From f113f9029cae1d5be181b7580a0f6b499bcd49bb Mon Sep 17 00:00:00 2001 From: "zengfanou.1212" Date: Tue, 15 Sep 2026 15:31:19 +0800 Subject: [PATCH] fix(ci): restrict README gate confirmations Only allow the PR author or trusted repository actors to confirm README-only PRs, preventing unrelated commenters from moving pending submissions to ready for review. Fixes #4796 Co-Authored-By: Claude Code --- .github/workflows/readme-pr-check.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/workflows/readme-pr-check.yml b/.github/workflows/readme-pr-check.yml index ec5a0a2944..76004bc2ae 100644 --- a/.github/workflows/readme-pr-check.yml +++ b/.github/workflows/readme-pr-check.yml @@ -63,6 +63,7 @@ jobs: if: github.event_name == 'issue_comment' && github.event.issue.pull_request && contains(github.event.comment.body, '/i-promise-this-is-not-a-new-server') runs-on: ubuntu-latest permissions: + issues: write pull-requests: write steps: - name: Swap labels and minimize comments @@ -72,6 +73,15 @@ jobs: const { owner, repo } = context.repo; const prNumber = context.payload.issue.number; + const association = context.payload.comment.author_association; + const trustedAssociations = ['OWNER', 'MEMBER', 'COLLABORATOR']; + const commenter = context.payload.comment.user.login; + const prAuthor = context.payload.issue.user.login; + if (commenter !== prAuthor && !trustedAssociations.includes(association)) { + console.log(`Ignoring confirmation from unauthorized commenter ${commenter} (${association})`); + return; + } + // Check if pending label exists const { data: labels } = await github.rest.issues.listLabelsOnIssue({ owner, repo, issue_number: prNumber }); if (!labels.some(l => l.name === 'readme: pending')) {