Fix command matching and commenter identification in workflow triggers

[kelos-bot]

Summary

• Add sender.type == 'User' check to skip bot-triggered events at the job if level in both /squash-commits and /reset-worker workflows
• Add regex validation in the gate step to ensure the command appears at the start of a line (not as incidental text in a larger comment)
• Use context.payload.sender.login as the primary source for commenter identification, with comment.user.login and review.user.login as fallbacks

Fixes #496

Test plan

• Verify /squash-commits command works when issued by an admin at the start of a comment on a PR
• Verify /squash-commits text appearing mid-comment (e.g. in a triage report) does not trigger the workflow
• Verify bot comments containing /squash-commits or /reset-worker are skipped at the job level
• Verify /reset-worker command works when issued by an admin at the start of a comment

🤖 Generated with Claude Code

---

Summary by cubic

Prevents false triggers and fixes commenter detection in the /squash-commits and /reset-worker workflows. Commands now only run from user comments that start with the command text, with a fail-closed bot filter. Fixes #496.

• Bug Fixes
  • Skip bot or unknown sender events with a job-level check: sender.type == 'User'.
  • Require the command at the start of a line via regex validation.
  • Identify the actor via context.payload.sender.login, with comment.user.login and review.user.login as fallbacks.

^{Written for commit 56fa174. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/squash-kelos-worker-commits.yaml">

<violation number="1" location=".github/workflows/squash-kelos-worker-commits.yaml:28">
P2: Fail-open bot filter: `|| 'User'` fallback defaults unknown sender types to `'User'`, bypassing the bot check. If `sender.type` is unexpectedly null/empty, the job runs anyway — contradicting the security intent. Remove the fallback so unknown sender types are rejected (fail-closed).</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}