Skip to content

fix(pr-pipeline): post resumed-branch statuses only when the branch is still at the checked tip #8574

Closed

Description

@kyle-sexton

Refs: #8567

Problem

post-statuses.mjs (around lines 144-153) posts pipeline/* statuses on a resumed branch's checked tip without checking that the branch ref still points at that tip, as report-outcome.mjs does (around 1189-1191). If the branch moves between run-checks and report-statuses, green statuses land on the old SHA. No merge gate reads pipeline/* success (gate-check.mjs requires only ci-status), so this is misleading, not a gate bypass.

Proposed change

Read git/ref/heads/<resumed branch> before posting and post only when it equals checks.tip; otherwise post nothing. Test: a moved branch posts nothing.

Found by GitHub Security & Cost's pass on #8567 (P4).

Activity

  1. added
    needs-triageNot yet classified. Floor until a type and one priority tier are set.
    on Oct 20, 2026
  2. github-actions commented on Oct 20, 2026

    @github-actions
    Contributor

    Thanks for the report. As I read it, post-statuses.mjs posts pipeline/* statuses on a resumed branch's checked tip without first confirming the branch ref still points at that tip, unlike report-outcome.mjs. If the branch moves between run-checks and report-statuses, green statuses land on the old SHA. You note no merge gate reads pipeline/*, so the effect is misleading statuses rather than a gate bypass. The proposed fix is to read git/ref/heads/ before posting, post only when it equals checks.tip, and add a test that a moved branch posts nothing. The brief is clear and I found no duplicate issues. A maintainer will confirm the priority and work class.

    Automated triage. A maintainer reviews it.

  3. added
    priority: lowNice-to-have, cosmetic, or speculative; opportunistic.
    and removed
    needs-triageNot yet classified. Floor until a type and one priority tier are set.
    on Oct 20, 2026
  4. added
    status: confirmedA maintainer confirmed the item is real and in scope; ready to be worked.
    on Oct 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    priority: lowNice-to-have, cosmetic, or speculative; opportunistic.status: confirmedA maintainer confirmed the item is real and in scope; ready to be worked.

    Type

    Fields

    No fields configured for Bug.

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions