From 1de4ab75a7ab02301b8e99a4ac4e4e716fc8f7d4 Mon Sep 17 00:00:00 2001 From: eric-wang-1990 Date: Thu, 16 Jul 2026 19:43:56 -0700 Subject: [PATCH] fix(bots): accept CONTRIBUTOR in engineer-followup comment-path gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A maintainer with PRIVATE org membership is reported as `author_association: CONTRIBUTOR` in the pull_request_review_comment webhook payload (even though REST shows MEMBER). The followup gate only accepted OWNER/MEMBER/COLLABORATOR, so such a maintainer's review comments SILENTLY failed the gate — the job skipped with no error and the bot never engaged. Observed on #868: a review comment (MEMBER per REST) triggered a followup run that skipped, because the payload association was CONTRIBUTOR (membership private). Add CONTRIBUTOR. Low risk: this path already requires a non-fork, OPEN, `engineer-bot`-labeled PR (a maintainer-applied opt-in). Mirrors the engine fix (databricks/databricks-bot-engine#120). Signed-off-by: eric-wang-1990 Co-authored-by: Isaac --- .github/workflows/engineer-bot-followup.yml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/engineer-bot-followup.yml b/.github/workflows/engineer-bot-followup.yml index bf4be5117..28f0abc8a 100644 --- a/.github/workflows/engineer-bot-followup.yml +++ b/.github/workflows/engineer-bot-followup.yml @@ -33,9 +33,15 @@ jobs: # - skip fork PRs — keep the model + App token out of untrusted code's reach; # - operate only on non-fork OPEN PRs carrying the `engineer-bot` label # (maintainer-applied opt-in; label requires triage+); - # - comment path: trusted commenters only (OWNER/MEMBER/COLLABORATOR, or a - # bot — reviewer-bot/Copilot), never the engineer-bot's own comments, and - # never a reviewer-bot reconcile loopback; + # - comment path: trusted commenters only + # (OWNER/MEMBER/COLLABORATOR/CONTRIBUTOR, or a bot — reviewer-bot/Copilot), + # never the engineer-bot's own comments, and never a reviewer-bot reconcile + # loopback. CONTRIBUTOR is included because a maintainer with PRIVATE org + # membership is reported as `author_association: CONTRIBUTOR` in the webhook + # payload (even though REST shows MEMBER) — without it, such a maintainer's + # review comments SILENTLY fail this gate and the bot never engages. Low + # risk: this path already requires a non-fork, OPEN, `engineer-bot`-labeled + # PR (a maintainer-applied opt-in); # - labeled path: the `engineer-bot` label was just applied by a human. if: >- github.event.pull_request.head.repo.fork == false @@ -47,7 +53,7 @@ jobs: && !startsWith(github.event.comment.user.login, 'peco-engineer-bot') && !contains(github.event.comment.body, '') && ( - contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) + contains(fromJson('["OWNER","MEMBER","COLLABORATOR","CONTRIBUTOR"]'), github.event.comment.author_association) || ( github.event.comment.user.type == 'Bot' && (