Commit b05db4d35d for openssl.org

commit b05db4d35d1bcf36f7b9cb27c9e9fb14dd4a8265
Author: Eugene Syromiatnikov <esyr@openssl.org>
Date:   Tue Oct 27 04:21:02 2026 +0100

    .github/workflows/check-news-changes.yml: tighten feature branch check

    [1] has noted that the topic branch name is unquoted and is controlled
    by an arbitrary contributor;  however, a feature branch is expected
    to come from the openssl/openssl repository, so that issue should not
    have arisen in the first place.  Update the workflow step to check
    whether the branch comes from the same repository as the target,
    and tighten the name check itself to check that the prefix matches,
    and not an arbitrary part of the branch name.

    [1] https://github.com/openssl/openssl/pull/32100

    Fixes: 7f51fd8ef7c7 "Create a simple check for suggesting NEWS/CHANGES additions"
    References: https://github.com/openssl/openssl/pull/32100
    Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Norbert Pocs <norbertp@openssl.org>
    Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
    Merge-date: Tue Nov  3 13:22:27 2026
    Merged-from: https://github.com/openssl/openssl/pull/33409

diff --git a/.github/workflows/check-news-changes.yml b/.github/workflows/check-news-changes.yml
index 484b3ee522..4eb54f599a 100644
--- a/.github/workflows/check-news-changes.yml
+++ b/.github/workflows/check-news-changes.yml
@@ -71,11 +71,11 @@ jobs:
             echo "NEED_NEWS_CHANGES=yes" >> $GITHUB_ENV
           fi
       - name: "Check if this is a feature branch merge"
-        if: ${{ env.FOUND_NEWS_CHANGES_ADDITION == 'no' && env.SKIP_NEWS_CHECK == 'no' }}
+        if: ${{ env.FOUND_NEWS_CHANGES_ADDITION == 'no' && env.SKIP_NEWS_CHECK == 'no' && github.event.pull_request.head.repo.full_name == github.repository }}
+        env:
+          HEAD_REF: ${{ github.head_ref }}
         run: |
-          set +e
-          echo ${{ github.head_ref }} | grep -q "feature"
-          if [ $? -eq 0 ]; then
+          if [ "x${HEAD_REF#feature/}" != "x${HEAD_REF}" ]; then
             echo "Feature branch found"
             echo "NEED_NEWS_CHANGES=yes" >> $GITHUB_ENV
           fi