Files
calendar/.github/workflows
Keith WilliamsGitHubDevin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
3d73238c00 fix: remove installation requirement from trusted bot check (#26466)
* fix: remove installation requirement from trusted bot check

The installation object is not present in the webhook payload when
GitHub Apps add labels via pull_request_target events. This caused
graphite-app[bot] to fail the authorization check and fall through
to the human permission check, which doesn't work for bots.

The fix removes the installation requirement and relies on:
- sender.type === 'Bot'
- sender.login matching the trusted bot list

This is secure because the sender fields come from GitHub's webhook
payload and cannot be forged by contributors.

Co-Authored-By: [email protected] <[email protected]>

* chore: add extra logging about sender type

Co-Authored-By: [email protected] <[email protected]>

* chore: remove senderId from logging

Co-Authored-By: [email protected] <[email protected]>

* Update run-ci.yml

---------

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-01-05 15:19:39 +00:00
..
2025-12-29 13:20:01 +00:00