidate_list_json="$(jq -c \
585588
(.base.repo.id | type == "number") and
586589
.base.repo.id == $repo_id and
587590
.head.ref == $head_ref and
588-
.head.sha == $sha and
591+
.head.sha == $source_sha and
589592
(.head.repo.id | type == "number") and
590593
.head.repo.id == $head_repo_id and
591594
((.head.repo.full_name // "") == "" or
@@ -640,7 +643,7 @@ if [[ "${candidate_count}" == "0" ]]; then
640643
empty_execution_mismatch_count="$(jq -r \
641644
--arg path "${WORKFLOW_PATH}" \
642645
--arg event "${TARGET_EVENT}" \
643-
--arg sha "${base_sha}" \
646+
--arg execution_sha "${base_sha}" \
644647
--arg workflow_id "${workflow_id}" \
645648
--arg head_repo "${head_repo}" \
646649
--argjson head_repo_id "${head_repo_id}" \
@@ -658,7 +661,7 @@ if [[ "${candidate_count}" == "0" ]]; then
658661
(.head_sha | type == "string") and
659662
(.head_sha | test("^[0-9a-f]{40}$")) and
660663
(
661-
.head_sha != $sha or
664+
.head_sha != $execution_sha or
662665
(.head_repository | type) != "object" or
663666
.head_repository.full_name != $head_repo or
664667
(.head_repository.id | type) != "number" or
@@ -690,7 +693,7 @@ if [[ "${candidate_count}" == "0" ]]; then
690693
stale_base_count="$(jq -r \
691694
--arg path "${WORKFLOW_PATH}" \
692695
--arg event "${TARGET_EVENT}" \
693-
--arg sha "${head_sha}" \
696+
--arg source_sha "${head_sha}" \
694697
--arg workflow_id "${workflow_id}" \
695698
--arg pr "${PR_NUMBER}" \
696699
--arg repo "${GH_REPO}" \
@@ -733,7 +736,7 @@ if [[ "${candidate_count}" == "0" ]]; then
733736
(.base.repo.id | type == "number") and
734737
.base.repo.id == $repo_id and
735738
.head.ref == $head_ref and
736-
.head.sha == $sha and
739+
.head.sha == $source_sha and
737740
(.head.repo.id | type == "number") and
738741
.head.repo.id == $head_repo_id and
739742
.head.repo.full_name == $head_repo and
@@ -756,7 +759,7 @@ if [[ "${candidate_count}" == "0" ]]; then
756759
stale_run_count="$(jq -r \
757760
--arg path "${WORKFLOW_PATH}" \
758761
--arg event "${TARGET_EVENT}" \
759-
--arg sha "${head_sha}" \
762+
--arg source_sha "${head_sha}" \
760763
--arg workflow_id "${workflow_id}" \
761764
--arg pr "${PR_NUMBER}" \
762765
--arg repo "${GH_REPO}" \
@@ -794,7 +797,7 @@ if [[ "${candidate_count}" == "0" ]]; then
794797
(.base.repo.id | type == "number") and
795798
.base.repo.id == $repo_id and
796799
.head.ref == $head_ref and
797-
.head.sha == $sha and
800+
.head.sha == $source_sha and
798801
(.head.repo.id | type == "number") and
799802
.head.repo.id == $head_repo_id and
800803
((.head.repo.full_name // "") == "" or
@@ -907,7 +910,7 @@ assert_failed_check_binding() {
907910
[[ "${expected_check_sha}" =~ ^[0-9a-f]{40}$ ]] || return 1
908911
matching_count="$(jq -r \
909912
--arg job "${expected_check_name}" \
910-
--arg sha "${expected_check_sha}" \
913+
--arg expected_sha "${expected_check_sha}" \
911914
--arg url "${details_url}" \
912915
--argjson app_id "${CLA_ACTION_APP_ID}" '
913916
[ .check_runs[]?
@@ -918,7 +921,7 @@ assert_failed_check_binding() {
918921
.status == "completed" and
919922
.conclusion == "failure" and
920923
(.head_sha | type == "string") and
921-
.head_sha == $sha and
924+
.head_sha == $expected_sha and
922925
(.app | type == "object") and
923926
(.app.id | type == "number") and
924927
.app.id == $app_id and
@@ -1010,7 +1013,7 @@ validate_exact_run_payload() {
10101013
--arg run_id "${run_id}" \
10111014
--arg path "${WORKFLOW_PATH}" \
10121015
--arg event "${TARGET_EVENT}" \
1013-
--arg sha "${head_sha}" \
1016+
--arg source_sha "${head_sha}" \
10141017
--arg run_sha "${run_execution_sha}" \
10151018
--arg run_head_branch "${run_head_branch}" \
10161019
--arg pr "${PR_NUMBER}" \
@@ -1048,7 +1051,7 @@ validate_exact_run_payload() {
10481051
(.base.repo.id | type == "number") and
10491052
.base.repo.id == $repo_id and
10501053
.head.ref == $head_ref and
1051-
.head.sha == $sha and
1054+
.head.sha == $source_sha and
10521055
(.head.repo.id | type == "number") and
10531056
.head.repo.id == $head_repo_id and
10541057
((.head.repo.full_name // "") == "" or

0 commit comments

Comments
 (0)