Re: [PATCH 01/14] Add b4 CI checks and mypy suppressions

On Fri, 10 Apr 2026 18:37:52 -0400, Tamir Duberstein <[email protected]> wrote:
> Add a repo-local b4 CI check command and helper script that runs mypy
> and pytest so review status surfaces local checks in the b4 UI.

No, this introduces a hidden vulnerability -- we're running a script 
from the same workdir with code modifications. A series that modifies 
tools/b4-ci-check.py will make the code run with permissions of the 
maintainer.

I am cognizant that this is what we do with b4 review and checkpatch, 
but I already have a fix in mind for that, plus a check that will 
specifically refuse to run a script from the workdir of the series.

-- 
KR