From 69fceafb5d4734ebbf780c55d7384ae2cf63af67 Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Mon, 5 Oct 2026 03:00:10 +0200
Subject: [PATCH] fix(ci): limit the fingerprint shortcut to branches of this
 repository

The duplicate check accepted any open PR whose head branch started with
the dedupe prefix and ended in the fingerprint of the fresh proposal. The
listing also returns PRs from forks, and the fingerprint can be derived
from public data, so a fork PR with such a branch name would have made the
bot skip its own update PR without carrying the change.

The shortcut now only applies to PRs whose head branch lives in this
repository, which only accounts with write access can create. A fork PR
is still compared by the content of its head, as before.

Raised by the CodeRabbit review of PR #781.

Refs #780

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 scripts/github/update/open/pr.sh              |  8 +++--
 .../scripts/github/update/open/test_pr.py     | 29 +++++++++++++++++--
 2 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/scripts/github/update/open/pr.sh b/scripts/github/update/open/pr.sh
index 83edcfd089..c99fa9170f 100755
--- a/scripts/github/update/open/pr.sh
+++ b/scripts/github/update/open/pr.sh
@@ -70,8 +70,8 @@ mapfile -t OPEN_PRS < <(
 		--state open \
 		--base "${UPDATE_BASE_BRANCH}" \
 		--limit 100 \
-		--json number,headRefName \
-		--jq ".[] | select(.headRefName | startswith(\"${UPDATE_DEDUPE_PREFIX}\")) | \"\(.number)\t\(.headRefName)\""
+		--json number,headRefName,isCrossRepository \
+		--jq ".[] | select(.headRefName | startswith(\"${UPDATE_DEDUPE_PREFIX}\")) | \"\(.number)\t\(.isCrossRepository)\t\(.headRefName)\""
 )
 
 DUPLICATE_PR=""
@@ -79,7 +79,9 @@ for entry in "${OPEN_PRS[@]}"; do
 	[[ -z "${entry}" ]] && continue
 	pr_num="${entry%%$'\t'*}"
 	pr_branch="${entry##*$'\t'}"
-	if [[ "${pr_branch}" == *"-${LOCAL_FP:0:7}" ]]; then
+	pr_cross_repo="${entry#*$'\t'}"
+	pr_cross_repo="${pr_cross_repo%%$'\t'*}"
+	if [[ "${pr_cross_repo}" == "false" && "${pr_branch}" == *"-${LOCAL_FP:0:7}" ]]; then
 		echo "  open PR #${pr_num} (${pr_branch}): branch name carries this fingerprint"
 		DUPLICATE_PR="${pr_num}"
 		break
diff --git a/tests/unit/python/scripts/github/update/open/test_pr.py b/tests/unit/python/scripts/github/update/open/test_pr.py
index 6729c3e1e5..bf7f47b3c0 100644
--- a/tests/unit/python/scripts/github/update/open/test_pr.py
+++ b/tests/unit/python/scripts/github/update/open/test_pr.py
@@ -12,7 +12,7 @@ SCRIPT = PROJECT_ROOT / "scripts" / "github" / "update" / "open" / "pr.sh"
 PINNED_FILE = "pin.txt"
 GH_STUB = """#!/usr/bin/env bash
 if [[ "$1 $2" == "pr list" ]]; then
-	printf '7\\t%s\\n' "${GH_STUB_BRANCH}"
+	printf '7\\t%s\\t%s\\n' "${GH_STUB_CROSS_REPO}" "${GH_STUB_BRANCH}"
 fi
 """
 
@@ -76,11 +76,23 @@ class UpdatePrFixture:
         blob = self.git("hash-object", PINNED_FILE)
         return self.git("hash-object", "--stdin", stdin=f"{blob}\t{PINNED_FILE}\n")
 
-    def open_pr(self, open_branch: str) -> subprocess.CompletedProcess:
+    def open_pr(
+        self, open_branch: str, cross_repo: bool = False
+    ) -> subprocess.CompletedProcess:
+        """Run the script while ``gh`` lists one open PR.
+
+        Args:
+            open_branch: head branch name of that PR.
+            cross_repo: whether that PR comes from a fork.
+        """
         return subprocess.run(
             ["bash", str(SCRIPT)],
             cwd=self.repo,
-            env={**self.env, "GH_STUB_BRANCH": open_branch},
+            env={
+                **self.env,
+                "GH_STUB_BRANCH": open_branch,
+                "GH_STUB_CROSS_REPO": str(cross_repo).lower(),
+            },
             capture_output=True,
             text=True,
             check=False,
@@ -97,6 +109,17 @@ class TestUpdatePrDedupe(unittest.TestCase):
             self.assertIn("Open PR #7 already carries this exact change", result.stdout)
             self.assertNotIn("Pushing change to branch", result.stdout)
 
+    def test_fork_branch_with_the_same_suffix_is_not_a_duplicate(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp:
+            fixture = UpdatePrFixture(tmp)
+            suffix = fixture.fingerprint()[:7]
+            result = fixture.open_pr(f"update/pins-20251231-{suffix}", cross_repo=True)
+            self.assertNotIn("already carries this exact change", result.stdout)
+            self.assertIn(
+                f"Pushing change to branch update/pins-20260101-{suffix}",
+                result.stdout,
+            )
+
     def test_branch_of_another_proposal_is_not_a_duplicate(self) -> None:
         with tempfile.TemporaryDirectory() as tmp:
             fixture = UpdatePrFixture(tmp)