Merge upstream release-v4.3 into patched/release-v4.3

.github/workflows/merge-upstream.yml

@@ -18,6 +18,7 @@ jobs:
     steps:
       - uses: actions/checkout@v2
         with:
+          ref: patches
           fetch-depth: 0
           ssh-key: ${{ secrets.DEPLOY_KEY }}
       - run: bash scripts/upgradeable/git-user-config.sh

scripts/upgradeable/merge-upstream.sh

@@ -18,5 +18,14 @@ upstream="${input#patched/}"
 branch="patched/$upstream"
 
 git checkout "$branch" 2>/dev/null || git checkout -b "$branch" origin/patches --no-track
+
+git fetch 'https://github.com/OpenZeppelin/openzeppelin-contracts.git' master
+merge_base="$(git merge-base origin/patches FETCH_HEAD)"
+
 git fetch 'https://github.com/OpenZeppelin/openzeppelin-contracts.git' "$upstream"
+# Check that patches is not ahead of the upstream branch we're merging.
+if ! git merge-base --is-ancestor "$merge_base" FETCH_HEAD; then
+  echo "The patches branch is ahead of $upstream" >&2
+  exit 1
+fi
 git merge origin/patches FETCH_HEAD -m "Merge upstream $upstream into $branch"