GitHub “allows” unauthorized users “merging” PRs, bypass write permission check?

Re:GitHub “allows” unauthorized users “merging” PRs, bypass ... by dnsmichi on Thursday August 25, 2022 @07:12PM (#32601230)

GitLab team member here. It seems related to the problem that you cannot open an empty PR https://stackoverflow.com/questions/46577500/why-cant-i-crea... and force overriding an old branch base is a workaround to land at an empty diff. Another workaround could be git commit —-allow-empty, making the GitHub UI think that no changes between branches is equal to the merged state.

The behavior is not reproducible in GitLab, where empty merge requests can be created, and remain in the open state, also with zero changes at some later point. Added in GitLab 9.2 as part of the issue to new branch and wip/draft merge request flow: https://gitlab.com/gitlab-org/gitlab-foss/-/issues/28558

[ Parent | on HN ]

Re:GitHub “allows” unauthorized users “merging” PRs, bypass ... by chrisfosterelli on Thursday August 25, 2022 @11:38PM (#32603094)

I think that Gitlab behaviour makes more intuitive sense. Thanks for chiming in.

[ Parent | on HN ]

Re:GitHub “allows” unauthorized users “merging” PRs, bypass ... by sighingnow on Thursday August 25, 2022 @10:59PM (#32602884)

Allowing "zero changes" state for a merge request does make sense, as during the development workflow developers may doing some rebase & force push work and they may forget commit changes after reset to main and before push to the pull requests.

Closing the "zero changes" merge request have confused in my previous experience when I continue to push re-added commits to the original pull request branch.

[ Parent | on HN ]