In https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/522649 libup is pushing using a command like git push origin HEAD:refs/for/master%topic=bump-dev-deps,t=CVE-2019-10746,l=Code-Review+2
However, in the first patchset comment, you only see "Hashtags added..."
Compare this to a pre-hashtag patch like https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Scribunto/+/516204 where it said "Uploaded patch set 1: Code-Review+2.".
If you try and add a comment while pushing using https://gerrit.wikimedia.org/r/Documentation/user-upload.html#message the hashtag comment will also overwrite that one - see https://gerrit.wikimedia.org/r/c/mediawiki/extensions/TemplateWizard/+/564832
@Paladox do you think you could report this upstream (if it hasn't been already)?
The push did set the Code-Review +2 label since that triggered CI gate-and-submit and it did add the hashtag as indicated by the comment added to the change.
I have looked at https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/522649 , the metadata can be retrieved using git fetch origin refs/changes/49/522649/meta. The commits has:
commit 9fbbdb6709a0f5d184ca4f2f7f555675bdc3a13c
Author: Libraryupgrader <5266@e9e9afe9-4712-486d-8885-f54b72dd1951>
Date: Sun Jul 14 07:35:03 2019 +0000
Create change
Hashtags added: CVE-2019-10746, CVE-2019-10747, n;mixin-deep=1.3.2, n;set-value=2.0.1, n;union-value=1.0.1
Patch-set: 1
Change-id: I36781c59229e416074783f0dc80b7e96bc730e1e
Subject: build: Updating npm dependencies
Branch: refs/heads/master
Status: new
Topic: bump-dev-deps
Commit: a1203293bd27a09b893309f6ffaf3c50735c7910
Hashtags: n;set-value=2.0.1,n;mixin-deep=1.3.2,CVE-2019-10747,n;union-value=1.0.1,CVE-2019-10746
Tag: autogenerated:gerrit:setHashtag
Groups: a1203293bd27a09b893309f6ffaf3c50735c7910
Reviewer: Libraryupgrader <5266@e9e9afe9-4712-486d-8885-f54b72dd1951>
Label: Code-Review=+2
Private: false
Work-in-progress: falseSo it has indeed both the label and the hashtags. The messages come from https://gerrit.wikimedia.org/r/changes/mediawiki%2Fextensions%2FAbuseFilter~522649/detail?O=916314 which has a series of messages, the first two are:
"messages": [ { "id": "9fbbdb6709a0f5d184ca4f2f7f555675bdc3a13c", "tag": "autogenerated:gerrit:setHashtag", "author": { "_account_id": 5266, "name": "Libraryupgrader", "email": "tools.libraryupgrader@tools.wmflabs.org", "username": "libraryupgrader", "tags": [ "SERVICE_USER" ] }, "real_author": { "_account_id": 5266, "name": "Libraryupgrader", "email": "tools.libraryupgrader@tools.wmflabs.org", "username": "libraryupgrader", "tags": [ "SERVICE_USER" ] }, "date": "2019-07-14 07:35:03.000000000", "message": "Hashtags added: CVE-2019-10746, CVE-2019-10747, n;mixin-deep=1.3.2, n;set-value=2.0.1, n;union-value=1.0.1", "_revision_number": 1 }, { "id": "cbbbf6dc43ec2dd9f01f61c042829123824fa735", "author": { "_account_id": 75, "name": "jenkins-bot", "username": "jenkins-bot", "tags": [ "SERVICE_USER" ] }, "real_author": { "_account_id": 75, "name": "jenkins-bot", "username": "jenkins-bot", "tags": [ "SERVICE_USER" ] }, "date": "2019-07-14 07:35:12.000000000", "message": "Patch Set 1:\n\nStarting gate-and-submit jobs.\nhttps://integration.wikimedia.org/zuul/", "_revision_number": 1 }, ...
Or in short form:
| LibraryUpgrader | Hashtags added: CVE-2019-10746, CVE-2019-10747, n;mixin-deep=1.3.2, n;set-value=2.0.1, n;union-value=1.0.1 |
| jenkins-bot | Patch Set 1:\n\nStarting gate-and-submit jobs.\nhttps://integration.wikimedia.org/zuul/ |
I don't know anything in the internal of Gerrit or how the Create change message is crafted though :-\