From 768dd07e0e0ca6ccd66f546640acb866d5bb0942 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 26 Jun 2026 14:10:01 +0900 Subject: [PATCH] Use checked subprocess calls in PR scheduler --- scripts/ci/pr_review_merge_scheduler.py | 18 +++++++++++++----- scripts/ci/test_strix_quick_gate.sh | 1 + 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/scripts/ci/pr_review_merge_scheduler.py b/scripts/ci/pr_review_merge_scheduler.py index b93ead9d9..a49b72a54 100644 --- a/scripts/ci/pr_review_merge_scheduler.py +++ b/scripts/ci/pr_review_merge_scheduler.py @@ -301,13 +301,21 @@ def run(args: Sequence[str], *, stdin: str | None = None) -> str: if isinstance(args, str) or not all(isinstance(arg, str) for arg in args): raise TypeError("run() requires a sequence of argv strings; shell command strings are not allowed") argv = list(args) - process = subprocess.run(argv, input=stdin, capture_output=True, text=True, shell=False) - if process.returncode != 0: + try: + process = subprocess.run( + argv, + input=stdin, + capture_output=True, + text=True, + shell=False, + check=True, + ) + except subprocess.CalledProcessError as exc: scrubbed_args = scrub_sensitive_data(' '.join(argv)) - scrubbed_stderr = scrub_sensitive_data(process.stderr or "") + scrubbed_stderr = scrub_sensitive_data(exc.stderr or "") raise RuntimeError( - f"Command failed ({process.returncode}): {scrubbed_args}\n{scrubbed_stderr}" - ) + f"Command failed ({exc.returncode}): {scrubbed_args}\n{scrubbed_stderr}" + ) from exc return process.stdout diff --git a/scripts/ci/test_strix_quick_gate.sh b/scripts/ci/test_strix_quick_gate.sh index dd9cbd352..46a74f4b4 100755 --- a/scripts/ci/test_strix_quick_gate.sh +++ b/scripts/ci/test_strix_quick_gate.sh @@ -820,6 +820,7 @@ assert_pr_review_merge_scheduler_uses_github_actions_bot_token() { assert_file_contains "$scheduler_file" "update-branch" "scheduler calls the GitHub update-branch API for outdated approved PRs" assert_file_contains "$scheduler_file" "expected_head_sha={head}" "scheduler guards branch updates with the current PR head SHA" assert_file_contains "$scheduler_file" "shell=False" "scheduler subprocess wrapper forbids shell command execution" + assert_file_contains "$scheduler_file" "check=True" "scheduler subprocess wrapper raises on failed commands" assert_file_contains "$REPO_ROOT/tests/test_pr_review_merge_scheduler.py" "test_run_passes_shell_metacharacters_as_plain_arguments" "scheduler tests prove branch-like shell metacharacters stay argv data" assert_file_contains "$scheduler_file" "dispatch_strix_evidence" "scheduler dispatches same-head Strix evidence before OpenCode review" assert_file_contains "$scheduler_file" "--security-workflow" "scheduler allows the canonical Strix workflow name to be configured"