fix(gitter): Update affected commit logic when introduced=0#5147
fix(gitter): Update affected commit logic when introduced=0#5147Ly-Joey wants to merge 6 commits intogoogle:masterfrom
Conversation
Now only roots that are ancestors of provided fix commits will be added to affected commit traversal. If no fix exists, all roots will be added (original behaviour).
go/cmd/gitter/repository.go
Outdated
| introduced = append(introduced, newIntro...) | ||
| } | ||
|
|
||
| return introduced, allFixes, newIntroHashes, newFixedHashes |
There was a problem hiding this comment.
nit: these variables are a bit confusing.
are the hashes the same commits as the other variable?
e.g. is introduced=newIntroHashes
and allFixes=newFixedHashes?
If not can we make them the same?
And if they are the same, can we update the name to make it clearer
There was a problem hiding this comment.
They're not really the same
introduced = intro from input + cherrypicked intro + roots resolved from intro=0
allFixes = fixed from input + children of lastAffected + cherrypicked fixed
The new___Hashes contains only the cherrypicked commit hashes (string) and it was added in #5101 because worker needs them to update the record (with minimal change to existing logic).
I've renamed new___Hashes -> cherrypicked___Hashes in an attempt to make it clearer(?)
3 participants
When
introduced=0, we now only evaluate root commits that are ancestors of a fixed or last_affected commit. This prevents disjoint trees in multi-root repos from being incorrectly marked as fully affected when a vuln is only applicable to the tree with the fix.If no fix / last affected commit,
introduced=0still defaults to evaluating all roots.Also extracted the event parsing and cherry-pick expansion into a
resolveEventshelper function for clarity.