dependabot/fetch-metadata
2
0
Fork 0
mirror of https://github.com/dependabot/fetch-metadata.git synced 2026-03-13 18:17:13 -04:00
Code Issues Packages Projects Releases Wiki Activity

getMessage can skip commit verification checks

Browse Source
This commit is contained in:
Barry Gordon
2022-06-30 14:27:21 +01:00
parent bfac3fa29c
commit 29dc6db06e
2 changed files with 19 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/dependabot/verified_commits.test.ts
View File

@@ -70,6 +70,23 @@ test('it returns false if the commit is has no verification payload', async () =
expect(await getMessage(mockGitHubClient, mockGitHubPullContext())).toBe(false)
})
test('it returns the message if the commit is has no verification payload but verification is skipped', async () => {
nock('https://api.github.com').get('/repos/dependabot/dependabot/pulls/101/commits')
.reply(200, [
{
author: {
login: 'dependabot[bot]'
},
commit: {
message: 'Bump lodash from 1.0.0 to 2.0.0',
verification: null
}
}
])
expect(await getMessage(mockGitHubClient, mockGitHubPullContext(), true)).toEqual('Bump lodash from 1.0.0 to 2.0.0')
})
test('it returns false if the commit is not verified', async () => {
nock('https://api.github.com').get('/repos/dependabot/dependabot/pulls/101/commits')
.reply(200, [

4
src/dependabot/verified_commits.ts
View File

@@ -6,7 +6,7 @@ import https from 'https'
const DEPENDABOT_LOGIN = 'dependabot[bot]'
export async function getMessage (client: InstanceType<typeof GitHub>, context: Context): Promise<string | false> {
export async function getMessage (client: InstanceType<typeof GitHub>, context: Context, skipCommitVerification = false): Promise<string | false> {
core.debug('Verifying the job is for an authentic Dependabot Pull Request')
const { pull_request: pr } = context.payload
@@ -43,7 +43,7 @@ export async function getMessage (client: InstanceType<typeof GitHub>, context:
return false
}
if (!commit.verification?.verified) {
if (!skipCommitVerification && !commit.verification?.verified) {
// TODO: Promote to setFailed
core.warning(
"Dependabot's commit signature is not verified, refusing to proceed."