feat(feedback): accept explicitly trusted private publisher identities - #425
Merged
Conversation
Signed-off-by: rldyourmnd <danil@nddev.it.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A trusted private executor using a User token could not deduplicate its own feedback because the publisher only recognized Bot accounts. Add an explicit publisher type with Bot unchanged as the default; User requires its exact configured numeric identity. Unknown types fail before API access, and unrelated or mismatched accounts cannot suppress a failure.
Evidence now includes observation/run creation times and a bounded reason derived only from authoritative conclusions. Product versus infrastructure classification remains unknown. Issues stay unassigned, and ambiguous POST replies still recover via the exact durable marker without a second write.
Validation: 23 production-publisher fixture tests, actionlint and full
make verify(vet, race tests, release manifest and build) passed. No live private executor is claimed by this source change.Closes #424.