Gate CI on sync PRs to require committer authorship#423
Gate CI on sync PRs to require committer authorship#423holly-cummins merged 1 commit intoquarkusio:mainfrom
Conversation
Sync PRs from non-committers could run CI on untrusted code. This adds a ci-gate job that checks the original commit author's repo permissions and blocks CI unless they have write access or the `ci-approved` label is added manually. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
How does the |
|
Also, this PR would be instead of #422, correct? |
No, in addition. They're sort of orthogonal and can be merged in either order, but merging this one first would be marginally more secure. |
That's not the intention. This is what comes of rushing a PR before a forced machine reboot. Will fix, thank you! |
Nevermind, I'd already done that and forgotten. :) It's here: |
Aha! I read/commented on the text before I looked at any of the changes (you know, make sure the flow matches expectations....) :) |
2 participants
See discussion in #423.
This updates the 'main' workflow to ensure that 'mirrors' of PRs created from forks don't automatically run. It uses labels, so it's easily bypassed, but only by people with label permissions on the repo.
ci-gatejob that checks whether sync PR commit authors have write access to the repoci-approvedlabel is manually addedHow it works
ci-gatejob runs first on every PRsynclabel, it queries the GitHub API for the commit author's repo permissionsci-approvedlabel is presentci-approvedto a blocked PR re-triggers the workflow (via the newlabeledevent type)It's pretty complex code, so as ever with workflow changes, we may not really be able to test it until merging.