timothy/ersatztv
1
0
Fork 0
Code Issues 57 Pull Requests 6 Actions Packages Projects Releases 9 Wiki Activity

[PROBE — DO NOT MERGE] ersatztv#672 experiment A: is a pull_request workflow definition head-resolved? #693

Closed
timothy wants to merge 1 commits from scratch/672-head-a into scratch/672-base-a
pull from: scratch/672-head-a
merge into: :scratch/672-base-a
Conversation 0 Commits 1 Files Changed 1
+17 -222
timothy commented 2026-07-28 21:06:30 +02:00
Owner
Copy Link
Copy Source

Throwaway probe PR for ersatztv#672 Done-when box 1. Do not merge; both branches are deleted after the result is read.

Base and head are scratch branches, not main. Both sides have docker-build.yml and pr-checks.yml removed so this exercises review-verdict.yml alone rather than a full build.

The head commit rewrites .gitea/workflows/review-verdict.yml. The rewritten copy posts a distinct probe context (review-verdict/h10-PROBE672) and deliberately never posts the real review-verdict/h10, so the experiment cannot forge a green on the required check.

Read the result as:

  • probe context present, h10 absent → the definition came from the HEAD (the #672 hole is real)
  • h10 present, probe context absent → the definition came from the BASE (not vulnerable)

Refs #672

**Throwaway probe PR for ersatztv#672 Done-when box 1. Do not merge; both branches are deleted after the result is read.** Base and head are scratch branches, not `main`. Both sides have `docker-build.yml` and `pr-checks.yml` removed so this exercises `review-verdict.yml` alone rather than a full build. The head commit rewrites `.gitea/workflows/review-verdict.yml`. The rewritten copy posts a **distinct probe context** (`review-verdict/h10-PROBE672`) and deliberately never posts the real `review-verdict/h10`, so the experiment cannot forge a green on the required check. Read the result as: - probe context present, `h10` absent → the definition came from the **HEAD** (the #672 hole is real) - `h10` present, probe context absent → the definition came from the **BASE** (not vulnerable) Refs #672
timothy added 1 commit 2026-07-28 21:06:31 +02:00
scratch(672): probe head A — rewrite review-verdict.yml in the PR itself
Review verdict / Set review-verdict status (pull_request) Successful in 2s
Details
review-verdict/h10-PROBE672 ersatztv#672 probe: posted by a HEAD-supplied workflow definition
Details
ccbc4abbe0 
Throwaway. Answers Done-when box 1: if this rewritten definition is what runs,
Gitea resolves a pull_request workflow definition from the PR head.

Posts a distinct probe context, never the real review-verdict/h10.
Not for merge.
timothy closed this pull request 2026-07-28 22:44:52 +02:00
timothy deleted branch scratch/672-head-a 2026-07-28 22:44:54 +02:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
ad-hoc
One-off / ad-hoc work not tracked by a dedicated issue
 api
REST API / HTTP endpoints
 bug
Something isn't working
 ci-cd
Build, test, deploy pipeline
 content
Channel content / schedules / playlists
 dependencies
Dependency updates (Renovate)
 enhancement
New feature or improvement
 frontend
ChicoryTV React SPA frontend
 in-progress
Claimed by an active session — do not pick up
 jellyfin
Jellyfin tuner / IPTV integration
 parked
Excluded from automatic queue pickup; work only when explicitly selected
 priority: high
priority: low
priority: medium
review
Adversarial review finding
 security
Security / vulnerability fix
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate timothy (Timothy)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: timothy/ersatztv#693