From e7804286db15fd0b296b58e64ed3f181a03f4b44 Mon Sep 17 00:00:00 2001 From: Michael Daniels Date: Sat, 1 Aug 2026 20:28:37 -0400 Subject: [PATCH] ci/github-script/get-pr-commit-details: output file list for merge commits Fixes a bug that was originally found by Claude and reported to the NixOS security team by Anthropic as a security issue. Previously, the file list was never output for merge commits. This could have allowed someone who buried an edit to a file that shouldn't be edited manually in a merge commit to not trigger the check. It isn't a security issue, though, because the manual-file-edits check is not a security boundary (just a friendly reminder to committers). Anthropic report ID: ANT-2026-223Q3FSE --- ci/github-script/get-pr-commit-details.js | 1 + 1 file changed, 1 insertion(+) diff --git a/ci/github-script/get-pr-commit-details.js b/ci/github-script/get-pr-commit-details.js index b268e7cf6202..5841bb8177eb 100644 --- a/ci/github-script/get-pr-commit-details.js +++ b/ci/github-script/get-pr-commit-details.js @@ -84,6 +84,7 @@ async function getCommitDetailsForPR({ core, pr, repoPath }) { 'log', '--format=%s\t%aN\t%aE\t%cN\t%cE', '--name-only', + '-m', '-1', sha, ],