You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(pr-pipeline): post resumed-branch statuses only when the branch is still at the checked tip #8574
post-statuses.mjs (around lines 144-153) posts pipeline/* statuses on a resumed branch's checked tip without checking that the branch ref still points at that tip, as report-outcome.mjs does (around 1189-1191). If the branch moves between run-checks and report-statuses, green statuses land on the old SHA. No merge gate reads pipeline/* success (gate-check.mjs requires only ci-status), so this is misleading, not a gate bypass.
Proposed change
Read git/ref/heads/<resumed branch> before posting and post only when it equals checks.tip; otherwise post nothing. Test: a moved branch posts nothing.
Found by GitHub Security & Cost's pass on #8567 (P4).
Thanks for the report. As I read it, post-statuses.mjs posts pipeline/* statuses on a resumed branch's checked tip without first confirming the branch ref still points at that tip, unlike report-outcome.mjs. If the branch moves between run-checks and report-statuses, green statuses land on the old SHA. You note no merge gate reads pipeline/*, so the effect is misleading statuses rather than a gate bypass. The proposed fix is to read git/ref/heads/ before posting, post only when it equals checks.tip, and add a test that a moved branch posts nothing. The brief is clear and I found no duplicate issues. A maintainer will confirm the priority and work class.
Activity
github-actions commentedon Oct 20, 2026
Thanks for the report. As I read it, post-statuses.mjs posts pipeline/* statuses on a resumed branch's checked tip without first confirming the branch ref still points at that tip, unlike report-outcome.mjs. If the branch moves between run-checks and report-statuses, green statuses land on the old SHA. You note no merge gate reads pipeline/*, so the effect is misleading statuses rather than a gate bypass. The proposed fix is to read git/ref/heads/ before posting, post only when it equals checks.tip, and add a test that a moved branch posts nothing. The brief is clear and I found no duplicate issues. A maintainer will confirm the priority and work class.
Automated triage. A maintainer reviews it.