kevin/meshtastic-firmware
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

fix(workflows): expand trusted author criteria for flasher comments

Browse Source
This commit is contained in:
Ben Meadors
2026-06-10 20:04:40 -05:00
parent 1490daa7ca
commit a14f7afe87
2 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/flasher-link-comment.yml
+9 -5
View File
@@ -54,12 +54,16 @@ jobs:
}
const prNumber = pr.number;
// Only comment on PRs authored by members of the organization.
// author_association MEMBER is computed by GitHub and reflects org
// membership (including concealed members); OWNER covers a repo owner.
const allowedAssociations = ['OWNER', 'MEMBER'];
// Restrict to trusted authors. NOTE: author_association is computed for
// the GITHUB_TOKEN, which cannot see *private/concealed* org memberships —
// those members come back as CONTRIBUTOR, not MEMBER. So gating on MEMBER
// alone silently excludes most maintainers. We allow the trusted set the
// token can actually identify (members, collaborators, and anyone with a
// previously merged PR). For strict members-only you'd need an org-read
// App/PAT token to call orgs.checkMembershipForUser.
const allowedAssociations = ['OWNER', 'MEMBER', 'COLLABORATOR', 'CONTRIBUTOR'];
if (!allowedAssociations.includes(pr.author_association)) {
core.info(`Author association ${pr.author_association} is not an org member; skipping.`);
core.info(`Author association ${pr.author_association} is not trusted; skipping.`);
return;
}
.github/workflows/flasher-link-placeholder.yml
+5 -3
View File
@@ -29,10 +29,12 @@ jobs:
const { owner, repo } = context.repo;
const pr = context.payload.pull_request;
// Only org members get the flasher comment (matches the real workflow)
const allowedAssociations = ['OWNER', 'MEMBER'];
// Trusted authors only (matches the real workflow). author_association
// can't reflect private org membership for the token, so concealed
// members appear as CONTRIBUTOR — include it, or maintainers are excluded.
const allowedAssociations = ['OWNER', 'MEMBER', 'COLLABORATOR', 'CONTRIBUTOR'];
if (!allowedAssociations.includes(pr.author_association)) {
core.info(`Author association ${pr.author_association} is not an org member; skipping.`);
core.info(`Author association ${pr.author_association} is not trusted; skipping.`);
return;
}