[LTS-8.6] CVE-2025-21919 CVE-2022-50020 CVE-2022-50022 CVE-2025-38086 CVE-2025-38380 CVE-2022-49788 CVE-2025-23150e #50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Check Kernel Commits for Upstream Fixes | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| check-upstream-fixes: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout PR branch | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.head_ref }} | |
| - name: Checkout base branch | |
| run: | | |
| git fetch origin ${{ github.base_ref }}:${{ github.base_ref }} | |
| - name: Download check_kernel_commits.py | |
| run: | | |
| curl -sL \ | |
| https://raw.githubusercontent.com/ctrliq/kernel-src-tree-tools/mainline/check_kernel_commits.py \ | |
| -o check_kernel_commits.py | |
| chmod +x check_kernel_commits.py | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.x' | |
| - name: Run upstream fixes check | |
| id: checkkernel | |
| run: | | |
| python3 check_kernel_commits.py --repo . --pr_branch "${{ github.head_ref }}" --base_branch "${{ github.base_ref }}" --markdown | tee result.txt | |
| # Save non-empty results for PR comment | |
| if grep -q -v "All referenced commits exist upstream and have no Fixes: tags." result.txt; then | |
| echo "has_findings=true" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Comment on PR if issues found | |
| if: steps.checkkernel.outputs.has_findings == 'true' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh pr comment ${{ github.event.pull_request.number }} \ | |
| --body "$(cat result.txt)" \ | |
| --repo ${{ github.repository }} |