From 4425a4f21c0d01c6ec658f646127e0d8ea882dc9 Mon Sep 17 00:00:00 2001 From: "sentry-junior[bot]" <264270552+sentry-junior[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 16:52:49 +0000 Subject: [PATCH 1/3] fix(validate-pr): Skip bots of Sentry-owned GitHub Apps GitHub App bot users are never repo collaborators, so the write-access check reports `none` for them even when the app can push. This made the action post its community-contributor comment on PRs opened by sentry-junior[bot] once they crossed the 100-line threshold. Look up the app behind a bot author and skip when it is owned by the getsentry organization or the sentry enterprise, matched by owner type and ID since logins are not unique across owner types. Co-Authored-By: Daniel Szoke <7881302+szokeasaurusrex@users.noreply.github.com> --- CHANGELOG.md | 6 ++++++ validate-pr/README.md | 3 ++- validate-pr/scripts/validate-pr.js | 23 +++++++++++++++++++++++ 3 files changed, 31 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index cddf730..93ca953 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## Unreleased + +### Fixes + +- Validate PR - Skip PRs opened by bots of GitHub Apps owned by Sentry (the `getsentry` organization or the `sentry` enterprise), such as `sentry-junior[bot]`. App bot users are never repo collaborators, so the write-access check couldn't recognize them. + ## 3.4.1 ### Fixes diff --git a/validate-pr/README.md b/validate-pr/README.md index 779b179..7403d04 100644 --- a/validate-pr/README.md +++ b/validate-pr/README.md @@ -4,7 +4,7 @@ Advisory validation for non-maintainer pull requests against contribution guidel ## What it does -For PRs from non-maintainer authors, the action checks that the PR body references a GitHub issue where the PR author and a maintainer have discussed the approach. When that's not the case, the action posts one short advisory comment inviting the contributor to start with an issue. Maintainers (`admin` or `maintain` role) and a hard-coded list of trusted bots are exempt. +For PRs from non-maintainer authors, the action checks that the PR body references a GitHub issue where the PR author and a maintainer have discussed the approach. When that's not the case, the action posts one short advisory comment inviting the contributor to start with an issue. Maintainers (`admin` or `maintain` role), bots of GitHub Apps owned by Sentry, and a hard-coded list of trusted bots are exempt. Small PRs (< 100 lines changed, excluding lock files) are skipped entirely — typo fixes and tiny bug fixes don't need to go through the issue-discussion loop. @@ -45,6 +45,7 @@ Pin to a specific commit SHA (consumers in `getsentry/*` already follow this con ### Skipped entirely - PR author is in the trusted-bot allowlist (Dependabot, Renovate, Codecov AI, etc.) +- PR author is the bot user of a GitHub App owned by the `getsentry` organization or the `sentry` enterprise (e.g. `sentry-junior[bot]`) - PR author has `admin`, `maintain`, `push`, or `write` access on the repo - PR has fewer than 100 lines changed (`additions + deletions`), excluding common lock files diff --git a/validate-pr/scripts/validate-pr.js b/validate-pr/scripts/validate-pr.js index ac823c7..ab4f7f9 100644 --- a/validate-pr/scripts/validate-pr.js +++ b/validate-pr/scripts/validate-pr.js @@ -32,6 +32,29 @@ module.exports = async ({ github, context, core }) => { return; } + // --- Step 0b: Skip bots of GitHub Apps owned by Sentry --- + // App bot users are never repo collaborators, so the write-access check + // below reports `none` for them even when the app can push. Match the owner + // by type and immutable ID: owner logins are not unique across types (e.g. + // a `sentry` user account exists that is unrelated to the `sentry` enterprise). + const SENTRY_APP_OWNERS = [ + { type: 'organization', id: 1396951 }, // getsentry + { type: 'enterprise', id: 79916 }, // sentry + ]; + if (pullRequest.user.type === 'Bot' && prAuthor.endsWith('[bot]')) { + const authorAppSlug = prAuthor.slice(0, -'[bot]'.length); + try { + const { data: app } = await github.rest.apps.getBySlug({ app_slug: authorAppSlug }); + const ownerType = app.owner?.type?.toLowerCase(); + if (SENTRY_APP_OWNERS.some((o) => o.type === ownerType && o.id === app.owner?.id)) { + core.info(`PR author ${prAuthor} is a Sentry-owned GitHub App. Skipping.`); + return; + } + } catch (e) { + core.warning(`Could not look up GitHub App ${authorAppSlug} (${e.message}); proceeding.`); + } + } + // --- Helpers: cached collaborator-role lookup --- const roleCache = new Map(); async function getRole(owner, repoName, username) { From ef62048c6f5be15171dbea010bfa31138aaa4b92 Mon Sep 17 00:00:00 2001 From: "sentry-junior[bot]" <264270552+sentry-junior[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 16:53:13 +0000 Subject: [PATCH 2/3] Add PR link to changelog Co-Authored-By: Daniel Szoke <7881302+szokeasaurusrex@users.noreply.github.com> --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 93ca953..daa5eae 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,7 +4,7 @@ ### Fixes -- Validate PR - Skip PRs opened by bots of GitHub Apps owned by Sentry (the `getsentry` organization or the `sentry` enterprise), such as `sentry-junior[bot]`. App bot users are never repo collaborators, so the write-access check couldn't recognize them. +- Validate PR - Skip PRs opened by bots of GitHub Apps owned by Sentry (the `getsentry` organization or the `sentry` enterprise), such as `sentry-junior[bot]`. App bot users are never repo collaborators, so the write-access check couldn't recognize them. ([#179](https://github.com/getsentry/github-workflows/pull/179)) ## 3.4.1 From 1eff8144dac7a487c5cdeb8d975f056e50bef809 Mon Sep 17 00:00:00 2001 From: "sentry-junior[bot]" <264270552+sentry-junior[bot]@users.noreply.github.com> Date: Tue, 27 Oct 2026 16:56:16 +0000 Subject: [PATCH 3/3] ref(validate-pr): Drop allowlisted bots covered by the Sentry-owned app check fix-it-felix-sentry, javascript-sdk-gitflow and sentry-mobile-updater are all owned by the getsentry organization, so the new owner check already skips them. Co-Authored-By: Daniel Szoke <7881302+szokeasaurusrex@users.noreply.github.com> --- validate-pr/scripts/validate-pr.js | 3 --- 1 file changed, 3 deletions(-) diff --git a/validate-pr/scripts/validate-pr.js b/validate-pr/scripts/validate-pr.js index ab4f7f9..9679588 100644 --- a/validate-pr/scripts/validate-pr.js +++ b/validate-pr/scripts/validate-pr.js @@ -20,12 +20,9 @@ module.exports = async ({ github, context, core }) => { const ALLOWED_BOTS = [ 'codecov-ai[bot]', 'dependabot[bot]', - 'fix-it-felix-sentry[bot]', 'getsentry-bot', 'github-actions[bot]', - 'javascript-sdk-gitflow[bot]', 'renovate[bot]', - 'sentry-mobile-updater[bot]', ]; if (ALLOWED_BOTS.includes(prAuthor)) { core.info(`PR author ${prAuthor} is an allowed bot. Skipping.`);