Skip to content

fix(pull): re-evaluate review official flag on target branch change#38319

Open
bircni wants to merge 1 commit into
go-gitea:mainfrom
bircni:fix/pr-retarget-official-review
Open

fix(pull): re-evaluate review official flag on target branch change#38319
bircni wants to merge 1 commit into
go-gitea:mainfrom
bircni:fix/pr-retarget-official-review

Conversation

@bircni

@bircni bircni commented Jul 3, 2026

Copy link
Copy Markdown
Member

The official flag of a pull request review is computed against the target branch's protection rules at submit time and stored on the review record. ChangeTargetBranch updated the base branch but never re-evaluated it, so an official approval obtained against an unprotected branch could be retargeted onto a protected branch and satisfy its required approvals, bypassing the branch protection.

This re-evaluates the official flag of the latest approve/reject reviews against the new base branch whenever the target branch changes.

The official flag of a pull request review is computed against the target
branch's protection rules when the review is submitted and stored on the
review record. Changing the target branch did not re-evaluate it, so an
official approval obtained against an unprotected branch could be retargeted
onto a protected branch and satisfy its required approvals.

Re-evaluate the official flag of the latest approve/reject reviews against
the new base branch whenever the target branch changes.

Assisted-by: Claude:claude-opus-4-8
@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Jul 3, 2026
@bircni bircni added the backport/v1.27 This PR should be backported to Gitea 1.27 label Jul 3, 2026
Comment thread models/issues/review.go
return err
}
if official {
if _, err := db.Exec(ctx, "UPDATE `review` SET official=? WHERE id=?", true, review.ID); err != nil {

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why use direct update not builder? 🤔

@bircni bircni mentioned this pull request Jul 7, 2026
22 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport/v1.27 This PR should be backported to Gitea 1.27 lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. type/bug

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants