From d83a14ad374b0bf2c55120842720c315cd9a4746 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 29 Jun 2026 18:30:27 +0900 Subject: [PATCH] fix: use PR base SHA for manual Strix targets --- .github/workflows/strix.yml | 2 +- scripts/ci/test_strix_quick_gate.sh | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/strix.yml b/.github/workflows/strix.yml index 6b1ba6528..5f0054832 100644 --- a/.github/workflows/strix.yml +++ b/.github/workflows/strix.yml @@ -141,7 +141,7 @@ jobs: env: GH_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN || github.token }} REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.event.inputs.target_repository || github.repository }} - TARGET_WORKSPACE_SHA: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.sha }} + TARGET_WORKSPACE_SHA: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.sha || github.event.inputs.pr_base_sha || github.sha }} run: | set -euo pipefail trusted_workspace="$RUNNER_TEMP/trusted-workspace" diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index c68becbfb..e0d6367c5 100755 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -122,6 +122,7 @@ assert_strix_workflow_pr_trigger_hardened() { assert_file_contains "$workflow_file" 'REPOSITORY: ${{ github.event.pull_request.base.repo.full_name || github.event.inputs.target_repository || github.repository }}' "strix manual dispatch fetches target repository data instead of the central .github repo" assert_file_contains "$workflow_file" 'GH_TOKEN: ${{ secrets.OPENCODE_APPROVE_TOKEN || github.token }}' "strix manual dispatch can use the cross-repo approval token to read private target repositories" assert_file_contains "$workflow_file" "TARGET_WORKSPACE_SHA" "strix workflow pins target workspace SHA" + assert_file_contains "$workflow_file" "github.event.inputs.pr_base_sha || github.sha" "strix manual dispatch uses the target PR base SHA instead of the central .github workflow SHA" assert_file_contains "$workflow_file" "TRUSTED_WORKSPACE=\$trusted_workspace" "strix workflow exports a trusted workspace path" assert_file_contains "$workflow_file" "git -C \"\$TRUSTED_WORKSPACE\"" "strix workflow runs git only inside trusted workspace" assert_file_contains "$workflow_file" 'working-directory: ${{ runner.temp }}/trusted-workspace' "strix workflow executes privileged steps from the trusted workspace"