Merge pull request #33 from actions/cassiomarques/scope-push-pr-lookup

Prevent push coverage from matching fork pull requests

Author: cassiomarques

CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+### Fixed
+
+- Non-default branch pushes no longer associate coverage with an unrelated fork pull request that uses the same branch name.
+- When a pushed branch has multiple open pull requests, the action prefers the pull request targeting the default branch. If no unique default-branch target exists, the upload skips successfully instead of selecting arbitrarily or failing CI.
+
 ## v1.4.3 - 2026-09-28
 
 ### Fixed

README.md

@@ -89,6 +89,8 @@ The action auto-detects the event type and resolves the correct behavior:
 - **Non-default branch `push` with an open PR**: Looks up the PR number and uploads coverage for the pushed commit.
 - **Non-default branch `push` without an open PR**: Skips successfully instead of sending an upload request the API cannot associate with a PR.
 
+When a pushed branch has multiple open pull requests in the repository, the action prefers the pull request targeting the default branch because coverage comparisons currently use the default branch as their baseline. If there is no unique default-branch target, the action skips the upload successfully and logs a warning.
+
 Configure workflows to run for pull requests and pushes to the default branch:
 
 ```yaml

docs/workflow-strategies.md

@@ -25,6 +25,8 @@ In a separate-job layout, the test job generates the report and the upload job r
 - Pushes with an open pull request upload using the discovered PR number.
 - Pushes without an open pull request skip successfully.
 
+If the same pushed branch has multiple open pull requests, the action prefers the pull request targeting the default branch because coverage comparisons currently use the default branch as their baseline. If no unique default-branch target exists, the action skips successfully with a warning rather than choosing arbitrarily or failing CI.
+
 If a branch is pushed before its pull request is opened, coverage is not uploaded until the next push. To upload coverage when a pull request is opened without requiring another push, use a `pull_request` trigger.
 
 Push-only workflows have an existing requirement to grant the upload job `pull-requests: read`:

resolve_upload_context.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+import json
 import os
 import subprocess
 from collections.abc import Mapping
@@ -22,11 +23,92 @@ class UploadContext:
 class PullRequestLookup:
     number: str = ""
     error: str = ""
+    warning: str = ""
+
+
+@dataclass(frozen=True)
+class PullRequestCandidate:
+    number: int
+    base_ref_name: str
+
+
+def _parse_pull_request_lookup(
+    output: str,
+    repository: str,
+    ref_name: str,
+    default_branch: str,
+) -> PullRequestLookup:
+    try:
+        pull_requests = json.loads(output)
+    except json.JSONDecodeError as error:
+        return PullRequestLookup(error=f"gh returned invalid JSON: {error.msg}")
+
+    if not isinstance(pull_requests, list):
+        return PullRequestLookup(error="gh returned invalid JSON: expected a list")
+
+    matching_pull_requests: list[PullRequestCandidate] = []
+    for pull_request in pull_requests:
+        if not isinstance(pull_request, dict):
+            return PullRequestLookup(
+                error="gh returned invalid JSON: expected pull request objects"
+            )
+
+        head_repository = pull_request.get("headRepository")
+        if not isinstance(head_repository, dict):
+            continue
+
+        head_repository_name = head_repository.get("nameWithOwner")
+        if (
+            pull_request.get("headRefName") != ref_name
+            or not isinstance(head_repository_name, str)
+            or head_repository_name.casefold() != repository.casefold()
+        ):
+            continue
+
+        number = pull_request.get("number")
+        if not isinstance(number, int):
+            return PullRequestLookup(
+                error="gh returned invalid JSON: expected a pull request number"
+            )
+        base_ref_name = pull_request.get("baseRefName")
+        if not isinstance(base_ref_name, str):
+            return PullRequestLookup(
+                error="gh returned invalid JSON: expected a pull request base branch"
+            )
+
+        if base_ref_name == default_branch:
+            return PullRequestLookup(number=str(number))
+
+        matching_pull_requests.append(
+            PullRequestCandidate(number=number, base_ref_name=base_ref_name)
+        )
+
+    if len(matching_pull_requests) == 1:
+        return PullRequestLookup(number=str(matching_pull_requests[0].number))
+
+    if len(matching_pull_requests) > 1:
+        numbers = ", ".join(
+            str(candidate.number)
+            for candidate in sorted(
+                matching_pull_requests,
+                key=lambda candidate: candidate.number,
+            )
+        )
+        return PullRequestLookup(
+            warning=(
+                f"multiple open pull requests from {repository}:{ref_name} matched: "
+                f"{numbers}, but none uniquely targets the default branch "
+                f"{default_branch}"
+            )
+        )
+
+    return PullRequestLookup()
 
 
 def _find_open_pull_request(environ: Mapping[str, str]) -> PullRequestLookup:
     repository = environ.get("GITHUB_REPOSITORY", "")
     ref_name = environ.get("GITHUB_REF_NAME", "")
+    default_branch = environ.get("COVERAGE_DEFAULT_BRANCH", "")
     command_environment = dict(environ)
     server_url = environ.get("GITHUB_SERVER_URL", "")
     if server_url:
@@ -44,10 +126,10 @@ def _find_open_pull_request(environ: Mapping[str, str]) -> PullRequestLookup:
                 ref_name,
                 "--state",
                 "open",
+                "--limit",
+                "1000",
                 "--json",
-                "number",
-                "--jq",
-                ".[0].number // empty",
+                "number,headRefName,headRepository,baseRefName",
             ],
             capture_output=True,
             check=False,
@@ -62,15 +144,22 @@ def _find_open_pull_request(environ: Mapping[str, str]) -> PullRequestLookup:
             error=result.stderr.strip() or f"gh exited with status {result.returncode}"
         )
 
-    return PullRequestLookup(number=result.stdout.strip())
+    return _parse_pull_request_lookup(
+        result.stdout,
+        repository,
+        ref_name,
+        default_branch,
+    )
 
 
 def resolve_upload_context(
-    environ: Optional[Mapping[str, str]] = None,
+    environ: Mapping[str, str],
     pull_request_lookup: Optional[Callable[[Mapping[str, str]], PullRequestLookup]] = None,
 ) -> UploadContext:
-    env = dict(os.environ if environ is None else environ)
-    lookup = _find_open_pull_request if pull_request_lookup is None else pull_request_lookup
+    env = dict(environ)
+    lookup_pull_request = (
+        _find_open_pull_request if pull_request_lookup is None else pull_request_lookup
+    )
     event_name = env.get("GITHUB_EVENT_NAME", "")
     repository = env.get("GITHUB_REPOSITORY", "")
     ref = env.get("GITHUB_REF", "")
@@ -102,13 +191,11 @@ def resolve_upload_context(
 
     if event_name == "push":
         default_branch = env.get("COVERAGE_DEFAULT_BRANCH", "")
-        is_non_default_branch = (
-            default_branch
-            and ref.startswith("refs/heads/")
-            and ref != f"refs/heads/{default_branch}"
-        )
+        default_branch_ref = f"refs/heads/{default_branch}"
+        is_branch_push = ref.startswith("refs/heads/")
+        is_non_default_branch = default_branch and is_branch_push and ref != default_branch_ref
         if is_non_default_branch:
-            pull_request = lookup(env)
+            pull_request = lookup_pull_request(env)
             if pull_request.number:
                 return UploadContext(
                     should_upload=True,
@@ -128,6 +215,17 @@ def resolve_upload_context(
                     ),
                 )
 
+            if pull_request.warning:
+                return UploadContext(
+                    should_upload=False,
+                    annotation_level="warning",
+                    message=(
+                        f"Skipping coverage upload because {pull_request.warning}. "
+                        "Use a pull_request workflow trigger for unambiguous per-PR "
+                        "uploads."
+                    ),
+                )
+
             return UploadContext(
                 should_upload=False,
                 annotation_level="notice",