4 Commits

Include renames

Author	SHA1	Message	Date
6 people	3d73238c00	fix: remove installation requirement from trusted bot check (#26466) ... * fix: remove installation requirement from trusted bot check The installation object is not present in the webhook payload when GitHub Apps add labels via pull_request_target events. This caused graphite-app[bot] to fail the authorization check and fall through to the human permission check, which doesn't work for bots. The fix removes the installation requirement and relies on: - sender.type === 'Bot' - sender.login matching the trusted bot list This is secure because the sender fields come from GitHub's webhook payload and cannot be forged by contributors. Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * chore: add extra logging about sender type Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * chore: remove senderId from logging Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * Update run-ci.yml --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-01-05 15:19:39 +00:00
8 people	3ab6d9096e	fix: cancel running CI workflow before re-triggering and allow trusted GitHub Apps (#26461) ... * fix: cancel running CI workflow before re-triggering and allow trusted bots Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: remove hardcoded bot allowlist, keep only cancel-and-rerun improvement Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: add app_id verification for trusted GitHub Apps (Graphite) Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * fix: simplify trusted bot check to use sender type, login, and installation context Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> * chore: remove unnecessary comments Co-Authored-By: keith@cal.com <keithwillcode@gmail.com> --------- Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-01-05 11:58:20 -03:00
3 people	8ef7b56b37	feat: re-trigger pr.yml when ready-for-e2e label is added (#26376) ... Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>	2026-01-01 20:42:12 -03:00
Pedro CastroandGitHub	4226dfb05f	fix(ci): improve security for external contributions (#26327) ... - Remove pull_request_review trigger - Add trust-check job to validate PR authors before running CI - Create run-ci.yml workflow for maintainer approval via label - Use workflow run timestamp to prevent backdating attacks - Add per_page and in-progress checks for robustness	2025-12-31 00:16:52 -03:00