fix(e2e): use event author_association for trusted member gate

[ifireball]

Fixes #2157

Summary

• Pass github.event.pull_request.author_association into the e2e gate and prefer it for trusted-author checks
• Keep REST API lookups for ok-to-test label freshness (labels/events)
• Document why the event payload is required (GITHUB_TOKEN lacks read:org)

Problem

PR #2106 authorized trusted authors via gh api .../pulls/... with GITHUB_TOKEN. That token cannot see org membership, so members (including fork PR authors like #1954) were misclassified as unauthorized and e2e was skipped despite the gate job succeeding.

Test plan

• bash scripts/check-e2e-authorization-test.sh
• Merge and re-run E2E Tests on PR feat(install)!: add --vendor for self-contained workflow and agent assets #1954 — gate should set authorized=true, e2e job should run

Made with Cursor

[github-actions]

E2E tests did not run

E2E tests run automatically for org/repo members and collaborators on pull requests.

For other contributors, a maintainer must add the ok-to-test label after the latest push.

See E2E testing guide for details.

[github-actions]

Site preview

Preview: https://968ddf31-site.fullsend-ai.workers.dev

Commit: 106ba9aab41da6d03704c1d28e51ade3e3675a36

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:49 AM UTC · Completed 9:00 AM UTC
Commit: b7f1671 · View workflow run →

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] .github/actions/check-e2e-authorization/action.yml, .github/workflows/e2e.yml, scripts/check-e2e-authorization.sh, scripts/check-e2e-authorization-test.sh — This PR modifies 4 files under protected paths (.github/, scripts/). The change is well-justified by linked issue fix(e2e): gate misclassifies org members as unauthorized (GITHUB_TOKEN lacks read:org) #2157 (fixing a regression where org members are misclassified as unauthorized due to GITHUB_TOKEN lacking read:org), but human approval is always required for protected-path changes regardless of context.

Previous run

Review

Findings

Medium

• [protected-path] .github/actions/check-e2e-authorization/action.yml, .github/workflows/e2e.yml, scripts/check-e2e-authorization.sh, scripts/check-e2e-authorization-test.sh — This PR modifies 4 files under protected paths (.github/, scripts/). The change is well-justified by linked issue fix(e2e): gate misclassifies org members as unauthorized (GITHUB_TOKEN lacks read:org) #2157 (fixing a regression where org members are misclassified as unauthorized), but human approval is always required for protected-path changes regardless of context.

Low

• [test adequacy] scripts/check-e2e-authorization-test.sh — The new test case verifies that a trusted PR_AUTHOR_ASSOCIATION (MEMBER) skips the API call, but there is no test for when PR_AUTHOR_ASSOCIATION is set to a non-trusted value (e.g., NONE or CONTRIBUTOR) and the script falls through to the label-check path. In that scenario, pr_json is never assigned by the initial block, so the lazy fetch pr_json="${pr_json:-$(gh api ...)}" is exercised — a novel code path that could regress if someone refactors the variable initialization. Adding a test with PR_AUTHOR_ASSOCIATION=CONTRIBUTOR plus an ok-to-test label would cover this branch.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:07 AM UTC · Completed 9:16 AM UTC
Commit: 106ba9a · View workflow run →

[rh-hemartin]

LGTM

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 9:39 AM UTC · Completed 9:42 AM UTC
Commit: 106ba9a · View workflow run →

[fullsend-ai-retro]

Retro: PR #2158 — fix(e2e): use event author_association for trusted member gate

This was a well-executed workflow with no significant improvement opportunities.

Timeline: Human (ifireball) filed #2157 and opened PR #2158 within seconds (already had the fix via Cursor). The review agent ran in ~11 minutes and correctly identified a missing test case for the fallback path when PR_AUTHOR_ASSOCIATION is a non-trusted value. The human addressed the feedback with a second commit, the review agent re-reviewed and confirmed the gap was resolved, a human reviewer approved, and the PR merged — 48 minutes end-to-end.

What went well:

• Review agent provided genuinely useful feedback (test adequacy gap) that improved the final code
• No false positives — both findings (protected-path, test adequacy) were appropriate
• The human acted on the feedback quickly, and the re-review correctly acknowledged the fix
• Fast time to resolution with no wasted iterations

No proposals filed. The review agent performed well, the human-agent collaboration was smooth, and no recurring patterns or systemic issues were identified.