Keith WilliamsGitHubkeith@cal.com <keithwillcode@gmail.com>keith@cal.com <keithwillcode@gmail.com>keith@cal.com <keithwillcode@gmail.com>Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix: remove installation requirement from trusted bot check
The installation object is not present in the webhook payload when
GitHub Apps add labels via pull_request_target events. This caused
graphite-app[bot] to fail the authorization check and fall through
to the human permission check, which doesn't work for bots.
The fix removes the installation requirement and relies on:
- sender.type === 'Bot'
- sender.login matching the trusted bot list
This is secure because the sender fields come from GitHub's webhook
payload and cannot be forged by contributors.
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* chore: add extra logging about sender type
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* chore: remove senderId from logging
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* Update run-ci.yml
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
