ton/pi_harness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: restrict bot gate bypasses

Browse Source 
Refs #6127
This commit is contained in:
Armin Ronacher
2026-06-28 18:53:35 +02:00
parent a8c692c712
commit 8f64353e65
2 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/issue-gate.yml
+6 -4
View File
@@ -17,11 +17,13 @@ jobs:
script: | script: |
const APPROVED_FILE = '.github/APPROVED_CONTRIBUTORS'; const APPROVED_FILE = '.github/APPROVED_CONTRIBUTORS';
const VALID_CAPABILITIES = new Set(['issue', 'pr']); const VALID_CAPABILITIES = new Set(['issue', 'pr']);
const TRUSTED_BOT_AUTHORS = new Set(['dependabot[bot]', 'sentry[bot]', 'claude[bot]']);
const issueAuthor = context.payload.issue.user.login; const issueAuthor = context.payload.issue.user.login;
const defaultBranch = context.payload.repository.default_branch; const defaultBranch = context.payload.repository.default_branch;
const isBotAuthor = issueAuthor.endsWith('[bot]');
if (issueAuthor.endsWith('[bot]') || issueAuthor === 'dependabot[bot]') { if (TRUSTED_BOT_AUTHORS.has(issueAuthor)) {
console.log(`Skipping bot: ${issueAuthor}`); console.log(`Skipping trusted bot: ${issueAuthor}`);
return; return;
} }
@@ -80,7 +82,7 @@ jobs:
} }
const permission = await getPermission(issueAuthor); const permission = await getPermission(issueAuthor);
if (['admin', 'maintain', 'write'].includes(permission)) { if (!isBotAuthor && ['admin', 'maintain', 'write'].includes(permission)) {
console.log(`${issueAuthor} is a collaborator with ${permission} access`); console.log(`${issueAuthor} is a collaborator with ${permission} access`);
return; return;
} }
@@ -89,7 +91,7 @@ jobs:
const approvedUsers = parseApprovedUsers(approvedContent); const approvedUsers = parseApprovedUsers(approvedContent);
const capability = approvedUsers.get(issueAuthor.toLowerCase()); const capability = approvedUsers.get(issueAuthor.toLowerCase());
if (capability === 'issue' || capability === 'pr') { if (!isBotAuthor && (capability === 'issue' || capability === 'pr')) {
console.log(`${issueAuthor} is approved for ${capability}`); console.log(`${issueAuthor} is approved for ${capability}`);
return; return;
} }
.github/workflows/pr-gate.yml
+6 -4
View File
@@ -18,11 +18,13 @@ jobs:
script: | script: |
const APPROVED_FILE = '.github/APPROVED_CONTRIBUTORS'; const APPROVED_FILE = '.github/APPROVED_CONTRIBUTORS';
const VALID_CAPABILITIES = new Set(['issue', 'pr']); const VALID_CAPABILITIES = new Set(['issue', 'pr']);
const TRUSTED_BOT_AUTHORS = new Set(['dependabot[bot]', 'sentry[bot]', 'claude[bot]']);
const prAuthor = context.payload.pull_request.user.login; const prAuthor = context.payload.pull_request.user.login;
const defaultBranch = context.payload.repository.default_branch; const defaultBranch = context.payload.repository.default_branch;
const isBotAuthor = prAuthor.endsWith('[bot]');
if (prAuthor.endsWith('[bot]') || prAuthor === 'dependabot[bot]') { if (TRUSTED_BOT_AUTHORS.has(prAuthor)) {
console.log(`Skipping bot: ${prAuthor}`); console.log(`Skipping trusted bot: ${prAuthor}`);
return; return;
} }
@@ -97,7 +99,7 @@ jobs:
} }
const permission = await getPermission(prAuthor); const permission = await getPermission(prAuthor);
if (['admin', 'maintain', 'write'].includes(permission)) { if (!isBotAuthor && ['admin', 'maintain', 'write'].includes(permission)) {
console.log(`${prAuthor} is a collaborator with ${permission} access`); console.log(`${prAuthor} is a collaborator with ${permission} access`);
return; return;
} }
@@ -106,7 +108,7 @@ jobs:
const approvedUsers = parseApprovedUsers(approvedContent); const approvedUsers = parseApprovedUsers(approvedContent);
const capability = approvedUsers.get(prAuthor.toLowerCase()); const capability = approvedUsers.get(prAuthor.toLowerCase());
if (capability === 'pr') { if (!isBotAuthor && capability === 'pr') {
console.log(`${prAuthor} is approved for PRs`); console.log(`${prAuthor} is approved for PRs`);
return; return;
} }