9510863184
`gh pr list --head <branch>` matches PRs across all forks, so when a session's branch is the project default (typically "main") we'd match unrelated contributors' fork PRs. Two defenses: 1. Short-circuit when session.branch === project.defaultBranch — a worker session should never legitimately have its head ref on the default branch, and matching there is unsafe by construction. 2. Request `headRepositoryOwner` from gh and discard PRs whose head owner differs from the project repo owner. Fork PRs are someone else's work. Refs #1724. |
||
|---|---|---|
| .. | ||
| graphql-batch.integration.test.ts | ||
| graphql-batch.test.ts | ||
| index.test.ts | ||