From 722492bd1f4c5dbede95be67b4ee1900c2773b6f Mon Sep 17 00:00:00 2001 From: Josh Date: Thu, 15 Oct 2026 22:22:55 -0400 Subject: [PATCH] ci: approve the organization review caller and reviewer --- scripts/test_pr_review_workflow.py | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/scripts/test_pr_review_workflow.py b/scripts/test_pr_review_workflow.py index bc99017..3c9aa1c 100644 --- a/scripts/test_pr_review_workflow.py +++ b/scripts/test_pr_review_workflow.py @@ -13,7 +13,10 @@ MAX_WORKFLOW_BYTES = 65536 # Upgrade trusted approvals in three stages: expand, migrate, then contract. # Both bootstrap and trusted validation must pass each stage before merging. -APPROVED_REVIEWER_SHAS = ("3e8534e0dd621c62879238cc01d56f7e58e9d096",) +APPROVED_REVIEWER_SHAS = ( + "3e8534e0dd621c62879238cc01d56f7e58e9d096", + "4edcf46d02011c2aa1e305aff69d4d7100aae0ca", +) EXPECTED_CALLERS = ( """name: AI PR Review @@ -49,6 +52,31 @@ openai_api_key: ${{ secrets.OPENAI_API_KEY }} """, ) +# After the move into pipelab-org: approve the organization caller shape before +# the caller switches to it, because the contract check validates a proposed +# caller with the approved list on the default branch. GitHub does not follow +# repository redirects for reusable workflows, so the reviewer is loaded from +# pipelab-org/pipelock. +_ORG_CALLER = EXPECTED_CALLERS[0].replace( + "luckyPipewrench/pipelock/.github/workflows/pr-review-reusable.yaml@", + "pipelab-org/pipelock/.github/workflows/pr-review-reusable.yaml@", +) +if "author_association == 'OWNER'" in _ORG_CALLER: + _ORG_CALLER = ( + _ORG_CALLER.replace( + "github.actor == 'luckyPipewrench' &&", + "github.actor == 'luckyPipewrench' &&\n" + " github.actor_id == '142104046' &&\n" + " github.run_attempt == '1' &&", + ) + .replace( + "github.event.comment.user.login == 'luckyPipewrench' &&", + "github.event.comment.user.login == 'luckyPipewrench' &&\n" + " github.event.comment.user.id == 142104046 &&", + ) + .replace("author_association == 'OWNER'", "author_association == 'MEMBER'") + ) +EXPECTED_CALLERS += (_ORG_CALLER,) EXPECTED_CONTRACTS = ( r"""name: Review caller contract