From 95f87942f94e37306a0d12dbb618e1f874f92853 Mon Sep 17 00:00:00 2001
From: Bjordis Collaku <bcollaku@qti.qualcomm.com>
Date: Fri, 28 Aug 2026 13:15:12 -0700
Subject: [PATCH] fix(ci): resolve premerge distro validation PR identity for
 fork PRs

Both the workflow_run orchestrator and the repository_dispatch callback
handler identify the originating pull request by calling GET
/commits/{sha}/pulls with the triggering commit SHA. That endpoint does
not reliably resolve commits that only exist on a fork: such commits
are reachable in this repository solely through the hidden
refs/pull/<n>/head ref, never through an actual branch, and GitHub's
commit-to-pull-request association does not cover that case.

This surfaced on pull request #90, a real fork PR opened specifically
to exercise this chain. Its premerge kernel build succeeded and
correctly triggered the workflow_run orchestrator, but the orchestrator
then failed identity resolution with "found 0" pull requests for a
commit that was, in fact, the current head of an open PR.

- List open pull requests against resolute-qcom-devel directly with GET
  /pulls?state=open&base=resolute-qcom-devel and match on head.sha
  instead of relying on the commit-to-pull-request association. This
  works identically for same-repo and fork-originated pull requests.
- Apply the same fix to both call sites: resolve-distro-validation-context.sh
  (workflow_run path) and validate-distro-validation-callback.sh
  (repository_dispatch callback path), which independently re-derives
  the same identity as a security cross-check against the callback
  payload.
- Move head_sha format validation ahead of its first use in
  resolve-distro-validation-context.sh.

Verified live against the real API: the new query returns exactly one
match, PR #90, for the exact commit that the old query returned zero
results for.

Signed-off-by: Bjordis Collaku <bcollaku@qti.qualcomm.com>
---
 scripts/resolve-distro-validation-context.sh   | 16 +++++++++++++---
 scripts/validate-distro-validation-callback.sh | 12 ++++++++++--
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/scripts/resolve-distro-validation-context.sh b/scripts/resolve-distro-validation-context.sh
index e34b147ef2775..2193636690c72 100755
--- a/scripts/resolve-distro-validation-context.sh
+++ b/scripts/resolve-distro-validation-context.sh
@@ -51,14 +51,24 @@ if [[ "$GITHUB_EVENT_NAME" == "workflow_run" ]]; then
   conclusion="$(jq -r '.workflow_run.conclusion' "$GITHUB_EVENT_PATH")"
   head_sha="$(jq -r '.workflow_run.head_sha' "$GITHUB_EVENT_PATH")"
 
+  [[ "$head_sha" =~ ^[0-9a-f]{40}$ ]] || { echo "::error::Invalid triggering workflow head SHA: ${head_sha}" >&2; exit 1; }
+
+  # GET /commits/{sha}/pulls does not reliably resolve commits that only
+  # exist on a fork (reachable in this repo solely via the hidden
+  # refs/pull/<n>/head ref, never an actual branch). List open pull
+  # requests against resolute-qcom-devel directly and match on head.sha
+  # instead, which works the same for same-repo and fork-originated PRs.
   pull_requests="$(
-    gh api "repos/${GITHUB_REPOSITORY}/commits/${head_sha}/pulls" \
+    gh api --paginate "repos/${GITHUB_REPOSITORY}/pulls" \
       -H "Accept: application/vnd.github+json" \
-      --jq '[.[] | select(.base.ref == "resolute-qcom-devel" and .head.sha == "'"$head_sha"'")]'
+      -X GET \
+      -f state=open \
+      -f base=resolute-qcom-devel \
+      | jq -s --arg sha "$head_sha" '[.[][] | select(.head.sha == $sha)]'
   )"
   pr_count="$(jq 'length' <<< "$pull_requests")"
   [[ "$pr_count" == "1" ]] || {
-    echo "::error::Expected exactly one resolute-qcom-devel pull request for ${head_sha}; found ${pr_count}." >&2
+    echo "::error::Expected exactly one open resolute-qcom-devel pull request for ${head_sha}; found ${pr_count}." >&2
     exit 1
   }
   pr_number="$(jq -r '.[0].number' <<< "$pull_requests")"
diff --git a/scripts/validate-distro-validation-callback.sh b/scripts/validate-distro-validation-callback.sh
index 224a9b4036508..f2055e62eae66 100755
--- a/scripts/validate-distro-validation-callback.sh
+++ b/scripts/validate-distro-validation-callback.sh
@@ -45,10 +45,18 @@ jq -e \
     exit 1
   }
 
+# GET /commits/{sha}/pulls does not reliably resolve commits that only
+# exist on a fork (reachable in this repo solely via the hidden
+# refs/pull/<n>/head ref, never an actual branch). List open pull
+# requests against resolute-qcom-devel directly and match on head.sha
+# instead, which works the same for same-repo and fork-originated PRs.
 pull_requests="$(
-  gh api "repos/qualcomm-linux/pkg-linux-qcom-canonical/commits/${head_sha}/pulls" \
+  gh api --paginate "repos/qualcomm-linux/pkg-linux-qcom-canonical/pulls" \
     -H "Accept: application/vnd.github+json" \
-    --jq '[.[] | select(.base.ref == "resolute-qcom-devel" and .head.sha == "'"$head_sha"'")]'
+    -X GET \
+    -f state=open \
+    -f base=resolute-qcom-devel \
+    | jq -s --arg sha "$head_sha" '[.[][] | select(.head.sha == $sha)]'
 )"
 [[ "$(jq 'length' <<< "$pull_requests")" == "1" ]] || { echo "::error::Unable to identify one matching Canonical pull request." >&2; exit 1; }
 [[ "$(jq -r '.[0].number' <<< "$pull_requests")" == "$pr_number" ]] || { echo "::error::Callback pull request number does not match the kernel commit." >&2; exit 1; }