From 9108adf4c656be0711382b9cb5dc924df618b231 Mon Sep 17 00:00:00 2001 From: teahubxyz Date: Sat, 10 Oct 2026 20:08:07 -0700 Subject: [PATCH] mention: only owner/members/collaborators trigger seats (public repo) --- .github/workflows/mention.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/mention.yml b/.github/workflows/mention.yml index 4a9aad3..93ad90f 100644 --- a/.github/workflows/mention.yml +++ b/.github/workflows/mention.yml @@ -14,10 +14,12 @@ concurrency: cancel-in-progress: false jobs: reply: - # cheap filter before a runner spins up: something that looks like a mention, not from a bot + # cheap filter before a runner spins up: a mention, not from a bot, and only from people with a say in this repo + # (public repo: strangers can comment, but must not be able to spend the seats' model credits) if: >- contains(github.event.comment.body || github.event.issue.body, '@') && - (github.event.comment.user.type || github.event.issue.user.type) != 'Bot' + (github.event.comment.user.type || github.event.issue.user.type) != 'Bot' && + contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association || github.event.issue.author_association) runs-on: ubuntu-latest timeout-minutes: 8 steps: