From 608b794b84ac9a807870672557baf2a2439d1efe Mon Sep 17 00:00:00 2001 From: Justin Gordon Date: Fri, 26 Jun 2026 17:37:00 -1000 Subject: [PATCH 1/2] Trust reviewed GitHub actors for PR batching --- .agents/trusted-github-actors.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .agents/trusted-github-actors.yml diff --git a/.agents/trusted-github-actors.yml b/.agents/trusted-github-actors.yml new file mode 100644 index 0000000..535e757 --- /dev/null +++ b/.agents/trusted-github-actors.yml @@ -0,0 +1,23 @@ +# GitHub actors whose public issue/PR/review comments may be acted on by +# PR-batch automation. Keep this list deliberately strict: unknown actors are +# queued for maintainer triage, not interpreted as instructions. +trusted_users: + - justin808 + +# Bot entries are base bot names. GitHub API logins usually include the +# `[bot]` suffix; humans with the same base login are not trusted by this list. +# Trusted bots are exempt from hidden-participant blocking, so keep this list +# limited to bot identities whose generated PR content is safe to process. +trusted_bots: + - chatgpt-codex-connector + - claude + - coderabbitai + - cursor + - dependabot + - greptile-apps + - github-actions + +# Team entries are GitHub team slugs under the repository owner org. Reading +# team membership requires the local GitHub token to have org access. +trusted_teams: + - shakacode From c1d07270828bd6bceea31421d234107eec625161 Mon Sep 17 00:00:00 2001 From: Justin Gordon Date: Fri, 26 Jun 2026 17:45:28 -1000 Subject: [PATCH 2/2] Document GitHub Actions trust scope --- .agents/trusted-github-actors.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.agents/trusted-github-actors.yml b/.agents/trusted-github-actors.yml index 535e757..8acb8e7 100644 --- a/.agents/trusted-github-actors.yml +++ b/.agents/trusted-github-actors.yml @@ -15,6 +15,10 @@ trusted_bots: - cursor - dependabot - greptile-apps + # Current use is limited to the deterministic Cloudflare Pages preview + # comment in `.github/workflows/site-build-deploy.yml`. Do not add new + # `GITHUB_TOKEN` comment workflows without a distinct bot/app identity or a + # matching provenance check in the batch preflight tool. - github-actions # Team entries are GitHub team slugs under the repository owner org. Reading