80a6014243
Co-authored-by: ronnie_zheng <zl19940307@163.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
59 lines
1.7 KiB
Python
Executable File
59 lines
1.7 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Check that required status check job names are unique across workflows.
|
|
|
|
Duplicate job names on the same commit allow a passing job in one workflow
|
|
to satisfy a required status check meant for a different workflow, bypassing
|
|
branch protection.
|
|
|
|
See: https://github.com/sgl-project/sglang/pull/20208 for an example where
|
|
pr-test-npu.yml's "pr-test-finish" job (which passed) caused GitHub to treat
|
|
the required "pr-test-finish" check (from pr-test.yml, which failed) as met.
|
|
"""
|
|
|
|
import glob
|
|
import sys
|
|
from collections import defaultdict
|
|
|
|
import yaml
|
|
|
|
# Job names used as required status checks in branch protection.
|
|
# These MUST be unique across all workflow files.
|
|
PROTECTED_JOB_NAMES = {
|
|
"pr-test-finish",
|
|
"lint",
|
|
}
|
|
|
|
|
|
def main() -> int:
|
|
workflows = sorted(glob.glob(".github/workflows/*.yml"))
|
|
job_to_files: dict[str, list[str]] = defaultdict(list)
|
|
|
|
for wf in workflows:
|
|
with open(wf, encoding="utf-8") as f:
|
|
data = yaml.safe_load(f)
|
|
if not data or "jobs" not in data:
|
|
continue
|
|
for job in data["jobs"]:
|
|
if job in PROTECTED_JOB_NAMES:
|
|
job_to_files[job].append(wf)
|
|
|
|
duplicates = {job: files for job, files in job_to_files.items() if len(files) > 1}
|
|
|
|
if not duplicates:
|
|
return 0
|
|
|
|
print("ERROR: Required status check job names must be unique across workflows.")
|
|
print("Duplicates allow branch protection bypass via auto-merge.\n")
|
|
for job, files in sorted(duplicates.items()):
|
|
print(f" Job '{job}' appears in:")
|
|
for f in files:
|
|
print(f" - {f}")
|
|
print()
|
|
|
|
print("Fix: rename the job in non-primary workflows to avoid collision.")
|
|
return 1
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|