Skip to content

fix(triage): never auto-approve cross-repo refactor PRs #5744

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yiliang114 merged 1 commit into from
Jun 23, 2026
Merged

fix(triage): never auto-approve cross-repo refactor PRs #5744

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .qwen/skills/triage/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,11 @@ gh label list --repo "$REPO" --limit 200
or `gh api -F body=@FILE` when the response ID is needed. Never `--body @FILE`
or `gh api -f body=@FILE` — those post the path literally.
- Drafts: skip
- **Approval guardrail**: never auto-approve a cross-repository (fork) PR whose
title is a `refactor` type (starts with `refactor` — `refactor:`,
`refactor(scope):`, `refactor(scope)!:`, case-insensitive). Review it as usual,
but escalate to the maintainer in place of approval. See `references/pr-workflow.md`
Stage 3 for the deterministic check.

## Duplicate Guard

Expand Down
13 changes: 11 additions & 2 deletions .qwen/skills/triage/references/pr-workflow.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -238,7 +238,16 @@ If your independent proposal was materially simpler — say so. Not as a blocker

**Step 2: Act on the verdict.**

All stages genuinely clean — approve:
**⛔ Approval guardrail — check this BEFORE approving.** A cross-repository (fork) `refactor` PR must never be auto-approved: refactors touch structure broadly and a fork author is not a trusted committer, so these always need a human maintainer's eye (this rule exists because such a PR was wrongly auto-approved and merged). Decide it deterministically — do not eyeball it:

```bash
GUARD=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json isCrossRepository,title \
--jq 'if (.isCrossRepository and (.title | test("^\\s*refactor"; "i"))) then "block" else "ok" end')
```

If `GUARD` is `block`: do **not** run `gh pr review --approve` no matter how clean every stage looked. Escalate to the maintainer instead (the "Genuinely unsure" path below, using `$QWEN_MAINTAINER_HANDLE` if set), and only `--request-changes` if you actually found blocking issues. This overrides the "approve" path.

All stages genuinely clean **and** `GUARD` is `ok` — approve:

```bash
gh pr review "$PR_NUMBER" --repo "$REPO" --approve --body "LGTM, looks ready to ship. ✅"
Expand All @@ -250,4 +259,4 @@ Reflection shows it shouldn't merge — request changes immediately, citing the
gh pr review "$PR_NUMBER" --repo "$REPO" --request-changes --body "Needs some rethinking — see my notes above. 🙏"
```

Genuinely unsure — **don't approve or reject**. Ask the maintainer to weigh in. Use `$QWEN_MAINTAINER_HANDLE` if set.
Genuinely unsure, or `GUARD` blocked approval — **don't approve or reject**. Ask the maintainer to weigh in. Use `$QWEN_MAINTAINER_HANDLE` if set.
Loading