mirror of
https://github.com/block/buzz.git
synced 2026-08-18 06:50:31 +02:00
54c8ef30a9
## Summary - require an exact-head trusted approval before desktop auto-tagging - remove rule-suite authorization that `GITHUB_TOKEN` cannot access - pin review pagination to `page=1` and test the deployed `gh` control flow ## Why The previous verifier unconditionally queried repository rule-suite endpoints with `github.token`. Those endpoints require Administration: read, which Actions `GITHUB_TOKEN` cannot receive. Its paginated list request also duplicated page one when no explicit page was supplied. This deliberately removes admin-bypass authorization rather than introducing a second credential during release recovery. Desktop release PRs must now have GitHub's overall `APPROVED` decision and a MEMBER/OWNER/COLLABORATOR approval attached to the exact candidate SHA. ## Validation - `scripts/test-desktop-release-authorization.sh` - `scripts/test-release-ref-contract.sh` - `bash -n scripts/verify-desktop-release-merge.sh scripts/verify-desktop-release-authorization.sh scripts/test-desktop-release-authorization.sh scripts/test-release-ref-contract.sh` - `git diff --check origin/main...HEAD` The new flow test uses a stub `gh` executable, asserts the exact `page=1` request, fails any rule-suite API call, and rejects stale-SHA, untrusted-author, changes-requested review, and non-approved aggregate-decision cases. Signed-off-by: Wes <wesbillman@users.noreply.github.com> Co-authored-by: Carl <c7ebe626f000404285d3686e1dc74cc07cc60a9754a150041ba132e14bd3e2ec@buzz.block.builderlab.xyz>
70 lines
2.7 KiB
Bash
Executable File
70 lines
2.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
|
|
tmp=$(mktemp -d)
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
mkdir -p "$tmp/bin"
|
|
cat >"$tmp/bin/gh" <<'GH'
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
printf '%q ' "$@" >>"$GH_CALLS"
|
|
printf '\n' >>"$GH_CALLS"
|
|
|
|
[[ "${1:-}" == api ]] || { echo "expected gh api" >&2; exit 91; }
|
|
if [[ "${2:-}" == graphql ]]; then
|
|
expected_query='query($owner:String!,$repo:String!,$number:Int!){repository(owner:$owner,name:$repo){pullRequest(number:$number){reviewDecision}}}'
|
|
[[ "$#" -eq 12 && "$3" == -f && "$4" == "query=$expected_query" &&
|
|
"$5" == -F && "$6" == owner=block &&
|
|
"$7" == -F && "$8" == repo=buzz &&
|
|
"$9" == -F && "${10}" == number=123 &&
|
|
"${11}" == --jq && "${12}" == '.data.repository.pullRequest' ]] || {
|
|
echo "GraphQL call does not match the deployed query contract" >&2; exit 92;
|
|
}
|
|
if [[ -n "${REVIEW_DECISION:-}" ]]; then printf '%s\n' "$REVIEW_DECISION"; else printf '%s\n' '{"reviewDecision":"APPROVED"}'; fi
|
|
elif [[ "$#" -eq 4 && "$2" == --paginate && "$3" == --slurp && "$4" == "repos/block/buzz/pulls/123/reviews?per_page=100&page=1" ]]; then
|
|
[[ "${GH_FAIL_REVIEWS:-false}" != true ]] || { echo "simulated reviews API failure" >&2; exit 94; }
|
|
if [[ -n "${REVIEWS:-}" ]]; then printf '%s\n' "$REVIEWS"; else printf '%s\n' '[[],[{"state":"APPROVED","commit_id":"head","author_association":"MEMBER"}]]'; fi
|
|
else
|
|
echo "unexpected or malformed gh call: $*" >&2
|
|
exit 95
|
|
fi
|
|
GH
|
|
chmod +x "$tmp/bin/gh"
|
|
|
|
run_authorization() {
|
|
(cd "$repo_root" && PATH="$tmp/bin:$PATH" GH_CALLS="$tmp/calls" GH_TOKEN=test \
|
|
GITHUB_REPOSITORY=block/buzz PR_NUMBER=123 PR_HEAD_SHA=head \
|
|
REVIEW_DECISION="${REVIEW_DECISION-}" REVIEWS="${REVIEWS-}" GH_FAIL_REVIEWS="${GH_FAIL_REVIEWS-false}" \
|
|
scripts/verify-desktop-release-authorization.sh)
|
|
}
|
|
|
|
: >"$tmp/calls"
|
|
run_authorization
|
|
! grep -Fq 'rule-suites' "$tmp/calls"
|
|
|
|
for invalid in \
|
|
'[[{"state":"APPROVED","commit_id":"stale","author_association":"MEMBER"}]]' \
|
|
'[[{"state":"APPROVED","commit_id":"head","author_association":"NONE"}]]' \
|
|
'[[{"state":"CHANGES_REQUESTED","commit_id":"head","author_association":"MEMBER"}]]'; do
|
|
: >"$tmp/calls"
|
|
if REVIEWS="$invalid" run_authorization >/dev/null 2>&1; then
|
|
echo "invalid approval was accepted: $invalid" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
|
|
: >"$tmp/calls"
|
|
if REVIEW_DECISION='{"reviewDecision":"CHANGES_REQUESTED"}' run_authorization >/dev/null 2>&1; then
|
|
echo "changes-requested review decision was accepted" >&2
|
|
exit 1
|
|
fi
|
|
|
|
: >"$tmp/calls"
|
|
if GH_FAIL_REVIEWS=true run_authorization >/dev/null 2>&1; then
|
|
echo "reviews API failure was ignored" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "desktop release authorization passed"
|