Function resolveTargetPrNumber

packages/bumpy/src/commands/ci.ts:345–366

(rootDir: string)

 * normal PR detection used by `ci check`.
 */
export function resolveTargetPrNumber(rootDir: string): string | null {
  if (process.env.GITHUB_EVENT_NAME === 'workflow_run') {
    const event = readGitHubEventPayload();
    const headSha = event?.workflow_run?.head_sha;
    const repo = process.env.GITHUB_REPOSITORY;
    // Sanitize both before they reach the gh api path: a 40-hex SHA and an owner/repo slug.
    if (headSha && /^[0-9a-f]{40}$/i.test(headSha) && repo && /^[\w.-]+\/[\w.-]+$/.test(repo)) {
      return findOpenPrByHeadSha(repo, headSha, rootDir);
    }
    return null;
  }
  return detectPrNumber();
}

/**
 * Find the open PR whose head commit is `headSha`.
 *
 * `GET commits/{sha}/pulls` is the cheap lookup, but it only knows about commits that
 * live in the base repo's own branches — for a PR opened from a fork the head commit
 * isn't there, so it returns `[]`. Fall back to scanning the repo's open PRs and matching
 * on `head.sha`. Both derive the target purely from the trusted SHA, so the security
 * model (never trust the artifact, never trust `workflow_run.pull_requests[]`, which
 * GitHub leaves empty for forks) is preserved.
 */
function findOpenPrByHeadSha(repo: string, headSha: string, rootDir: string): string | null {