From fdae27b122ab3ae317e4c9109f7467ac02687d34 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bart=C5=82omiej=20Piotrowski?= <b@bpiotrowski.pl>
Date: Fri, 3 Nov 2023 23:14:04 +0100
Subject: [PATCH] flatmanager: Extend to catch apps abusing "branch/" to push
 non-stable branches

---
 flatpak_builder_lint/checks/flatmanager.py | 26 ++++++++++++++++++----
 pyproject.toml                             |  2 +-
 2 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/flatpak_builder_lint/checks/flatmanager.py b/flatpak_builder_lint/checks/flatmanager.py
index 7b037d0c..85de64ec 100644
--- a/flatpak_builder_lint/checks/flatmanager.py
+++ b/flatpak_builder_lint/checks/flatmanager.py
@@ -51,11 +51,12 @@ def check_repo(self, path: str) -> None:
             token_type = build_info["token_type"]
             target_repo = build_info["repo"]
 
+            refs = [
+                build_ref["ref_name"]
+                for build_ref in build_extended.get("build_refs", [])
+            ]
+
             if token_type == "app":
-                refs = [
-                    build_ref["ref_name"]
-                    for build_ref in build_extended.get("build_refs", [])
-                ]
                 has_app_ref = any(ref.startswith("app/") for ref in refs)
                 if not has_app_ref:
                     self.errors.add("flat-manager-no-app-ref-uploaded")
@@ -65,3 +66,20 @@ def check_repo(self, path: str) -> None:
                     if ref_branch != target_repo:
                         self.errors.add("flat-manager-branch-repo-mismatch")
                         break
+            else:
+                appref_list = [ref for ref in refs if ref.startswith("app/")]
+                if not appref_list:
+                    return
+
+                appref = appref_list[0]
+                _, appid, _, branch = appref.split("/")
+
+                if (
+                    not (
+                        appid.split(".")[-1] == "BaseApp"
+                        or appid.startswith("org.freedesktop.Platform.")
+                        or appid == "org.winehq.Wine"
+                    )
+                    and branch != target_repo
+                ):
+                    self.errors.add("flat-manager-branch-repo-mismatch")
diff --git a/pyproject.toml b/pyproject.toml
index 61f486cc..fb688641 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "flatpak_builder_lint"
-version = "2.0.12"
+version = "2.0.13"
 description = "A linter for flatpak-builder manifests"
 authors = ["Bartłomiej Piotrowski <b@bpiotrowski.pl>"]
 license = "MIT"