feat: open up external contributions, AI-reviewed (advisory only) - #19
Merged
Conversation
The repo was already public with no merge-approval requirement (branch protection only requires the `audit` check) -- external contributors could already fork+branch+PR with zero config changes. What was missing: docs saying so, and a review gate proportional to trusting code from people who aren't collaborators. - CONTRIBUTING.md: explicit fork -> branch -> PR walkthrough, and fixed a stale pre-tests/smoke.py checklist (referenced an old one-line import check and a 3-file bandit scope; CI actually runs the full smoke suite and scans the whole repo). - pull_request_template.md: same checklist fix. - New external-pr-review.yml: posts ONE advisory AI review comment on PRs from non-collaborators (never dependabot, which has its own auto-merge workflow). Never approves, merges, or modifies anything -- contents:read only, no contents:write. Security model: pull_request_target is normally dangerous for fork PRs (secrets exposed + if you check out and run the fork's code, that's a "pwn request"). This workflow never checks out or executes the fork's code -- checkout takes no `ref:` override (stays on base `main`), and the PR's diff is fetched as TEXT ONLY via `gh pr diff`, handed to the model as clearly-labeled untrusted input, exactly like issue-autopilot.yml already treats untrusted issue bodies. Confirmed no other workflow can auto-merge a non-dependabot PR (only dependabot-auto-merge.yml calls `gh pr merge`, already actor-gated). - New test: parses every .github/workflows/*.yml file to catch a syntax mistake before it silently breaks a CI trigger (caught and fixed a YAML block-scalar formatting choice in the new workflow's own `if:` while writing this).
ctopherwilliams
force-pushed
the
feat/external-contributions
branch
from
July 5, 2026 01:57
41c68c2 to
9272eb6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
CONTRIBUTING.md: explicit fork → branch → PR walkthrough; fixed a stale checklist (predatedtests/smoke.py, referenced a 3-file bandit scope instead of the whole repo).pull_request_template.md: same checklist fix.external-pr-review.yml: posts one advisory AI review comment on PRs from non-collaborators (never Dependabot, which keeps its own separate auto-merge workflow). Never approves, merges, or modifies anything --contents: readonly.dependabot-auto-merge.ymlcan ever callgh pr merge, already actor-gated todependabot[bot]-- external PRs cannot auto-merge through any path.Security model (the part worth scrutinizing)
pull_request_targetis normally dangerous for fork PRs -- secrets are available, and checking out + running the fork's code is the classic "pwn request." This workflow avoids that: noref:override on checkout (stays on basemain), and the PR's diff is fetched as text only viagh pr diff, handed to the model as clearly-labeled untrusted input -- the same treatmentissue-autopilot.ymlalready gives untrusted issue bodies. The model is explicitly instructed never to check out, install, import, or execute anything from the PR.Stacked on #18 (pellet/anomaly alerts) -- merge in order: #10 → #11 → #12 → #13 → #14 → #15 → #16 → #17 → #18 → this one.
Test plan
.github/workflows/*.ymlfile (caught and fixed a real YAML formatting issue in this PR's own new workflow while writing it)gh api repos/.../branches/main/protectionthat no approval requirement exists today (matches "ours still auto-merge, not approvals") and that the repo is public