You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
~/projects/oss/codeowners-validator-issue-demo (main) $ cat CODEOWNERS
# Docs https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
# The `docs/*` pattern will match files like
# `docs/getting-started.md` but not further nested files like
# `docs/build-app/troubleshooting.md`.
# docs/* docs@example.com
/packages/demo/* @iamstarkov
# In this example, @doctocat owns any files in the build/logs
# directory at the root of the repository and any of its
# subdirectories.
# /build/logs/ @doctocat
/packages/demo/src/owned @iamstarkov
# Current configuration leaves files in /packages/demo/src/not-owned folder not owned, but validator fails to throw an error
# /packages/demo/src/not-owned @iamstarkov
The problem with this action is that despite /packages/demo/src/not-owned is not owned, because /packages/demo/*doesn't provide ownership for nested files, codeowners-validator action doesn't fail the "not owned" check.
And wildcard pattern misinterpretation most likely is the root cause, because if you remove it, action does recognise the problem and fails the check.
Expected result
given original file structure and codeowners configuration from the description or from the main branch of the demo repo, then not owned check should fail.
Maybe other semantic rules are worth to be checked too.
Actual result
clearly not owned files don't make the check fail.
However, this path traversal is quite tricky and I wanted to do more testing to do not introduce a new bug instead. I will add a prio on it and try to get it merge soon 👍 .
Description
Let's say you have the repository with the given file structure:
and given CODEOWNERS file:
The problem with this action is that despite
/packages/demo/src/not-owned
is not owned, because/packages/demo/*
doesn't provide ownership for nested files, codeowners-validator action doesn't fail the "not owned" check.And wildcard pattern misinterpretation most likely is the root cause, because if you remove it, action does recognise the problem and fails the check.
Expected result
given original file structure and codeowners configuration from the description or from the main branch of the demo repo, then
not owned
check should fail.Maybe other semantic rules are worth to be checked too.
Actual result
clearly not owned files don't make the check fail.
Steps to reproduce
see demo repo for reproduction https://github.com/iamstarkov/codeowners-validator-issue-demo/
and 1st PR too iamstarkov/codeowners-validator-issue-demo#1
Troubleshooting
I don't know what to put here
The text was updated successfully, but these errors were encountered: