fix(ng-dev/pr): prevent CheckRun status map fallthrough and require CheckRun type in assertSignedCla

ng-dev/pr/common/fetch-pull-request.ts

@@ -249,17 +249,19 @@ export function getStatusesForPullRequest(
     .forEach((context) => {
       switch (context.__typename) {
         case 'CheckRun':
-          statusMap.set(context.name, {
+          statusMap.set(`check:${context.name}`, {
             type: 'check' as const,
             name: context.name,
             status: normalizeGithubCheckState(context.conclusion, context.status),
           });
+          break;
         case 'StatusContext':
-          statusMap.set(context.context!, {
+          statusMap.set(`status:${context.context!}`, {
             type: 'status' as const,
             name: context.context!,
             status: normalizeGithubStatusState(context.state!),
           });
+          break;
       }
     });
 

ng-dev/pr/common/test/common.spec.ts

@@ -15,7 +15,11 @@ import {GoogleSyncConfig} from '../../../utils/g3-sync-config.js';
 import {targetLabels} from '../labels/target.js';
 import {Log} from '../../../utils/logging.js';
 
-import {PullRequestFromGithub} from '../fetch-pull-request.js';
+import {
+  getStatusesForPullRequest,
+  PullRequestFromGithub,
+  PullRequestStatus,
+} from '../fetch-pull-request.js';
 import {mergeLabels} from '../labels/merge.js';
 import {requiresLabels} from '../labels/requires.js';
 
@@ -90,6 +94,82 @@ describe('pull request validation', () => {
     return configFileName;
   }
 
+  describe('assert-signed-cla', () => {
+    it('should pass when a CheckRun named cla/google is passing', async () => {
+      const config = createIsolatedValidationConfig({assertSignedCla: true});
+      const pr = createTestPullRequest();
+      pr.commits.nodes[1].commit.statusCheckRollup = {
+        state: 'SUCCESS',
+        contexts: {
+          nodes: [
+            {
+              __typename: 'CheckRun',
+              name: 'cla/google',
+              status: 'COMPLETED',
+              conclusion: 'SUCCESS',
+              completedAt: '2026-07-13T10:05:00Z',
+            } as any,
+          ],
+        },
+      };
+
+      const results = await assertValidPullRequest(pr, config, ngDevConfig, null, prTarget, git);
+      expect(results.length).toBe(0);
+    });
+
+    it('should fail when only a StatusContext named cla/google is passing', async () => {
+      const config = createIsolatedValidationConfig({assertSignedCla: true});
+      const pr = createTestPullRequest();
+      pr.commits.nodes[1].commit.statusCheckRollup = {
+        state: 'SUCCESS',
+        contexts: {
+          nodes: [
+            {
+              __typename: 'StatusContext',
+              context: 'cla/google',
+              state: 'SUCCESS',
+              createdAt: '2026-07-13T10:00:00Z',
+            } as any,
+          ],
+        },
+      };
+
+      const results = await assertValidPullRequest(pr, config, ngDevConfig, null, prTarget, git);
+      expect(results.length).toBe(1);
+      expect(results[0].message).toBe('CLA is not signed by the contributor.');
+    });
+
+    it('should not allow a CheckRun to overwrite a StatusContext with the same name', async () => {
+      const pr = createTestPullRequest();
+      pr.commits.nodes[1].commit.statusCheckRollup = {
+        state: 'FAILURE',
+        contexts: {
+          nodes: [
+            {
+              __typename: 'StatusContext',
+              context: 'cla/google',
+              state: 'FAILURE',
+              createdAt: '2026-07-13T10:00:00Z',
+            } as any,
+            {
+              __typename: 'CheckRun',
+              name: 'cla/google',
+              status: 'COMPLETED',
+              conclusion: 'SUCCESS',
+              completedAt: '2026-07-13T10:05:00Z',
+            } as any,
+          ],
+        },
+      };
+
+      const {statuses} = getStatusesForPullRequest(pr);
+      expect(statuses).toEqual([
+        {type: 'status', name: 'cla/google', status: PullRequestStatus.FAILING},
+        {type: 'check', name: 'cla/google', status: PullRequestStatus.PASSING},
+      ]);
+    });
+  });
+
   describe('assert-allowed-target-label', () => {
     const fakeReleaseTrains = {isFeatureFreeze: () => false} as any;
 

ng-dev/pr/common/validation/assert-signed-cla.ts

@@ -24,8 +24,8 @@ export const signedClaValidation = createPullRequestValidation(
 
 class Validation extends PullRequestValidation {
   assert(pullRequest: PullRequestFromGithub) {
-    const passing = getStatusesForPullRequest(pullRequest).statuses.some(({name, status}) => {
-      return name === 'cla/google' && status === PullRequestStatus.PASSING;
+    const passing = getStatusesForPullRequest(pullRequest).statuses.some(({type, name, status}) => {
+      return type === 'check' && name === 'cla/google' && status === PullRequestStatus.PASSING;
     });
 
     if (!passing) {