From 3d73238c008a6f15b843ef3ab504ac45d5f42f9e Mon Sep 17 00:00:00 2001 From: Keith Williams Date: Mon, 5 Jan 2026 12:19:39 -0300 Subject: [PATCH] fix: remove installation requirement from trusted bot check (#26466) * fix: remove installation requirement from trusted bot check The installation object is not present in the webhook payload when GitHub Apps add labels via pull_request_target events. This caused graphite-app[bot] to fail the authorization check and fall through to the human permission check, which doesn't work for bots. The fix removes the installation requirement and relies on: - sender.type === 'Bot' - sender.login matching the trusted bot list This is secure because the sender fields come from GitHub's webhook payload and cannot be forged by contributors. Co-Authored-By: keith@cal.com * chore: add extra logging about sender type Co-Authored-By: keith@cal.com * chore: remove senderId from logging Co-Authored-By: keith@cal.com * Update run-ci.yml --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .github/workflows/run-ci.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/run-ci.yml b/.github/workflows/run-ci.yml index 1d96a65ce2..00ba78b46b 100644 --- a/.github/workflows/run-ci.yml +++ b/.github/workflows/run-ci.yml @@ -21,13 +21,14 @@ jobs: const adder = context.payload.sender.login; const senderType = context.payload.sender.type; const pr = context.payload.pull_request; - const installation = context.payload.installation; + + console.log(`Sender: ${adder} (type: ${senderType})`); const trustedBotLogins = ['graphite-app[bot]']; let isAuthorized = false; - if (senderType === 'Bot' && installation && trustedBotLogins.includes(adder)) { - console.log(`Label added by trusted GitHub App: ${adder}`); + if (senderType === 'Bot' && trustedBotLogins.includes(adder)) { + console.log(`Authorized: trusted GitHub App`); isAuthorized = true; } @@ -43,7 +44,7 @@ jobs: return; } - console.log(`Label added by ${adder} (${perm.permission})`); + console.log(`Label added by ${adder}`); } // Find the latest pr.yml run for this PR's head SHA