fix: bind merge approvals to current head

github-actions/post-approval-changes/lib/main.ts

@@ -103,8 +103,11 @@ async function runPostApprovalChangesAction(
     if (knownReviewers.has(user)) {
       continue;
     }
-    // Only consider reviews by Googlers for this check.
-    if (!(await isGooglerOrgMember(membershipCheckClient, user))) {
+    // Only consider reviews by trusted project members for this check.
+    if (
+      review.author_association !== 'MEMBER' &&
+      !(await isGooglerOrgMember(membershipCheckClient, user))
+    ) {
       continue;
     }
     knownReviewers.add(user);

ng-dev/pr/common/fetch-pull-request.ts

@@ -97,9 +97,9 @@ export const PR_SCHEMA = {
           },
           authorAssociation: graphqlTypes.custom<CommentAuthorAssociation>(),
           bodyText: graphqlTypes.string,
-          commit: {
+          commit: optional({
             oid: graphqlTypes.string,
-          },
+          }),
         },
       ],
     },

ng-dev/pr/common/test/common.spec.ts

@@ -168,6 +168,62 @@ describe('pull request validation', () => {
     });
   });
 
+  describe('assert-minimum-reviews', () => {
+    it('should pass when a team member approved the latest commit', async () => {
+      const config = createIsolatedValidationConfig({assertMinimumReviews: true});
+      const pr = createTestPullRequest();
+      pr.reviews.nodes.push({
+        authorAssociation: 'MEMBER' as CommentAuthorAssociation,
+        author: {
+          login: 'fakelogin',
+        },
+        bodyText: '',
+        commit: {
+          oid: pr.headRefOid,
+        },
+      });
+
+      const results = await assertValidPullRequest(pr, config, ngDevConfig, null, prTarget, git);
+      expect(results.length).toBe(0);
+    });
+
+    it('should reject when the only team member approval is for an older commit', async () => {
+      const config = createIsolatedValidationConfig({assertMinimumReviews: true});
+      const pr = createTestPullRequest();
+      pr.reviews.nodes.push({
+        authorAssociation: 'MEMBER' as CommentAuthorAssociation,
+        author: {
+          login: 'fakelogin',
+        },
+        bodyText: '',
+        commit: {
+          oid: '1234',
+        },
+      });
+
+      const results = await assertValidPullRequest(pr, config, ngDevConfig, null, prTarget, git);
+      expect(results.length).toBe(1);
+      expect(results[0].message).toContain('for the latest commit');
+    });
+
+    it('should reject when a team member approval has no commit', async () => {
+      const config = createIsolatedValidationConfig({assertMinimumReviews: true});
+      const pr = createTestPullRequest();
+      pr.reviews.nodes.push({
+        authorAssociation: 'MEMBER' as CommentAuthorAssociation,
+        author: {
+          login: 'fakelogin',
+        },
+        bodyText: '',
+        commit: null,
+      });
+
+      const results = await assertValidPullRequest(pr, config, ngDevConfig, null, prTarget, git);
+      expect(results.length).toBe(1);
+      expect(results[0].message).toContain('for the latest commit');
+    });
+  });
+
   describe('assert-isolate-primitives', () => {
     it('should pass when no google sync config present', async () => {
       const config = createIsolatedValidationConfig({assertIsolatedSeparateFiles: true});

ng-dev/pr/common/validation/assert-minimum-reviews.ts

@@ -18,11 +18,12 @@ export const minimumReviewsValidation = createPullRequestValidation(
 class Validation extends PullRequestValidation {
   assert(pullRequest: PullRequestFromGithub) {
     const totalCount = pullRequest.reviews.nodes.filter(
-      ({authorAssociation}) => authorAssociation === 'MEMBER',
+      ({authorAssociation, commit}) =>
+        authorAssociation === 'MEMBER' && commit?.oid === pullRequest.headRefOid,
     ).length;
     if (totalCount === 0) {
       throw this._createError(
-        `Pull request cannot be merged without at least one review from a team member`,
+        `Pull request cannot be merged without at least one review from a team member for the latest commit`,
       );
     }
   }