Restrict cherry-pick comments to owners and members

Signed-off-by: Minh Vu <vuhoangminh97@gmail.com>

Author: fallintoplace

.github/scripts/add-labels-from-comment.js

@@ -17,9 +17,16 @@
 module.exports = async ({ github, context, core }) => {
   const commentBody = context.payload.comment.body;
   const prNumber = context.payload.issue.number;
+  const trustedAssociations = new Set(['OWNER', 'MEMBER']);
+  const authorAssociation = context.payload.comment.author_association;
 
   core.info(`Processing comment: ${commentBody}`);
 
+  if (!trustedAssociations.has(authorAssociation)) {
+    core.warning(`Ignoring /cherry-pick comment from ${authorAssociation || 'unknown'} author association`);
+    return { success: false, message: 'Unauthorized comment author' };
+  }
+
   // Parse comment for /cherry-pick branches
   const cherryPickPattern = /^\/cherry-pick\s+(.+)$/m;
   const match = commentBody.match(cherryPickPattern);
@@ -107,4 +114,3 @@ module.exports = async ({ github, context, core }) => {
     };
   }
 };
-

.github/workflows/cherrypick.yml

@@ -20,10 +20,7 @@ on:
   pull_request_target:
     types: [closed]
 
-permissions:
-  contents: write
-  pull-requests: write
-  issues: write
+permissions: {}
 
 jobs:
   add-labels:
@@ -33,7 +30,12 @@ jobs:
     if: |
       github.event_name == 'issue_comment' &&
       github.event.issue.pull_request && 
-      startsWith(github.event.comment.body, '/cherry-pick')
+      startsWith(github.event.comment.body, '/cherry-pick') &&
+      contains(fromJSON('["OWNER", "MEMBER"]'), github.event.comment.author_association)
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
 
     steps:
       - name: Checkout repository
@@ -62,6 +64,10 @@ jobs:
       github.event_name == 'pull_request_target' &&
       github.event.pull_request.merged == true &&
       contains(join(github.event.pull_request.labels.*.name, ','), 'cherry-pick/')
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
 
     steps:
       - name: Checkout base branch repository