fix(bots): accept CONTRIBUTOR in engineer-followup comment-path gate#869
Merged
Merged
Conversation
A maintainer with PRIVATE org membership is reported as `author_association: CONTRIBUTOR` in the pull_request_review_comment webhook payload (even though REST shows MEMBER). The followup gate only accepted OWNER/MEMBER/COLLABORATOR, so such a maintainer's review comments SILENTLY failed the gate — the job skipped with no error and the bot never engaged. Observed on #868: a review comment (MEMBER per REST) triggered a followup run that skipped, because the payload association was CONTRIBUTOR (membership private). Add CONTRIBUTOR. Low risk: this path already requires a non-fork, OPEN, `engineer-bot`-labeled PR (a maintainer-applied opt-in). Mirrors the engine fix (databricks/databricks-bot-engine#120). Signed-off-by: eric-wang-1990 <e.wang@databricks.com> Co-authored-by: Isaac
eric-wang-1990
temporarily deployed
to
azure-prod
July 17, 2026 02:44 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
eric-wang-1990
temporarily deployed
to
azure-prod
July 17, 2026 02:44 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
eric-wang-1990
enabled auto-merge
July 17, 2026 02:47
eric-wang-1990
disabled auto-merge
July 17, 2026 02:47
eric-wang-1990
enabled auto-merge
July 17, 2026 02:47
eric-wang-1990
disabled auto-merge
July 17, 2026 02:47
![peco-review-bot[bot]](https://avatars.githubusercontent.com/in/3801177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verdict: 1 Low
Looks good — a minimal, well-justified gate change that adds CONTRIBUTOR to the accepted author_association set to unblock private-org maintainers whose webhook payload reports CONTRIBUTOR. The array stays valid JSON and the explanatory comment is updated symmetrically. One low-severity note about the (documented, label-mitigated) broadening of the trusted commenter set.
eric-wang-1990
enabled auto-merge
July 17, 2026 02:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
A maintainer with private org membership is reported as
author_association: CONTRIBUTORin thepull_request_review_commentwebhook payload — even though the REST API showsMEMBER. The engineer-followup gate only acceptedOWNER/MEMBER/COLLABORATOR, so such a maintainer's review comments silently fail the gate: the job skips with no error, and the bot never engages.Observed live on #868 — a review comment (MEMBER per REST) triggered followup run
29550013874, which skipped. Confirmed the commenter is a private org member (404 on the org public-members check), so the webhook payload carriedCONTRIBUTOR. This is why the bot never followed up on the review comment there.Fix
Add
CONTRIBUTORto the accepted association set. Low risk: this path already requires a non-fork, OPEN,engineer-bot-labeled PR (a maintainer-applied opt-in) — the label is the real trust gate;author_associationis defense-in-depth.Mirrors the engine fix (databricks/databricks-bot-engine#120), which also updates the canonical dogfood workflow + consumer example stub so future onboardings inherit the corrected gate.
This pull request and its description were written by Isaac.