ci: make the trust gate a job that says why it declined - #18
Merged
Conversation
A MEMBER opened three issues and all three runs came back "skipped". As a one-line `if:` on the work itself there is no way to tell a correctly-declined run from a broken expression — the log is empty either way, and the only evidence is that nothing happened. The gate is now its own job. It prints the event, the author association, and the decision as a notice, so a skipped run explains itself. The rule is unchanged: same-repository pull requests, and comments or issues from OWNER, MEMBER or COLLABORATOR.
🔍 ShipIT Forge reviewed this PR — 💬 commented (no blocking issues)0 finding(s) (0 security). See the review above for inline details and suggested fixes. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
ShipIT Forge review
✅ No blocking issues found. I reviewed the changed files and ran:
- 🛡️ Security checks — SSRF, injection (SQL/command/template), broken auth/authz, hardcoded secrets, unsafe deserialization, path traversal, weak crypto.
- 🔧 Code review — correctness, error handling, missing tests, clarity.
Nothing to flag. This is a comment, not an approval — ShipIT Forge never approves PRs; a human reviewer should approve and merge.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Three issues opened by a MEMBER produced three runs that all came back
skipped. The gate was a one-lineif:on the work itself, so there was nothing to look at: a correctly-declined run and a broken expression look identical — an empty log and nothing happening.The gate is now its own job. It prints the event, the author association and the decision as a
::notice::, so a skipped run explains itself.The rule is unchanged:
pull_request— same-repository only (a fork PR gets no secrets anyway; failing on every drive-by PR is just noise)OWNER,MEMBERorCOLLABORATORonlyWhy this matters beyond debugging: on a public repo this gate is the whole defence — there is no author check anywhere in the agent. A gate that can silently fail open would be worse than one that fails closed, and until now neither state was visible.