Fix non-admins unable to automerge PRs from forks (#36833) (#36843)

backport #36833 

Make `handlePullRequestAutoMerge` correctly check the permissions of the
merging user against pr.BaseRepo.

Co-authored-by: Michael Hoang <10492681+Enzime@users.noreply.github.com>
Co-authored-by: Michael Hoang <enzime@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
Lunny Xiao
2026-03-08 10:18:35 +00:00
committed by GitHub
co-authored by Michael Hoang Michael Hoang wxiaoguang
parent 76c539cd57
commit 4f562da975
2 changed files with 38 additions and 79 deletions
+2 -2
View File
@@ -241,9 +241,9 @@ func handlePullRequestAutoMerge(pullID int64, sha string) {
return
}
perm, err := access_model.GetUserRepoPermission(ctx, pr.HeadRepo, doer)
perm, err := access_model.GetUserRepoPermission(ctx, pr.BaseRepo, doer)
if err != nil {
log.Error("GetUserRepoPermission %-v: %v", pr.HeadRepo, err)
log.Error("GetUserRepoPermission %-v: %v", pr.BaseRepo, err)
return
}