From 8d2e9d2fcfd6ea1c5b8f7c7e15359ad031444c7d Mon Sep 17 00:00:00 2001
From: MalTeeez <41554385+MalTeeez@users.noreply.github.com>
Date: Tue, 14 Jul 2026 02:36:09 +0200
Subject: [PATCH] Switch out pr url lookup method with repos/repo/pulls +
 filter (#71)

---
 .github/workflows/latest-daily-integration-test.yml | 10 +++++++---
 .github/workflows/trigger-rebuild-with-deps.yml     | 10 +++++++---
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/latest-daily-integration-test.yml b/.github/workflows/latest-daily-integration-test.yml
index 6b3315c..5235216 100644
--- a/.github/workflows/latest-daily-integration-test.yml
+++ b/.github/workflows/latest-daily-integration-test.yml
@@ -34,10 +34,14 @@ jobs:
         id: lookup
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} # Not inlined below to prevent injection from branch names
         run: |
-          PR_URL=$(gh api \
-            "repos/${{ github.repository }}/commits/${{ github.event.workflow_run.head_sha }}/pulls" \
-            --jq "[.[] | select(.head.sha == \"${{ github.event.workflow_run.head_sha }}\" and .state == \"open\")] | first | .html_url // empty")
+          PR_URL=$(gh api --method GET \
+            "repos/${{ github.repository }}/pulls" \
+            -f state=open \
+            -f head="${{ github.event.workflow_run.head_repository.owner.login }}:${HEAD_BRANCH}" \
+            -f base="${{ github.event.repository.default_branch }}" \
+            --jq "([.[] | select(.head.sha == \"${{ github.event.workflow_run.head_sha }}\")] | first | .html_url) // (first | .html_url) // empty")
 
           if [ -z "$PR_URL" ]; then
             echo "Failed to find a PR url"
diff --git a/.github/workflows/trigger-rebuild-with-deps.yml b/.github/workflows/trigger-rebuild-with-deps.yml
index c77b24b..14fe7d7 100644
--- a/.github/workflows/trigger-rebuild-with-deps.yml
+++ b/.github/workflows/trigger-rebuild-with-deps.yml
@@ -23,10 +23,14 @@ jobs:
         id: lookup
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }} # Not inlined below to prevent injection from branch names
         run: |
-          PR_URL=$(gh api \
-            "repos/${{ github.repository }}/commits/${{ github.event.workflow_run.head_sha }}/pulls" \
-            --jq "[.[] | select(.head.sha == \"${{ github.event.workflow_run.head_sha }}\" and .state == \"open\")] | first | .html_url // empty")
+          PR_URL=$(gh api --method GET \
+            "repos/${{ github.repository }}/pulls" \
+            -f state=open \
+            -f head="${{ github.event.workflow_run.head_repository.owner.login }}:${HEAD_BRANCH}" \
+            -f base="${{ github.event.repository.default_branch }}" \
+            --jq "([.[] | select(.head.sha == \"${{ github.event.workflow_run.head_sha }}\")] | first | .html_url) // (first | .html_url) // empty")
 
           if [ -z "$PR_URL" ]; then
             echo "Failed to find a PR url"