Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Dry run only inspects the first 30 changed files (pulls.listFiles is not paginated)

Open Beginner friendly
  • Is something wrong?
#1,080 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@3rwww1 is already working on this.

Since Sep 21, 2026.

  • #1081 by @3rwww1 — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
84/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript
Domain
api, backend

Research direction

Start in index.js at the unpaginated pulls.listFiles call around lines 584-585, then compare it with the existing apps.listInstallations pagination pattern in the same file. Ensure the dry-run path considers every changed file, including files beyond the first API page, and verify it against a pull request changing more than 30 configuration files so the reported repo set is complete.

Written by the indexing model from the issue text.

Description

What happens

The pull-request dry run (NOP) only looks at the first 30 changed files of the PR. On a PR that touches more than 30 files under .github/repos/, the check run reports far fewer repos than the PR actually changes - and when none of the config files happen to land on the first API page, it reports Number of repos that were considered: 0 and concludes success with "No Safe-settings changes detected".

The dry run silently under-reports. A reviewer reads the check run as "this PR changes nothing", merges, and the real sync then applies changes that were never shown.

Why

pulls.listFiles is called without pagination, so it returns the API default of 30 items:

https://github.com/github/safe-settings/blob/0cc709f5af9246ccbad0577131c75c17d573f059/index.js#L584-L585

The resulting files array feeds every downstream decision in the same handler - the .github/settings.yml full-sync check, getChangedRepoConfigName (.github/repos/*.yml) and getChangedSubOrgConfigName (.github/suborgs/*.yml). Any config file past the first page is invisible to all three.

Reproduction
  1. In the admin repo, open a PR that changes more than 30 files under .github/repos/ (for example a fleet-wide property change).
  2. Wait for the Safe-setting validator check run.
  3. The check run reports a partial repo set, or Number of repos that were considered: 0 when the first 30 changed files contain no safe-settings config.

Observed on an org with ~130 repos, safe-settings 2.1.21: a PR touching 129 files reported 0 repos considered; a later push on the same PR touching 23 files reported the expected repos.

Expected

Every changed file in the PR is considered, regardless of how many files the PR touches.

Proposed fix

Paginate the call:

const files = await context.octokit.paginate(
  context.octokit.rest.pulls.listFiles,
  { ...params, per_page: 100 },
  response => response.data.map(f => f.filename)
)

The same octokit.paginate pattern is already used in this file for apps.listInstallations.

Related, not covered by the fix above

The push handler takes its file lists from the webhook payload (payload.commits[].added / .modified) rather than from the API. The push event payload is documented to carry at most 20 commits, so a large push to the default branch can hide config changes the same way. Worth a separate look; this report is only about the dry-run path.

Versions
  • safe-settings 2.1.21 (where this was observed)
  • default branch main-enterprise at 0cc709f5af9246ccbad0577131c75c17d573f059 (same unpaginated call, index.js:584)
Dominant language
JavaScript
Stars
924
Forks
227
Avg merge
6h 8m
Merged PRs (30d)
15

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from github-community-projects/safe-settings

All issues in github-community-projects/safe-settings

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.