Repository navigation
fix(ng-dev/pr): harden CLA status check, automation target validation, TGP comment freshness, and log symlink guard - #4030
Open
josephperrott wants to merge 4 commits into
Conversation
…vent CheckRun status map overwrite
…mit message fixup skip
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request enhances pull request validation by ensuring that TESTED comments are fresh (created after the latest commit), preventing CheckRuns from overwriting failing CLA StatusContexts, and ensuring automation target label checks are not bypassed by commit message fixup labels. It also refactors the logging utility to securely handle symbolic links. The review feedback suggests keeping the comment creation date as a required property to avoid correctness bypasses, and explicitly handling cases where the comment creation date is missing during freshness checks to prevent stale comments from being incorrectly treated as fresh.
josephperrott
force-pushed
the
fix/pr-merge-validation-hardening
branch
from
October 9, 2026 20:30
88b5c9f to
52c2687
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Hardens PR merge validation and local CLI logging against edge-case status, label, comment timestamp, and symlink checks:
assertSignedCla&getStatusesForPullRequest):type === "status"inassertSignedClawhen verifyingcla/google.statusMapkeys ingetStatusesForPullRequestwithcheck:andstatus:and add the missingbreak;statement undercase "CheckRun":so aCheckRuncannot overwrite aStatusContextwith the same name.assertChangesAllowForTargetLabel):automationBotsauthor allowlist fortarget: automationbefore themerge: fix commit messageearly return.assertEnforceTested):committedDate/pushedDateand commentcreatedAtin GraphQL schemas and verify inpullRequestHasValidTestedCommentthatTESTED=comments from Googlers were created at or after the latest commit timestamp when timestamps are available..ng-dev.logguard (captureLogOutputForCommand):lstatSync(logFilePath, {throwIfNoEntry: false})?.isSymbolicLink()so dangling symlinks are also rejected before opening.ng-dev.log.