From 5ddd7610b8a8f65a5cf6b52762c8045269f4eb52 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Fri, 2 Oct 2026 21:30:37 -0700 Subject: [PATCH] ci: re-render the maintainer gate for bases that predate the policy file Re-rendered from the agentrust-io/.github template at 58c4f9c (.github#53). A pull request whose base predates .github/maintainers.json now reads the policy at the tip of its base branch instead of failing with Not Found. Co-Authored-By: Claude Opus 5.5 --- .../workflows/require-maintainer-approval.yml | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/.github/workflows/require-maintainer-approval.yml b/.github/workflows/require-maintainer-approval.yml index 2549fecd..f32c9e8d 100644 --- a/.github/workflows/require-maintainer-approval.yml +++ b/.github/workflows/require-maintainer-approval.yml @@ -33,17 +33,26 @@ jobs: pull_number: context.payload.pull_request.number, }); // Read only reviewed base-branch data. Never execute or read policy from a PR head. + const readPolicy = async ref => (await github.rest.repos.getContent({ + owner: context.repo.owner, repo: context.repo.repo, + path: '.github/maintainers.json', ref, + })).data; let file; try { - ({ data: file } = await github.rest.repos.getContent({ - owner: context.repo.owner, repo: context.repo.repo, - path: '.github/maintainers.json', ref: pr.base.sha, - })); + file = await readPolicy(pr.base.sha); } catch (error) { - // One-commit bootstrap: the initial policy PR must be reviewable before its - // policy file exists on main. Missing policy on any later base fails closed. - if (error.status !== 404 || pr.base.sha !== "c5cfa00e1c62ca1b4da2b999fc16e943dad09d90") throw error; - file = { encoding: 'base64', content: Buffer.from(JSON.stringify({"schema":1,"repository":"trace-spec","source":"agentrust-io/.github:maintainers/roster.json","maintainers":["imran-siddique","lywinged","pforest","Qiang-Xu","rajnisht7"],"security_paths":[],"security_approvals":1})).toString('base64') }; + if (error.status !== 404) throw error; + // A pull request opened before the policy file landed keeps that older base.sha, + // so read the policy at the tip of its base branch, which is reviewed data too. + // Qualified, so a tag with the branch's name cannot stand in for it. + try { + file = await readPolicy('refs/heads/' + pr.base.ref); + } catch (error) { + // One-commit bootstrap: the initial policy PR must be reviewable before its + // policy file exists on main. Missing policy on any later base fails closed. + if (error.status !== 404 || pr.base.sha !== "c5cfa00e1c62ca1b4da2b999fc16e943dad09d90") throw error; + file = { encoding: 'base64', content: Buffer.from(JSON.stringify({"schema":1,"repository":"trace-spec","source":"agentrust-io/.github:maintainers/roster.json","maintainers":["imran-siddique","lywinged","pforest","Qiang-Xu","rajnisht7"],"security_paths":[],"security_approvals":1})).toString('base64') }; + } } if (Array.isArray(file) || file.encoding !== 'base64') { throw new Error('Missing base-branch maintainer policy');