Commit faf29942c47 for woocommerce

commit faf29942c479ace38b314a4040264524570c180f
Author: Daniel Mallory <daniel.mallory@automattic.com>
Date:   Tue Oct 13 12:22:53 2026 +0100

    Lint PRs against their base branch instead of trunk (#69588)

    * Lint PRs against their base branch instead of trunk

    CI never passed --base-ref to ci-jobs, so the <baseRef> placeholder in the
    plugin's lint command was empty and lint-branch.sh fell back to
    origin/trunk. PRs into release/* branches were linted against trunk and
    picked up findings in code they didn't touch.

    * fix(ci): Only pass safe base branch names to the lint commands

    The PR base branch name goes into the ci-jobs shell command and, through
    the <baseRef> placeholder, into the Lint step's run script. A branch name
    with shell characters would be run as part of those commands. Pass it only
    when it is made of letters, digits, ".", "_", "/" and "-", and lint against
    trunk otherwise.

    Refs WOOPLUG-7452

    Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

    ---------

    Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 021fe3af716..b51208b8a9b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -136,9 +136,20 @@ jobs:
             // - PRs: run CI jobs aiming PRs and filter out jobs based on the content changes
             // - Pushes: run CI jobs aiming pushes without filtering based on the content changes

+            // The base ref fills the `<baseRef>` placeholder in project commands, so a PR
+            // targeting a release/* branch is linted against that branch, not trunk.
+            // It ends up in shell commands here and in the Lint step, so a branch name with
+            // anything other than letters, digits, `.`, `_`, `/` or `-` falls back to trunk.
             let prNumberFilter   = '';
+            let baseRefFilter    = '';
             if ( '${{ github.event_name }}' === 'pull_request' ) {
               prNumberFilter = `--pr-number ${{ github.event.pull_request.number }}`;
+              const baseRef  = process.env.GITHUB_BASE_REF;
+              if ( /^[A-Za-z0-9._\/-]+$/.test( baseRef ) ) {
+                baseRefFilter = `--base-ref origin/${ baseRef }`;
+              } else {
+                core.warning( `Linting against trunk because the base branch name is not safe to pass to a shell: ${ baseRef }` );
+              }
             }

             let githubEvent = ${{ toJson( github.event_name ) }};
@@ -155,7 +166,7 @@ jobs:
             }

             const child_process = require( 'node:child_process' );
-            child_process.execSync( `pnpm utils ci-jobs ${ prNumberFilter } --event ${ githubEvent }` );
+            child_process.execSync( `pnpm utils ci-jobs ${ prNumberFilter } ${ baseRefFilter } --event ${ githubEvent }` );

   project-lint-jobs:
     name: "Lint - ${{ matrix.projectName }} ${{ ( matrix.optional && ' (optional)' ) || '' }}"