fix(environments): stop mutating the shared config when expanding branch policies - #1082
Open
ethanejones wants to merge 1 commit into
Conversation
…nch policies
The Environments constructor rewrote custom_branch_policies on the config
objects it was given. Suborg config is shared by every repo in the suborg,
so the first repo turned ['main'] into [{ name: 'main', type: 'branch' }]
and every later repo saw objects that match neither expansion branch,
ending up with custom branch policies enabled and an empty allowlist.
Clone the entries before normalising them.
Fixes github-community-projects#876
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The fix is covered by targeted regression tests and resolves the shared-config mutation.
Review effort: Lite
Findings: None
What changed in this PR
Prevents environment policy expansion from mutating shared configuration across repositories.
Changes:
- Clones entries before normalizing branch policies.
- Adds regression tests for config immutability and repeated plugin construction.
| File | Description |
|---|---|
test/unit/lib/plugins/environments.test.js |
Tests shared-config behavior. |
lib/plugins/environments.js |
Clones entries before normalization. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Author
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
Environmentsconstructor rewritescustom_branch_policieson the config objects it is given. Suborg config is one object shared by every repo in the suborg, so the first repo turns['main']into[{ name: 'main', type: 'branch' }]and every later repo sees objects that match neither expansion branch. Those repos end up with custom branch policies switched on and an empty allowlist, which blocks every deployment with no error.This clones the entries before normalising them. Two tests cover it: the caller's config is left untouched, and a second plugin built from the same config gets the same expanded policies as the first.
The same two tests against
main-enterprise(left) and this branch (right):Fixes #876. The symptom there (custom policies enabled, no rules created, at org and suborg level) matches what we saw on an org with four suborgs declaring the policy.