From bf2db3dc7966987dcbef614f398b7d9eba0e4b77 Mon Sep 17 00:00:00 2001 From: Dhravya Date: Fri, 18 Sep 2026 05:46:34 +0000 Subject: [PATCH] fix(ci): gate auto-fix to same-repo human runs (#1663) ## Summary The `workflow_run` auto-fix job has write permissions and checks out the triggering PR branch. It now runs only when all three conditions hold: - the tracked CI workflow failed on a pull request; - the pull request branch belongs to this repository, not a fork; - the triggering actor is not a bot account. The same-repository check closes the privileged fork boundary. The generic `[bot]` suffix check covers Polylane, Graphite, Dependabot, and other GitHub App bot users without maintaining a name list. ## Validation - `go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/claude-auto-fix-ci.yml` - YAML parse with the repository's installed parser - Final diff audit: one workflow, +3/-1, no added comments Human-triggered same-repository pull requests keep the existing auto-fix behavior. --- .github/workflows/claude-auto-fix-ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/claude-auto-fix-ci.yml b/.github/workflows/claude-auto-fix-ci.yml index bb1849a0e..e84d78c85 100644 --- a/.github/workflows/claude-auto-fix-ci.yml +++ b/.github/workflows/claude-auto-fix-ci.yml @@ -17,7 +17,9 @@ jobs: auto-fix: if: | github.event.workflow_run.conclusion == 'failure' && - github.event.workflow_run.pull_requests[0] + github.event.workflow_run.pull_requests[0] && + github.event.workflow_run.head_repository.full_name == github.event.workflow_run.repository.full_name && + !endsWith(github.event.workflow_run.actor.login, '[bot]') runs-on: ubuntu-latest timeout-minutes: 30 steps: