Repository navigation
[code-infra] Authorize labeled triage replies from issue authors and members - #1944
Conversation
Deploy previewBundle sizeTotal Size Change: 0B(0.00%) - Total Gzip Change: 0B(0.00%) Show details for 79 more bundles@mui/internal-docs-infra/abstractCreateDemo parsed: 0B(0.00%) gzip: 0B(0.00%) PerformanceNo regressions in 8 benchmarks · ran 54s · details Check out the code infra dashboard for more information about this PR. |
brijeshb42
changed the title
brijeshb42
added
the
scope: code-infra
| with: | ||
| github_token: ${{ github.token }} # Use this job's read-only token instead of minting an App token. | ||
| allowed_bots: ${{ needs.authorize.outputs.allowed-bot }} # Forward only the bot approved by authorization. | ||
| allowed_non_write_users: ${{ needs.authorize.outputs.allowed-user }} # Forward only the human reply approved by authorization. |
There was a problem hiding this comment.
This whitelists the issue author temporarily so that the triage job takes the comment into consideration.
brijeshb42
changed the title
Separate reply validation into early returns so the authorization rules are easier to audit without changing who can trigger triage.
Keep comment retriage active after the request label is replaced by the completed-triage label without requiring caller overrides.
84e3f50 to
64273e7
Compare
|
@Janpot Can you review this. |
Allow issue authors, repository collaborators, and organization members to retrigger triage on labeled issues.
triage-comment-labelsdefaults to["ai: needs-triage", "ai: triaged"]; callers can override the list or pass[]for maintainer-only comment authorization.The workflow checks live labels, the triggering comment, and commenter identity before granting access. It forwards only the authorized username to Claude. Bot replies and fix requests cannot use this exception. Reply validation uses early returns.
Used by mui/material-ui#49454. Validation: 24 authorization scenarios using the declared default, workflow lint, mstack checks, formatting, build, TypeScript, and CLI passed. Live Actions execution remains unverified.