Add trusted GitHub actor allowlist

[justin808]

Summary

• add the repo-local trusted GitHub actor allowlist used by pr-security-preflight
• seed the policy from react_on_rails and include this repo's github-actions preview-comment bot
• unblock the current exact PR batch without broadening trust to unknown actors

Why

The current batch security preflight failed because reactonrails.com had no .agents/trusted-github-actors.yml, so all PR authors, reviewers, and preview-comment bots were treated as untrusted. This file makes the trust boundary explicit and auditable in this repo.

Test plan

• PR_BATCH_SKILL_DIR=/Users/justin/.codex/skills/pr-batch; "$PR_BATCH_SKILL_DIR/bin/pr-security-preflight" --repo shakacode/reactonrails.com 131 130 102 132 129 113
• npm run install:site
• npm run prepare
• npm run build (passes; Docusaurus reports existing generated-doc broken-link/anchor warnings)

Summary by CodeRabbit

• Chores
  • Tightened which GitHub accounts can trigger automation from public comments.
  • Unrecognized comments are now left for maintainer review instead of being treated as instructions, reducing accidental actions and improving safety.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

@justin808, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 51 minutes and 55 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2404b5ac-f187-4092-ae41-8f7388406f65

📥 Commits

Reviewing files that changed from the base of the PR and between 608b794 and c1d0727.

📒 Files selected for processing (1)

• .agents/trusted-github-actors.yml

Walkthrough

Adds a GitHub actors allowlist for PR-batch automation, listing trusted users, bots, and teams and documenting that unknown actors are sent to maintainer triage.

Changes

Trusted GitHub actors allowlist

Layer / File(s)	Summary
Allowlist entries and comments .agents/trusted-github-actors.yml	Defines trusted_users, trusted_bots, and trusted_teams entries for PR-batch automation, with comments describing the allowlist constraints.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding a trusted GitHub actor allowlist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/trusted-github-actors

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Cloudflare preview deployed.

• Branch: pr-133
• URL: https://86ee8c7c.reactonrails-com.pages.dev

[greptile-apps]

Greptile Summary

This PR adds a repo-local trusted actor policy for PR-batch automation. The main changes are:

• New .agents/trusted-github-actors.yml allowlist.
• Trusted human user entry for justin808.
• Trusted bot base names for review, automation, and preview-comment bots.
• Trusted GitHub team slug for shakacode.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
.agents/trusted-github-actors.yml	Adds the trusted users, bot base names, and team slug consumed by PR-batch security preflight automation.

_{Reviews (1): Last reviewed commit: "Trust reviewed GitHub actors for PR batc..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.agents/trusted-github-actors.yml:
- Line 18: The trusted actor allowlist is too broad because it includes
github-actions, which can let unrelated workflow comments influence
pr-security-preflight. Update the trusted-github-actors.yml allowlist to remove
github-actions and rely on a distinct preview bot/app identity instead, or add
separate provenance checks in the code that reads this allowlist so only the
intended preview workflow actor is trusted.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3e075052-2f1a-42bd-a28c-f9572c71c15d

📥 Commits

Reviewing files that changed from the base of the PR and between b984365 and 608b794.

📒 Files selected for processing (1)

• .agents/trusted-github-actors.yml