ci: bump hybrid-gate pin to the release-please waiver fix - #6861
Merged
Conversation
The prior pin waives the AI-attribution check on `github.head_ref` alone -- a branch name chosen by whoever opens the PR. Confirmed live by execution on this repo before the fix (probe #6858: check passed in 9s without scanning), and confirmed caught after. forkwright/.github#42 requires the branch shape AND `user.type == 'Bot'`. All three open release-please PRs fleet-wide are bot-authored, so no release flow changes. Refs forkwright/.github#42
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the shared-gate pin to
08a0bad, which carries the release-please waiver fix (forkwright/.github#42).Why this matters here
The prior pin (
54f1af7) waives the AI-attribution check ongithub.head_refalone — a branch name chosen by whoever opens the PR, with no author condition. That was confirmed live on this repo, not argued:54f1af7exit 0, nothing scanned08a0badProbe #6858 (now closed, branch deleted). The decisive post-fix line:
aletheia is public, and an external account opened #6854 on this repo while that probe was running — so the capability the bypass requires is demonstrably held outside the org.
No effect on releases
All three open release-please PRs fleet-wide (typikon#174, kanon#3306, logismos#109) are authored by
github-actions[bot],user.type = Bot. They still waive. Verified rather than assumed, because tightening a waiver is exactly the change that silently reddens a release flow.Wider note, not fixed here
Three consumer repos pin this workflow at three different SHAs, all pre-fix. A security fix in the shared gate reaches an adopting repo only when that repo bumps, and nothing reports the lag. That is a propagation gap worth its own mechanism; flagging rather than solving it in a pin bump.