From 8dc91a5ad10e660ee9265c172ccb415f18b1af9f Mon Sep 17 00:00:00 2001 From: Jon Bogaty Date: Mon, 27 Jul 2026 00:40:30 -0500 Subject: [PATCH 1/2] chore: remove stale CODEOWNERS entries for deleted directories MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit /.cursor/ and /docs/ don't exist anywhere in the tracked tree (verified via git ls-tree) — leftover from a prior repo state. GitHub silently no-ops on non-existent CODEOWNERS paths, so this wasn't a functional break, but it's misleading to a contributor reading the file. The existing `* @jbdevprimary` and `*.md @jbdevprimary` rules already cover everything that actually exists. Found by a post-merge dangling-references sweep of the repo. --- .github/CODEOWNERS | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index d385a272..fe3ca3c9 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -4,9 +4,5 @@ # GitHub Actions and CI/CD /.github/ @jbdevprimary -# Cursor rules and agent configuration -/.cursor/ @jbdevprimary - # Documentation -/docs/ @jbdevprimary *.md @jbdevprimary From 595f6c8a50461a92c36bf24954e224bb2563207f Mon Sep 17 00:00:00 2001 From: Jon Bogaty Date: Mon, 27 Jul 2026 00:40:43 -0500 Subject: [PATCH 2/2] fix(ci): harden automerge PR-author check and drop redundant approval MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A security review of the automerge workflow (PR #168) found: 1. `github.actor` reflects who triggered the current event, not the PR author — the wrong field for this gate. Switched to `github.event.pull_request.user.login`, the pattern dependabot/fetch-metadata's own README uses in every example, and added the `github.repository ==` guard from the same examples. 2. dependabot/fetch-metadata calls `core.setFailed(...)` (not `setFailed` propagating a hard stop by itself, but a failed step) when the PR isn't genuinely from Dependabot or its commit signature isn't verified — GitHub Actions skips subsequent steps in the job by default after a failed step, so the approve/merge step was already unreachable in that case. Added an explicit non-empty check on `update-type` anyway so the gate doesn't depend on that implicit, third-party-owned fail-closed behavior. 3. Verified live branch protection on `main`: there is no required-review rule configured (`required_pull_request_reviews` is absent; the only ruleset's rules are `copilot_code_review` and `code_quality`, which explicitly exclude `main`). `gh pr review --approve` was therefore satisfying no actual gate — a bot self-approving a PR with zero protective effect. Removed it; only `gh pr merge --squash --auto` (gated by required status checks) remains. --- .github/workflows/automerge.yml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml index 344e5c6d..139e93e6 100644 --- a/.github/workflows/automerge.yml +++ b/.github/workflows/automerge.yml @@ -10,7 +10,7 @@ permissions: jobs: dependabot: - if: github.actor == 'dependabot[bot]' + if: github.event.pull_request.user.login == 'dependabot[bot]' && github.repository == 'jbcom/jbcom.github.io' runs-on: ubuntu-latest steps: - name: Fetch Dependabot metadata @@ -19,11 +19,9 @@ jobs: with: github-token: ${{ secrets.GITHUB_TOKEN }} - - name: Approve and enable auto-merge (patch/minor only) - if: steps.metadata.outputs.update-type != 'version-update:semver-major' + - name: Enable auto-merge (patch/minor only) + if: steps.metadata.outputs.update-type != '' && steps.metadata.outputs.update-type != 'version-update:semver-major' env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} PR_URL: ${{ github.event.pull_request.html_url }} - run: | - gh pr review "$PR_URL" --approve - gh pr merge "$PR_URL" --squash --auto + run: gh pr merge "$PR_URL" --squash --auto