Open iamstarkov opened 1 year ago
Hi @iamstarkov
Thanks for reporting that. Some time ago (> 1 year 😅 ) try to fix that: https://github.com/mszostok/codeowners-validator/pull/69/files
However, this path traversal is quite tricky and I wanted to do more testing to do not introduce a new bug instead. I will add a prio on it and try to get it merge soon 👍 .
Description
Let's say you have the repository with the given file structure:
and given CODEOWNERS file:
The problem with this action is that despite
/packages/demo/src/not-owned
is not owned, because/packages/demo/*
doesn't provide ownership for nested files, codeowners-validator action doesn't fail the "not owned" check.And wildcard pattern misinterpretation most likely is the root cause, because if you remove it, action does recognise the problem and fails the check.
Expected result
given original file structure and codeowners configuration from the description or from the main branch of the demo repo, then
not owned
check should fail.Maybe other semantic rules are worth to be checked too.
Actual result
clearly not owned files don't make the check fail.
Steps to reproduce
see demo repo for reproduction https://github.com/iamstarkov/codeowners-validator-issue-demo/ and 1st PR too https://github.com/iamstarkov/codeowners-validator-issue-demo/pull/1/
Troubleshooting
I don't know what to put here