Global
/
vcpkg
mirror of https://github.com/microsoft/vcpkg.git
1
0
Fork 0
Code Activity

Don't compare against upstream for PR-against-PR in untrustedPR check (#52279) 

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This commit is contained in:
Billy O'Neal 2026-06-09 17:06:13 -07:00 committed by GitHub
parent 81fd6444aa
commit a0c1c9f584
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 24 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
.github/workflows/untrustedPR.yml vendored
View File

@ -67,16 +67,33 @@ jobs:
git add -u
git commit -m "tmp" --allow-empty
# reset the version database to the state of the merge base, so that we can check that the PR only adds one version and doesn't modify any existing versions
git restore --source=$merge_base --staged --worktree -- versions
git clean -fd -- versions
echo '{"default": {}}' > versions/baseline.json # to allow deindexing, let x-add-version completely regenerate the baseline json
#
# This "compare against upstream" behavior only makes sense when the PR targets the
# canonical microsoft/vcpkg repository. When a PR is opened against another PR (for
# example, a PR targeting a branch in a fork rather than microsoft/vcpkg), the merge
# base already contains the parent PR's in-progress version-database changes, so
# comparing against it would incorrectly flag the expected mutation of those
# not-yet-published versions. There is no reliable way to discover the ultimate
# upstream merge base in that situation, so instead we validate the version database
# against the incoming changes as-is: we still confirm the database is internally
# consistent (and updated) but we don't attempt the upstream comparison.
if [ "${{ github.event.pull_request.base.repo.full_name }}" = "microsoft/vcpkg" ]; then
version_db_reset_ref="$merge_base"
else
version_db_reset_ref="$incoming_branch_commit"
fi
reset_version_db() {
git restore --source="$version_db_reset_ref" --staged --worktree -- versions
git clean -fd -- versions
echo '{"default": {}}' > versions/baseline.json # to allow deindexing, let x-add-version completely regenerate the baseline json
}
reset_version_db
# check for version format errors separately by running x-add-version --all, recording problems it generates
./vcpkg x-add-version --all | grep -E '^warning:|instead of "version-string"' | tee .github-pr.version-string.out || true
# reset the version database again
git restore --source=$merge_base --staged --worktree -- versions
git clean -fd -- versions
echo '{"default": {}}' > versions/baseline.json
# check that the PR only adds one version and doesn't modify any existing versions, ignoring any of the warnings recorded into .github-pr.version-string.out
reset_version_db
# check that the version database is valid, ignoring any of the warnings recorded into .github-pr.version-string.out
# When targeting microsoft/vcpkg this additionally checks that the PR only adds one version and doesn't modify any existing versions.
./vcpkg x-add-version --all --skip-version-format-check | tee .github-pr.x-add-version.out || true
git add -A -- versions
git diff --cached "$incoming_branch_commit" -- versions > .github-pr.x-add-version.diff