API shows unexpected PR for a commit

[betanummeric]

Description

The API endpoint GET /repos/{owner}/{repo}/commits/{sha}/pull returns a pull request in more cases than I would expect:
I created the example repo https://demo.gitea.com/betanummeric/pr-test1 as an example:

* 2e0af5a76e4e02ff9ee4d52949d25fd229683754  (HEAD -> yetanother, origin/yetanother)
| * a8a7c696d7de8abd600798966caa4a47a6c420ca  (origin/other, other)
| * 827ed730869e32856e56da7be2a294dbf89a1b93  (origin/mergeme, mergeme)
|/  
* bd0050a443969356bf847bed330aa34a53be00cf  (origin/main, main)

I created a PR from branch mergeme to main: https://demo.gitea.com/betanummeric/pr-test1/pulls/1

The API returns that PR for every commit hash of the repo. I would have expected this to return the PR only for commit 827ed730869e32856e56da7be2a294dbf89a1b93, because only that will be applied to the target branch in the PR.

I'm using this endpoint to determine if a push event relates to some PR. I work around by checking if the PR head matches the head of the push event.

Gitea Version

1.22.1

Can you reproduce the bug on the Gitea demo site?

Yes

Log Gist

No response

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

tested with gitea 1.22.1 and https://demo.gitea.com/ at 1.23.0+dev-464-g19af534462

Database

None

[Zettat123]

The /repos/{owner}/{repo}/commits/{sha}/pull API was added by #29243. According to its description, this API is used to get the merged PR associated to a commit. If the PR is not merged, the API should return 404.

However, now the API can return a PR even if it has not been merged yet. This is caused by a bug.

Here we try to get the SHA by the sha path param.

gitea/routers/api/v1/repo/commits.go

Line 357 in 2fc347b

pr, err := issues_model.GetPullRequestByMergedCommit(ctx, ctx.Repo.Repository.ID, ctx.PathParam(":sha"))

But there is not a sha param in the path. The correct param should be ref.

gitea/routers/api/v1/api.go

Lines 1286 to 1289 in 2fc347b

	m.Group("/{ref}", func() {
	m.Get("/status", repo.GetCombinedCommitStatusByRef)
	m.Get("/statuses", repo.GetCommitStatusesByRef)
	m.Get("/pull", repo.GetCommitPullRequest)

[betanummeric]

Thanks for the quick fix. :)

For the record, I wanted to use the API endpoint to get the PR (if any) by commit sha regardless of whether the PR is merged or not. I want to check in a push webhook if the push belongs to a PR. I guess I need to find a different solution for that now.