From 334ad9b3134968520819fec300cf2cd3fc94f7a6 Mon Sep 17 00:00:00 2001 From: Ben Meadors Date: Wed, 10 Jun 2026 06:33:33 -0500 Subject: [PATCH] Restrict web flasher link comments to organization members only --- .github/workflows/flasher-link-comment.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/flasher-link-comment.yml b/.github/workflows/flasher-link-comment.yml index bc06a92e1..cd1f695df 100644 --- a/.github/workflows/flasher-link-comment.yml +++ b/.github/workflows/flasher-link-comment.yml @@ -41,10 +41,12 @@ jobs: const { data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: prNumber }); - // Only comment on PRs from contributors and members - const allowedAssociations = ['OWNER', 'MEMBER', 'COLLABORATOR', 'CONTRIBUTOR']; + // Only comment on PRs authored by members of the organization. + // author_association MEMBER is computed by GitHub and reflects org + // membership (including concealed members); OWNER covers a repo owner. + const allowedAssociations = ['OWNER', 'MEMBER']; if (!allowedAssociations.includes(pr.author_association)) { - core.info(`Author association ${pr.author_association} is not eligible; skipping.`); + core.info(`Author association ${pr.author_association} is not an org member; skipping.`); return; } if (pr.state !== 'open') {