Re: [PATCH 01/14] Add b4 CI checks and mypy suppressions

On Mon, Apr 13, 2026 at 5:19 PM Konstantin Ryabitsev
<[email protected]> wrote:
>
> On Fri, 10 Apr 2026 18:37:52 -0400, Tamir Duberstein <[email protected]> wrote:
> > Add a repo-local b4 CI check command and helper script that runs mypy
> > and pytest so review status surfaces local checks in the b4 UI.
>
> No, this introduces a hidden vulnerability -- we're running a script
> from the same workdir with code modifications. A series that modifies
> tools/b4-ci-check.py will make the code run with permissions of the
> maintainer.
>
> I am cognizant that this is what we do with b4 review and checkpatch,
> but I already have a fix in mind for that, plus a check that will
> specifically refuse to run a script from the workdir of the series.

Shall I drop pytest from the set of commands, or drop this patch entirely?