context.config() does not take event context into account

In followup from #264 (I cannot reopen that issue, and the issue was auto-closed without having a solution/fix.

Bug Report

This problem makes it impossible to change the configuration of a probot bot IN the pull request where the probot is active/receives events. Only configuration in the repo’s master branch is taken into account.

Problematic code: https://github.com/probot/probot/blob/master/src/context.ts#L230

Assume the files

# .github/my-config.yaml
# branch: master (the default branch)
property: 1

# .github/my-config.yaml
# branch: my-feature
property: 2

Current Behavior

• I open a pull request

• I have my probot bot listen to pull request events

• I create a pull request to merge my-feature into master

• When the bot receives a pull request event:

  context.config('my-config.yaml').property == 1
  

Expected behavior/code

• I open a pull request

• I have my probot bot listen to pull request events

• I create a pull request to merge my-feature into master

• When the bot receives a pull request event:

  context.config('my-config.yaml').property == 2
  

Possible Solution

Take the branch information that is stored in the context into account. For pull requests, that means the changes of the pull request branch.

[gr2m]

Isn’t the same true for having CI config in the repo, where the branch is also used when the CI configuration is read? How are those security issues mitigated in such cases?

The CIs take care of that.

Feel free to close this issue if this is not a priority feature

We can leave it open for a while to see if anyone else has a similar need

Maybe some documentation would be useful for explaining this behaviour and the security risks

Always! PRs welcome 😃

[github-actions[bot]]

🎉 This issue has been resolved in version 9.11.4 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀