Support for team on commit[*].author

[nathan-ahn]

According to this article from a few years back, the list of conditions that supports checking the user's team are:

• assignee
• approved-reviews-by
• author
• changes-requested-reviews-by
• commented-reviews-by
• dismissed-reviews-by
• review-requested

Any chance that commits[*].author could be added to this list for support? Would help unblock us on a complex rule that we're trying to set up.

I'm imagining the condition would look like:
- commits[*].author = @team-name

[jd]

Hey @nathan-ahn !

Could you elaborate on your use case here? :)

[nathan-ahn]

I'm working on a condition that checks if a pull request is safe based on the author being a part of a specific team. As an additional check, I'd like to also see if all the commits belong to that team as well to reduce risk for someone "hijacking" the pull request with their own code changes. Similar functionality could be achieved by checking if all commits belong to the author, but I couldn't figure out a good way to do that dynamically without hard-coding author usernames.

[jd]

Interesting. Though considering you can fake the author of any commit pretty easily, anyone can hijack the content of a pull request AFAICT. You sure this is really as safe as you imagine it to be?

[nathan-ahn]

Fair enough! Yeah, it's probably not worth trying to enforce anything at this level considering the larger gap. Thanks Julien!