chore: Add PR validation workflow#2608
Conversation
Automatically validates non-maintainer PRs by checking: - Issue reference exists in PR body - Referenced issue has discussion between author and maintainer - Referenced issue is not assigned to someone else Also enforces that all PRs start as drafts. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Semver Impact of This PR🟢 Patch (bug fixes) 📋 Changelog PreviewThis is how your changes will appear in the changelog. Internal Changes 🔧Deps
Other
Other
🤖 This preview updates automatically when you update the PR. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
|
|
||
| for (const user of usersToCheck) { | ||
| if (user === prAuthor) continue; | ||
| if (await isMaintainer(repo.owner, repo.repo, user)) { |
There was a problem hiding this comment.
Bug: The cross-repo maintainer check validates against the PR's repository instead of the issue's repository, causing valid PRs to be incorrectly closed.
Severity: MEDIUM
Suggested Fix
Update the call to isMaintainer on line 204 to use the issue's repository context. The call should be changed from isMaintainer(repo.owner, repo.repo, user) to isMaintainer(ref.owner, ref.repo, user) to align the code with the documented intent.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: .github/workflows/validate-pr.yml#L204
Potential issue: When a pull request references an issue from a different repository,
the GitHub workflow incorrectly checks for maintainer permissions on the pull request's
repository instead of the issue's repository. The code on line 204 calls
`isMaintainer(repo.owner, repo.repo, user)`, where `repo` is the PR's repository. This
contradicts the code comment on line 193, which states the check should be on "the
issue's repo". This will cause the workflow to incorrectly close valid PRs from
non-maintainers that reference cross-repo issues, even when a maintainer of the issue's
repository has participated in the discussion.
Did we get this right? 👍 / 👎 to inform future reviews.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
|
|
||
| for (const user of usersToCheck) { | ||
| if (user === prAuthor) continue; | ||
| if (await isMaintainer(repo.owner, repo.repo, user)) { |
There was a problem hiding this comment.
Comment contradicts code: wrong repo checked for maintainer
Medium Severity
The comment on line 193 states maintainer access is checked "on the issue's repo," but the isMaintainer call on line 204 passes repo.owner, repo.repo (the PR's repo) instead of ref.owner, ref.repo (the issue's repo). For cross-repo references (e.g., an issue in getsentry/sentry referenced from a different SDK repo), this means a maintainer of the issue's repo who commented would not be recognized unless they also maintain the PR's repo, or vice versa. Either the comment is misleading or the code has the wrong arguments.
Additional Locations (1)
2 participants
Summary
validate-pr.ymlworkflow to automatically validate non-maintainer PRsRollout of getsentry/sentry-python#4233 across all SDK repos.
Test plan
SDK_MAINTAINER_BOT_APP_IDvar andSDK_MAINTAINER_BOT_PRIVATE_KEYsecret are available to this repoCo-Authored-By: Claude Opus 4.6 (1M context) noreply@anthropic.com