kevin/meshtastic_firmware
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

fix(workflows): expand trusted author criteria for flasher comments

Browse Source
This commit is contained in:
Ben Meadors
2026-06-10 20:04:40 -05:00
parent 1490daa7ca
commit a14f7afe87
2 changed files with 14 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/flasher-link-comment.yml
+9 -5
View File
@@ -54,12 +54,16 @@ jobs:
} }
const prNumber = pr.number; const prNumber = pr.number;
// Only comment on PRs authored by members of the organization. // Restrict to trusted authors. NOTE: author_association is computed for
// author_association MEMBER is computed by GitHub and reflects org // the GITHUB_TOKEN, which cannot see *private/concealed* org memberships —
// membership (including concealed members); OWNER covers a repo owner. // those members come back as CONTRIBUTOR, not MEMBER. So gating on MEMBER
const allowedAssociations = ['OWNER', 'MEMBER']; // alone silently excludes most maintainers. We allow the trusted set the
// token can actually identify (members, collaborators, and anyone with a
// previously merged PR). For strict members-only you'd need an org-read
// App/PAT token to call orgs.checkMembershipForUser.
const allowedAssociations = ['OWNER', 'MEMBER', 'COLLABORATOR', 'CONTRIBUTOR'];
if (!allowedAssociations.includes(pr.author_association)) { if (!allowedAssociations.includes(pr.author_association)) {
core.info(`Author association ${pr.author_association} is not an org member; skipping.`); core.info(`Author association ${pr.author_association} is not trusted; skipping.`);
return; return;
} }
.github/workflows/flasher-link-placeholder.yml
+5 -3
View File
@@ -29,10 +29,12 @@ jobs:
const { owner, repo } = context.repo; const { owner, repo } = context.repo;
const pr = context.payload.pull_request; const pr = context.payload.pull_request;
// Only org members get the flasher comment (matches the real workflow) // Trusted authors only (matches the real workflow). author_association
const allowedAssociations = ['OWNER', 'MEMBER']; // can't reflect private org membership for the token, so concealed
// members appear as CONTRIBUTOR — include it, or maintainers are excluded.
const allowedAssociations = ['OWNER', 'MEMBER', 'COLLABORATOR', 'CONTRIBUTOR'];
if (!allowedAssociations.includes(pr.author_association)) { if (!allowedAssociations.includes(pr.author_association)) {
core.info(`Author association ${pr.author_association} is not an org member; skipping.`); core.info(`Author association ${pr.author_association} is not trusted; skipping.`);
return; return;
} }