Re: [PATCH 01/14] Add b4 CI checks and mypy suppressions

On Mon, Apr 13, 2026 at 5:55 PM Tamir Duberstein <[email protected]> wrote:
>
> On Mon, Apr 13, 2026 at 5:19 PM Konstantin Ryabitsev
> <[email protected]> wrote:
> >
> > On Fri, 10 Apr 2026 18:37:52 -0400, Tamir Duberstein <[email protected]> wrote:
> > > Add a repo-local b4 CI check command and helper script that runs mypy
> > > and pytest so review status surfaces local checks in the b4 UI.
> >
> > No, this introduces a hidden vulnerability -- we're running a script
> > from the same workdir with code modifications. A series that modifies
> > tools/b4-ci-check.py will make the code run with permissions of the
> > maintainer.
> >
> > I am cognizant that this is what we do with b4 review and checkpatch,
> > but I already have a fix in mind for that, plus a check that will
> > specifically refuse to run a script from the workdir of the series.
>
> Shall I drop pytest from the set of commands, or drop this patch entirely?

Oh, I misread - the objection is that this script exists at all. Will
drop this patch.