Address merged issue bookkeeping review

Author: EtienneLescot

.github/workflows/merged-pr-bookkeeping.yml

@@ -105,14 +105,20 @@ jobs:
               }
             }
 
-            async function getClosingIssueNumbers() {
+            async function getClosingIssueRefs() {
               const query = `
                 query($owner: String!, $repo: String!, $pullNumber: Int!, $cursor: String) {
                   repository(owner: $owner, name: $repo) {
                     pullRequest(number: $pullNumber) {
                       closingIssuesReferences(first: 100, after: $cursor) {
                         nodes {
                           number
+                          repository {
+                            name
+                            owner {
+                              login
+                            }
+                          }
                         }
                         pageInfo {
                           hasNextPage
@@ -124,7 +130,7 @@ jobs:
                 }
               `;
 
-              const numbers = [];
+              const issueRefs = new Map();
               let cursor = null;
               let hasNextPage = true;
 
@@ -136,12 +142,20 @@ jobs:
                   cursor,
                 });
                 const refs = result.repository.pullRequest.closingIssuesReferences;
-                numbers.push(...refs.nodes.map((issue) => issue.number));
+                for (const issue of refs.nodes) {
+                  const issueOwner = issue.repository.owner.login;
+                  const issueRepo = issue.repository.name;
+                  issueRefs.set(`${issueOwner}/${issueRepo}#${issue.number}`, {
+                    owner: issueOwner,
+                    repo: issueRepo,
+                    number: issue.number,
+                  });
+                }
                 hasNextPage = refs.pageInfo.hasNextPage;
                 cursor = refs.pageInfo.endCursor;
               }
 
-              return [...new Set(numbers)];
+              return [...issueRefs.values()];
             }
 
             async function hasBookkeepingComment(issueNumber, marker) {
@@ -158,13 +172,25 @@ jobs:
             await ensureLabel(pendingReleaseLabel);
             const fallbackMilestone = pullRequest.milestone || await ensureMilestone(nextReleaseMilestoneTitle);
 
-            const issueNumbers = await getClosingIssueNumbers();
-            if (issueNumbers.length === 0) {
+            const issueRefs = await getClosingIssueRefs();
+            if (issueRefs.length === 0) {
               core.info(`PR #${pullNumber} did not declare closing issue references. Nothing to update.`);
               return;
             }
 
-            for (const issueNumber of issueNumbers) {
+            for (const issueRef of issueRefs) {
+              if (
+                issueRef.owner.toLowerCase() !== owner.toLowerCase() ||
+                issueRef.repo.toLowerCase() !== repo.toLowerCase()
+              ) {
+                core.warning(
+                  `Skipping cross-repository closing reference ${issueRef.owner}/${issueRef.repo}#${issueRef.number}; ` +
+                    `this workflow only updates issues in ${owner}/${repo}.`,
+                );
+                continue;
+              }
+
+              const issueNumber = issueRef.number;
               const issueResponse = await github.rest.issues.get({
                 owner,
                 repo,
@@ -213,10 +239,12 @@ jobs:
                   owner,
                   repo,
                   issue_number: issueNumber,
-                  body: `${marker}
-Fixed by #${pullNumber} and merged into \`main\`.
-
-This change is assigned to the \`${milestoneTitle}\` release milestone and is not necessarily available in the latest downloadable desktop release yet. It is currently marked as \`${pendingReleaseLabel.name}\` until a packaged release containing it is published.`,
+                  body: [
+                    marker,
+                    `Fixed by #${pullNumber} and merged into \`main\`.`,
+                    "",
+                    `This change is assigned to the \`${milestoneTitle}\` release milestone and is not necessarily available in the latest downloadable desktop release yet. It is currently marked as \`${pendingReleaseLabel.name}\` until a packaged release containing it is published.`,
+                  ].join("\n"),
                 });
               }