Repository navigation
fix(ci): stop trusting a merge queue title from a fork - #1881
Merged
mergify[bot] merged 1 commit intoOct 5, 2026
Conversation
`mergify ci git-refs` and `ci scopes` read a pull request body as the engine's merge queue metadata on the title prefix `merge queue: ` alone. The title is the author's to pick, so a fork's pull request could name its own head as `checking_base_sha`: the diff came out empty, every scope read false, and `source: merge_queue` force-enabled the merge-queue scope, with CI green. `pull_request_target` runs that path too. The engine always opens its drafts from a branch of the base repository, so merge queue metadata is now only read when the pull request's head and base live in the same repository (compared by id). That gates the git note as well as the body: a workflow that checks a fork out as `origin` fetches the fork's note, which the fork's author writes. A fork, a deleted fork's head, or a payload without repository ids falls through to the pull request base, with a warning when the title asked for the body. What this does not close: anyone who can read the repository can open a pull request from a branch someone else pushed there and write its title and body. The code under test is then still a writer's. The other signals the ticket listed do not hold up: the branch prefix is `queue_branch_prefix` and the author is `draft_bot_account`, both configurable. Dropping the body path for the git note only was rejected too: the engine writes the note best effort and swallows push failures, and a clone that cannot fetch notes would lose the merge-queue scope on every draft. Fixes MRGFY-8854 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Change-Id: I19f70a5d13a2672ad13b1a4d66f54d132c3ad32e
Contributor
Merge Protections🟢 All 6 merge protections satisfied — ready to merge. Show 6 satisfied protections🟢 🤖 Continuous Integration
🟢 👀 Review Requirements
🟢 Enforce conventional commitMake sure that we follow https://www.conventionalcommits.org/en/v1.0.0/
🟢 🔎 Reviews
🟢 📕 PR description
🟢 🚦 Auto-queueWhen all merge protections are satisfied, this pull request will be queued automatically. |
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The repository-origin gate consistently covers both metadata sources with appropriate fallback behavior and focused tests.
Review effort: Balanced
Findings: None
What changed in this PR
Hardens merge-queue metadata detection by trusting only pull requests whose head and base repository IDs match.
Changes:
- Adds repository identity data and same-repository validation.
- Gates body and git-note metadata extraction.
- Adds regression coverage for forked and missing-repository payloads.
| File | Description |
|---|---|
queue_metadata.rs |
Rejects untrusted metadata bodies. |
github_event.rs |
Models repository IDs and validates origin. |
git_refs.rs |
Gates git notes and adds security regression tests. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
sileht
marked this pull request as ready for review
October 5, 2026 14:18
JulianMaurin
approved these changes
Oct 5, 2026
remyduthu
approved these changes
Oct 5, 2026
Contributor
Merge Queue Status
This pull request spent 9 minutes 21 seconds in the queue, including 8 minutes 53 seconds running CI. Required conditions to merge
|
This was referenced Oct 5, 2026
mergify
Bot
deleted the
devs/sileht/mrgfy-8854-mq-title-spoofing/stop-trusting-merge-queue-title-fork--19f70a5d
branch
October 5, 2026 15:13
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
mergify ci git-refsandci scopesread a pull request body as theengine's merge queue metadata on the title prefix
merge queue:alone.The title is the author's to pick, so a fork's pull request could name
its own head as
checking_base_sha: the diff came out empty, every scoperead false, and
source: merge_queueforce-enabled the merge-queuescope, with CI green.
pull_request_targetruns that path too.The engine always opens its drafts from a branch of the base repository,
so merge queue metadata is now only read when the pull request's head
and base live in the same repository (compared by id). That gates the
git note as well as the body: a workflow that checks a fork out as
originfetches the fork's note, which the fork's author writes. A fork,a deleted fork's head, or a payload without repository ids falls through
to the pull request base, with a warning when the title asked for the
body.
What this does not close: anyone who can read the repository can open a
pull request from a branch someone else pushed there and write its title
and body. The code under test is then still a writer's.
The other signals the ticket listed do not hold up: the branch prefix is
queue_branch_prefixand the author isdraft_bot_account, bothconfigurable. Dropping the body path for the git note only was rejected
too: the engine writes the note best effort and swallows push failures,
and a clone that cannot fetch notes would lose the merge-queue scope on
every draft.
Fixes MRGFY-8854
Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com