Skip to content

Avoid fallback download of artifacts when not on develop #18785

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
maurelian merged 5 commits into from
Jan 19, 2026
Merged

Avoid fallback download of artifacts when not on develop #18785

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
53a43fc
fix: do not use fallback artifacts on PRs branches other than develop
maurelian Jan 14, 2026
a8c30b9
Refactor get-target-branch into script
maurelian Jan 14, 2026
ed1bd06
fix: shellcheck error
maurelian Jan 14, 2026
464d664
fix: simplify get-target-branch.sh to match original logic
maurelian Jan 14, 2026
b2e704b
remove extra ci job calls
maurelian Jan 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 4 additions & 13 deletions .circleci/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,18 +231,12 @@ commands:
- run:
name: Determine target branch for this pipeline
command: |
TARGET_BRANCH=""
if [ -n "${CIRCLE_PULL_REQUEST:-}" ]; then
TARGET_BRANCH=$(curl -s "https://api.github.com/repos/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}/pulls/${CIRCLE_PULL_REQUEST##*/}" | jq -r .base.ref)
fi

# Fallbacks when not a PR or API did not return a branch
if [ -z "$TARGET_BRANCH" ] || [ "$TARGET_BRANCH" = "null" ]; then
TARGET_BRANCH="<< pipeline.git.branch >>"
fi
# Use the get-target-branch.sh script
source scripts/ops/get-target-branch.sh

echo "Resolved TARGET_BRANCH=$TARGET_BRANCH"
# Make TARGET_BRANCH available to subsequent steps
echo "export TARGET_BRANCH=$TARGET_BRANCH" >> "$BASH_ENV"
working_directory: packages/contracts-bedrock

setup-features:
description: "Set up dev and system feature environment variables. Features are auto-classified based on system_features registry."
Expand Down Expand Up @@ -954,7 +948,6 @@ jobs:
name: Print forge version
command: forge --version
working_directory: packages/contracts-bedrock
- get-target-branch
- pull-artifacts-conditional
- go-restore-cache:
namespace: packages/contracts-bedrock/scripts/go-ffi
Expand Down Expand Up @@ -1123,7 +1116,6 @@ jobs:
name: Print forge version
command: forge --version
working_directory: packages/contracts-bedrock
- get-target-branch
- pull-artifacts-conditional
- run:
name: Install lcov
Expand Down Expand Up @@ -1218,7 +1210,6 @@ jobs:
name: Print forge version
command: forge --version
working_directory: packages/contracts-bedrock
- get-target-branch
- pull-artifacts-conditional
- run:
name: Write pinned block number for cache key
Expand Down
5 changes: 4 additions & 1 deletion packages/contracts-bedrock/scripts/checks/check-semver-diff.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,10 @@ SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" &> /dev/null && pwd)
# shellcheck source=/dev/null
source "$SCRIPT_DIR/utils/semver-utils.sh"

# Determine the target branch.
# shellcheck source=/dev/null
source "$SCRIPT_DIR/../ops/get-target-branch.sh"

# Path to semver-lock.json.
SEMVER_LOCK="snapshots/semver-lock.json"

Expand All @@ -32,7 +36,6 @@ temp_dir=$(mktemp -d)
trap 'rm -rf "$temp_dir"' EXIT

# Exit early if semver-lock.json has not changed.
TARGET_BRANCH="${TARGET_BRANCH:-develop}"
UPSTREAM_REF="origin/${TARGET_BRANCH}"
if ! {
git diff "$UPSTREAM_REF"...HEAD --name-only
Expand Down
15 changes: 15 additions & 0 deletions packages/contracts-bedrock/scripts/ops/get-target-branch.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
#!/usr/bin/env bash
# Determines the PR target branch and exports TARGET_BRANCH

TARGET_BRANCH=""
if [ -n "${CIRCLE_PULL_REQUEST:-}" ]; then
TARGET_BRANCH=$(curl -s "https://api.github.com/repos/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}/pulls/${CIRCLE_PULL_REQUEST##*/}" | jq -r .base.ref)
fi

# Fallbacks when not a PR or API did not return a branch
if [ -z "$TARGET_BRANCH" ] || [ "$TARGET_BRANCH" = "null" ]; then
TARGET_BRANCH="${CIRCLE_BRANCH:-develop}"
fi

echo "Resolved TARGET_BRANCH=$TARGET_BRANCH" >&2
export TARGET_BRANCH
9 changes: 8 additions & 1 deletion packages/contracts-bedrock/scripts/ops/use-latest-fallback.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ set -euo pipefail
# - develop branch: Always build fresh (accuracy)
# - force-use-fresh-artifacts label: Override fallback (emergency escape hatch)

# Determine the target branch for this PR
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=/dev/null
source "$SCRIPT_DIR/get-target-branch.sh"

USE_FALLBACK=false

# Check if we're on a PR (not develop branch)
Expand Down Expand Up @@ -43,6 +48,7 @@ if [ "${CIRCLE_BRANCH:-}" != "develop" ]; then
fi
fi

echo "TARGET_BRANCH=$TARGET_BRANCH"
# Ensure that PRs targetting anything other than develop do not use the fallback
TARGET_BRANCH="${TARGET_BRANCH:-unknown}"
if [ "$TARGET_BRANCH" != "develop" ]; then
Expand All @@ -51,7 +57,8 @@ fi

# Pull artifacts with or without fallback
if [ "$USE_FALLBACK" = "true" ]; then
bash scripts/ops/pull-artifacts.sh --fallback-to-latest

j bash scripts/ops/pull-artifacts.sh --fallback-to-latest
else
bash scripts/ops/pull-artifacts.sh
Comment on lines 59 to 63
Copy link
Copy Markdown
Contributor

@almanax-ai almanax-ai bot Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Low Severity severity

Denial of Service (DoS): CI script fails artifact pull in use-latest-fallback.sh

use-latest-fallback.sh contains a stray j before the bash invocation, which will trigger command not found and (due to set -euo pipefail) abort the script, preventing artifact pulling and potentially failing the entire CI job.

Remove the stray j and ensure the fallback path executes bash scripts/ops/pull-artifacts.sh --fallback-to-latest as intended.

Suggested change
if [ "$USE_FALLBACK" = "true" ]; then
bash scripts/ops/pull-artifacts.sh --fallback-to-latest
j bash scripts/ops/pull-artifacts.sh --fallback-to-latest
else
bash scripts/ops/pull-artifacts.sh
if [ "$USE_FALLBACK" = "true" ]; then
bash scripts/ops/pull-artifacts.sh --fallback-to-latest
else
bash scripts/ops/pull-artifacts.sh

Don't like this finding? Reply "dismiss" and it won't appear again in future scans.

If it's acknowledged or addressed, reply "resolve" to mark it resolved.

fi