Skip to content

fix: use branch ref instead of SHA for actions/checkout@v7 - #325

Open
hudeng-go wants to merge 1 commit into
linuxdeepin:masterfrom
hudeng-go:fix/checkout-v7-sha-ref
Open

fix: use branch ref instead of SHA for actions/checkout@v7#325
hudeng-go wants to merge 1 commit into
linuxdeepin:masterfrom
hudeng-go:fix/checkout-v7-sha-ref

Conversation

@hudeng-go

@hudeng-go hudeng-go commented Jul 29, 2026

Copy link
Copy Markdown

问题

actions/checkout@v7 在使用 ref: ${{ github.event.pull_request.head.sha }} 时存在缺陷:

  1. getRefSpec 对 SHA 只 fetch 单个 commit,不拉取完整分支历史
  2. testRef 对 SHA 永远返回 true,不会触发第二次 targeted fetch
  3. 当 PR 分支使用 git commit --amend 后,新的 commit SHA 不在本地 git 历史中,导致后续 git diff base...head 等命令失败

详情见 #318 的 CI 失败记录。

修复

ref 参数从裸 SHA 改为 refs/heads/<branch> 格式,使 getRefSpecForAllHistory 能正确处理分支 ref,testRef 也能在 force-push 后正确检测到 ref 变化并触发第二次 fetch。

变更文件

  • .github/workflows/cppcheck.ymlref: ${{ github.event.pull_request.head.sha }}ref: refs/heads/${{ github.head_ref }}

其他受影响的工作流

linuxdeepin/.github 仓库中的多个 reusable workflow 也存在同样问题,需要单独修复:

  • .github/workflows/license-check.yml(3 处)
  • .github/workflows/commitlint.yml
  • .github/workflows/doc-check.yml
  • .github/workflows/dtk-unittest.yml
  • .github/workflows/build-distribution.yml(4 处)
  • .github/workflows/auto-tag.yml
  • workflow-templates/cppcheck.yml

这些已准备好 patch,需要另提 PR 到 linuxdeepin/.github 仓库。

Summary by Sourcery

Bug Fixes:

  • Fix cppcheck workflow failures when pull request commits are amended or force-pushed by using the branch ref instead of the head SHA for actions/checkout.

Using a bare SHA as the ref parameter in actions/checkout@v7 causes
the getRefSpec function to only fetch the specific commit instead
of the full branch. This is problematic when git commit --amend is
used on a PR branch, because the amended commit's SHA is not present
in the initial fetch, and testRef() always returns true for SHA refs
(never triggering the second targeted fetch).

The fix is to use refs/heads/<branch> instead of the bare SHA, which
makes getRefSpecForAllHistory properly handle the ref and allows
testRef() to correctly detect when a force-push has moved the branch.

Log: 修复 actions/checkout@v7 在 git commit --amend 后无法正确获取
      PR 分支最新 commit 的问题
@deepin-ci-robot

Copy link
Copy Markdown

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: hudeng-go

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry @hudeng-go, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

@sourcery-ai

sourcery-ai Bot commented Jul 29, 2026

Copy link
Copy Markdown
Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the cppcheck GitHub Actions workflow to checkout the pull request branch by ref name instead of a specific commit SHA, ensuring full branch history is fetched and avoiding failures after amended/force-pushed commits.

Sequence diagram for updated checkout behavior in cppcheck workflow

sequenceDiagram
  actor Developer
  participant GitHubActionsRunner as GitHubActionsRunner
  participant actions_checkout_v7 as actions_checkout_v7
  participant git as git

  Developer->>GitHubActionsRunner: open pull_request
  GitHubActionsRunner->>actions_checkout_v7: uses actions/checkout@v7
  GitHubActionsRunner->>actions_checkout_v7: with ref=refs/heads/${{ github.head_ref }}

  actions_checkout_v7->>git: getRefSpecForAllHistory(refs/heads/${{ github.head_ref }})
  git-->>actions_checkout_v7: full branch history

  actions_checkout_v7->>git: testRef(refs/heads/${{ github.head_ref }})
  alt [branch force-pushed]
    git-->>actions_checkout_v7: ref changed
    actions_checkout_v7->>git: getRefSpecForAllHistory(refs/heads/${{ github.head_ref }})
  else [no change]
    git-->>actions_checkout_v7: ref unchanged
  end

  GitHubActionsRunner->>git: git diff base...head
  git-->>GitHubActionsRunner: diff succeeds with full history
Loading

File-Level Changes

Change Details Files
Use branch ref instead of commit SHA for actions/checkout to ensure full PR branch history is available.
  • Change checkout ref from pull_request.head.sha to refs/heads/${{ github.head_ref }} so actions/checkout fetches the full branch and can refetch after force pushes.
  • Keep existing checkout options (persist-credentials and allow-unsafe-pr-checkout) unchanged to preserve current behavior aside from ref selection.
.github/workflows/cppcheck.yml

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@deepin-ci-robot

Copy link
Copy Markdown

deepin pr auto review

★ 总体评分:40分

■ 【总体评价】

代码修改了 GitHub Actions 的代码检出引用方式,将 commit SHA 改为分支名,引入了 CI 环境的 TOCTOU 漏洞。
逻辑正确但因存在 CI 检查绕过风险扣分,且因高危漏洞触发评分上限。

■ 【详细分析】

  • 1.语法逻辑(完全正确)✓

修改了 .github/workflows/cppcheck.yml 中 actions/checkout 步骤的 ref 参数,YAML 语法正确,GitHub Actions 表达式 github.head_ref 在 pull_request 事件下可用。
潜在问题:无
建议:无

  • 2.代码质量(良好)✓

代码结构清晰,修改意图明确,符合 YAML 缩进规范。
潜在问题:无
建议:无

  • 3.代码性能(无性能问题)✓

修改仅影响检出策略,对执行性能无影响。
潜在问题:无
建议:无

  • 4.代码安全(存在 1 个安全漏洞)✕

漏洞对比统计:新增漏洞 1 个,减少漏洞 0 个,持平 0 个
使用分支引用替代 commit SHA 检出代码,破坏了 CI 检查的不可变性和确定性,攻击面位于工作流执行期间的代码检出阶段。

  • 安全漏洞1(无):高危 在 .github/workflows/cppcheck.yml 中,将 ref 从 ${{ github.event.pull_request.head.sha }} 修改为 refs/heads/${{ github.head_ref }},引入了 TOCTOU(Time of Check to Time of Use)漏洞。触发方式为攻击者在提交 PR 触发 CI 后,在 CI 运行期间向源分支强制推送新的 commit。危害是 CI 将检出最新被篡改的代码进行检查或后续部署,导致安全检查被绕过或恶意代码被引入。 ——非常重要

  • 建议:恢复使用 ${{ github.event.pull_request.head.sha }} 以确保检出触发工作流时的确切代码状态。

■ 【改进建议代码示例】

diff --git a/.github/workflows/cppcheck.yml b/.github/workflows/cppcheck.yml
index 5ae77f4a..85544fae 100644
--- a/.github/workflows/cppcheck.yml
+++ b/.github/workflows/cppcheck.yml
@@ -16,7 +16,7 @@ jobs:
       - run: export
       - uses: actions/checkout@v7
         with:
-          ref: refs/heads/${{ github.head_ref }}
+          ref: ${{ github.event.pull_request.head.sha }}
           persist-credentials: false
           allow-unsafe-pr-checkout: true
       - uses: linuxdeepin/action-cppcheck@main

@deepin-ci-robot

Copy link
Copy Markdown

@hudeng-go: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
github-pr-review-ci bed5a03 link true /test github-pr-review-ci

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants