fix(release): ignore fork PRs in dev bump guard

[luvs01]

Summary

Prevent fork-origin pull requests from satisfying the dev version-bump workflow's repository-owned idempotency guard.

Problem

The release workflow checks for an existing bump pull request with:

gh pr list --base dev --head "${branch}"

The --head filter matches pull requests by branch name, including heads from forks. Because the generated codex/dev-version-${NEXT_VERSION} name is predictable, a fork pull request using that name can make the check exit early even though the repository-owned bump has not been queued.

Changes

• Query the repository pulls endpoint with state, base, and repository-owner-qualified head filters applied on the server.
• Limit the already-scoped response to one result instead of filtering a paginated client-side list.
• Add regression coverage that pins the server-side owner filter and rejects the prior client-side query.

Verification

• bun test tests/bump-dev-version.test.ts — 10 pass, 1 platform-conditional skip, 0 fail, 39 assertions.
• Live GitHub API readback confirmed that a fork PR can share the branch name while an owner-qualified head selects only the repository-owned branch.
• Exact rebase readback confirmed HEAD e0491c4 has current dev 8b60e4c as its parent and preserves the reviewed patch ID cc096d7.
• git diff HEAD^..HEAD --check — clean.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

No documentation or release-note change is needed because this is a release-workflow guard correction with focused regression coverage.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: .github/workflows/dev-version-bump.yml.

[github-actions]

⏳ DRAFT

• review readiness checklist open (0/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[luvs01]

@Ingwannu Could you review this focused release-workflow guard and apply the maintainer-sponsored label if the boundary is acceptable? The change only filters the existing PR idempotency query by isCrossRepository and adds a regression. Focused Bun verification is 10 pass, 1 platform-conditional skip, 0 fail; live readback confirmed fork heads are excluded while same-repository heads remain counted; an independent focused review found no permissions, quoting, fail-open, or TOCTOU regression.

[lidge-jun]

리뷰 · 우선순위 63 / 80

설명

이 PR은 dev 버전 bump 워크플로의 “이미 bump PR이 열려 있으면 아무것도 하지 않는다”는 멱등 가드가, 같은 이름의 포크 PR에도 속아 early-exit 할 수 있는 구멍을 막는다. 지금 dev HEAD ff1ac6b8c의 .github/workflows/dev-version-bump.yml은 대략 이렇게 센다: gh pr list --base dev --head "${branch}" --state open --json number --jq 'length'. 여기서 ${branch}는 codex/dev-version-${NEXT_VERSION}처럼 예측 가능하다. gh pr list --head는 브랜치 이름만 보므로, 포크가 같은 이름으로 PR을 열어 두면 길이이 0이 아니게 되어 저장소 소유 bump가 조용히 생략될 수 있다.

패치는 isCrossRepository를 같이 받아 [.[] | select(.isCrossRepository == false)] | length로 같은 저장소 헤드만 센다. 테스트는 워크플로 파일에 그 쿼리 문자열이 들어 있는지 고정한다. 방향은 맞다. 릴리즈 자동화·워크플로 표면이라 intake: hygiene-blocked / unsponsored_surface가 걸린 것도 MAINTAINERS.md 규칙과 일치한다. draft이고 체크리스트가 비어 있으며 review-ready가 없다. enforce-target도 실패한 상태다.

dev가 방금 Meta 직접 프로바이더(#3321)를 받은 뒤라 버전 bump 멱등은 릴리즈 열차와 직접 맞닿아 있다. 제품 코드는 안 건드린다. types/config 분할과 무관하다. 다만 메인테이너 스폰서 없이 머지할 표면이 아니다.

.github/workflows/dev-version-bump.yml open_prs 가드 - isCrossRepository == false 필터는 “포크가 예측 가능한 bump 브랜치 이름으로 가드를 선점”하는 실패 모드를 직접 제거한다. 주석도 그 위협을 설명한다.

tests/bump-dev-version.test.ts - 워크플로 소스 문자열 containment라 동작 통합 테스트는 아니다. 이 저장소의 다른 워크플로 가드 테스트 스타일과는 같고, 쿼리가 되돌아가면 깨진다. gh 필드명이 바뀌는 날까지는 버티지만, mock list fixture까지는 없다.

draft + 미체크 체크리스트 + hygiene unsponsored_surface - 코드 리뷰와 별개로 게이트가 막아 둔 상태다. 내용이 맞아도 스폰서 라벨과 ready 전환이 필요하다.

메인테이너의 판단이 필요한 지점

• 보안/릴리즈 리뷰 후 maintainer-sponsored를 붙일지 (워크플로 표면이라 규칙상 필요)
• draft를 유지한 채 스폰서만 할지, 체크리스트를 채우고 ready로 올린 뒤 머지할지
• 문자열 containment 테스트로 충분한지, 아니면 isCrossRepository fixture JSON을 한 줄 넣는 단위 테스트를 더 요구할지

너의 추천
내용은 머지할 가치가 있다. 예측 가능한 bump 브랜치 이름을 포크가 가로채 early-exit 하는 것은 실제 릴리즈 멱등 버그 후보다. 다만 지금 상태로는 머지하지 말고, 메인테이너가 워크플로 diff를 확인한 뒤 maintainer-sponsored를 붙이고, 체크리스트를 채운 다음 draft를 해제한 뒤에 랜딩하는 편이 맞다. 테스트 강화는 필수는 아니다.

이 댓글은 grok-bot이 작성했습니다

[luvs01]

@Ingwannu Correction to my sponsorship note above: the current patch no longer uses isCrossRepository. It now scopes the server-side pulls query with base=dev and the repository-owner-qualified head=${owner}:${branch}, then limits the response to one result. I rebased the unchanged patch onto current dev (8b60e4c; PR head e0491c4); the focused test remains 10 pass, 1 platform-conditional skip, 0 fail, and git diff HEAD^..HEAD --check is clean. The sponsorship request is unchanged.

[lidge-jun]

Triaged in the 260904 bug-backlog closeout, and sponsored as maintainer.

The fix is correct. The old branch-name-only gh pr list lookup could be satisfied by a same-named branch on a fork, so a fork PR could make the repository-owned idempotency guard believe a bump already existed. Qualifying head with the repository owner in the server-side query fixes that at the source, and per_page=1 is safe once the filter is exact.

Both failing checks report unsponsored_surface for one reason: .github/workflows/dev-version-bump.yml is a release-automation surface, which AGENTS.md routes to explicit maintainer security review. I have reviewed it as that reviewer. The change adds no new permissions, introduces no new secret usage, pins no mutable third-party action, and narrows rather than widens what the guard accepts. I am applying maintainer-sponsored on that basis.

Rebase onto current dev and tick the readiness boxes, and the two checks should go green on the next run.