From fe9ce77d952f2e9142a5f93d0d542a0d1cd14b3c Mon Sep 17 00:00:00 2001 From: Patrick Ryan Date: Sat, 3 Oct 2026 04:20:42 -0500 Subject: [PATCH] merge-bot: fail closed when compare output is truncated --- .github/workflows/merge-bot.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/merge-bot.yml b/.github/workflows/merge-bot.yml index 1cd2dab..0ec18aa 100644 --- a/.github/workflows/merge-bot.yml +++ b/.github/workflows/merge-bot.yml @@ -95,6 +95,8 @@ jobs: run: | set -euo pipefail CMP=$(gh api "repos/$GITHUB_REPOSITORY/compare/$BASE_REF...$HEAD_SHA") + [ "$(jq .total_commits <<<"$CMP")" -eq "$(jq ".commits | length" <<<"$CMP")" ] \ + || { echo "::error::compare truncated (too many commits)"; exit 1; } jq -e '.status == "ahead" or .status == "identical"' <<<"$CMP" >/dev/null \ || { echo "::error::PR is not a fast-forward of $BASE_REF"; exit 1; } jq -e '[.commits[] | select(.commit.verification.verified != true)] | length == 0' <<<"$CMP" >/dev/null \ @@ -117,6 +119,8 @@ jobs: [ -n "${ALLOWED_FPRS// /}" ] || { echo "::error::repo variable ALLOWED_SIGNING_FPRS is empty"; exit 1; } ALLOWED=$(tr ' ,' '\n\n' <<<"$ALLOWED_FPRS" | tr a-f A-F | sed '/^$/d') CMP=$(gh api "repos/$GITHUB_REPOSITORY/compare/$BASE_REF...$HEAD_SHA") + [ "$(jq .total_commits <<<"$CMP")" -eq "$(jq ".commits | length" <<<"$CMP")" ] \ + || { echo "::error::compare truncated (too many commits)"; exit 1; } N=$(jq '.commits | length' <<<"$CMP") for i in $(seq 0 $((N - 1))); do SHA=$(jq -r ".commits[$i].sha" <<<"$CMP")