9510863184
`gh pr list --head <branch>` matches PRs across all forks, so when a session's branch is the project default (typically "main") we'd match unrelated contributors' fork PRs. Two defenses: 1. Short-circuit when session.branch === project.defaultBranch — a worker session should never legitimately have its head ref on the default branch, and matching there is unsafe by construction. 2. Request `headRepositoryOwner` from gh and discard PRs whose head owner differs from the project repo owner. Fork PRs are someone else's work. Refs #1724. |
||
|---|---|---|
| .. | ||
| src | ||
| test | ||
| .gitignore | ||
| CHANGELOG.md | ||
| package.json | ||
| tsconfig.json | ||