From bebbba05c64ea68cbb69b08f6eb74995265bb027 Mon Sep 17 00:00:00 2001
From: Dan Shernicoff <dan@brassnet.biz>
Date: Thu, 5 Nov 2026 22:35:15 -0500
Subject: [PATCH] Update `gh-profiler` workflow to ignore trusted users

---
 .github/workflows/profile_contributors.yml | 30 +++++++++++++++++-----
 gh-profiler.toml                           | 10 ++++++++
 2 files changed, 33 insertions(+), 7 deletions(-)
 create mode 100644 gh-profiler.toml

diff --git a/.github/workflows/profile_contributors.yml b/.github/workflows/profile_contributors.yml
index f3c14f1..60da4f7 100644
--- a/.github/workflows/profile_contributors.yml
+++ b/.github/workflows/profile_contributors.yml
@@ -16,12 +16,18 @@ jobs:
     if: github.event.action == 'opened'
 
     permissions:
+      contents: read
       issues: write
       pull-requests: write
 
     runs-on: ubuntu-latest
 
     steps:
+      # Load trust configuration from the trusted base/default branch, never PR head code.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.base.ref || github.event.repository.default_branch }}
+          persist-credentials: false
       - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       - name: Determine target login and issue number
         id: meta
@@ -31,6 +37,7 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           PR_USER_LOGIN: ${{ github.event.pull_request.user.login }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
+          
         run: |
           if [ "$EVENT_NAME" = "issues" ]; then
             echo "login=$ISSUE_USER_LOGIN" >> "$GITHUB_OUTPUT"
@@ -43,11 +50,25 @@ jobs:
           fi
 
       - name: Run gh-profiler (=== Expand this to see full profile output ===)
+        id: profile
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           LOGIN: ${{ steps.meta.outputs.login }}
         run: |
           uvx gh-profiler@latest "$LOGIN" --concise > profiler.txt
+          if grep -Fq "User $LOGIN is a trusted" profiler.txt; then
+            echo "trusted=true" >> "$GITHUB_OUTPUT"
+            echo "Trusted account; skipping profile output and comment."
+            exit 0
+          fi
+          echo "trusted=false" >> "$GITHUB_OUTPUT"
+          echo
+          echo "======================= Concise profile ======================="
+          echo
+          cat profiler.txt
+          echo
+          echo "==============================================================="
+          echo
           echo
           echo "======================== Full profile ========================="
           echo
@@ -56,6 +77,7 @@ jobs:
           echo "==============================================================="
 
       - name: Comment on issue or PR
+        if: steps.profile.outputs.trusted != 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SERVER_URL: ${{ github.server_url }}
@@ -67,13 +89,7 @@ jobs:
         run: |
           {
             echo "<!-- gh-profiler:profile-link run-id=$RUN_ID -->"
-            echo "Profile summary:"
-            echo
-            echo '```text'
-            cat profiler.txt
-            echo '```'
-            echo
-            echo "<a href=\"$SERVER_URL/$REPOSITORY/actions/runs/$RUN_ID/job/$CHECK_RUN_ID\">Full profile</a>"
+            echo "<a href=\"$SERVER_URL/$REPOSITORY/actions/runs/$RUN_ID/job/$CHECK_RUN_ID\">Contributor profile</a>"
             echo
             echo "(This comment and the linked profile output will auto-delete when this $ISSUE_PR is closed.)"
           } > body.txt
diff --git a/gh-profiler.toml b/gh-profiler.toml
new file mode 100644
index 0000000..d652e76
--- /dev/null
+++ b/gh-profiler.toml
@@ -0,0 +1,10 @@
+# Don't profile these trusted contributors.
+# This can be overridden with `--ignore-trusted`.
+trusted_contributors = [
+    "kjaymiller",
+    "brass75",
+]
+
+trusted_bots = [
+    "dependabot[bot]",
+]