diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-26 22:43:25 +0300 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-05-26 22:43:25 +0300 |
| commit | 0c3ac315317f53160838f2d21eeda2a0891f2443 (patch) | |
| tree | 332db00b325a04c696507a9739bc3f21a2fdb105 | |
| parent | 63f04bce46081876279aa874a96fe6136db7c2b5 (diff) | |
| download | mergify-0c3ac315317f53160838f2d21eeda2a0891f2443.tar.gz mergify-0c3ac315317f53160838f2d21eeda2a0891f2443.zip | |
feat(commands): allow vyos-bot[bot] App identity as Mergifyio sender
The mirror-pipeline App vyos-bot[bot] issues @Mergifyio backport
commands as part of the algorithm's step 6. Under the prior PAT auth,
the comment author was the `vyosbot` GitHub user account, which the
existing third allowlist condition matches. Under the new App auth
(rolled out as Mirror Pipeline Rollout 1), the author is the App
identity vyos-bot[bot] — distinct from the user, no team membership.
Mergify currently rejects with 'Command disallowed due to command
restrictions'.
Empirically verified on canary VyOS-Networks/mirror-canary#6 on
2026-05-26: Mergify rejected the App's command with the exact format
that lists the three currently-allowed senders. Adding this fourth
condition allows the App to issue all 9 Mergifyio slash commands
(backport / copy / dequeue / queue / rebase / refresh / requeue /
squash / update) via the shared YAML anchor.
`sender=vyosbot` (the legacy user identity) is RETAINED here —
Rollout 1's staggered migration leaves some consumers on PAT during
Tasks 5-10. Removing `vyosbot` is deferred to 1b Task 12 cleanup,
after Task 11 PAT revocation.
Parent plan: ~/.claude/plans/2026-05-26-mirror-mergify-app-allowlist.md
Canary evidence: ~/.claude/plans/2026-05-26-mirror-rollout-1a-expanded-canary-tests.md Task B.1.5
| -rw-r--r-- | .mergify.yml | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/.mergify.yml b/.mergify.yml index 55eff24..7ba0f73 100644 --- a/.mergify.yml +++ b/.mergify.yml @@ -202,6 +202,15 @@ commands_restrictions: - sender=@vyos/maintainers - sender=@VyOS-Networks/maintainers - sender=vyosbot + # vyos-bot[bot] is the App identity that replaces the legacy vyosbot + # user PAT under Mirror Pipeline Rollout 1 (PAT → App migration). + # The App's GitHub login is literal `vyos-bot[bot]`. Single-quoted + # to keep YAML parsers from interpreting `[bot]` as flow-sequence + # syntax. Empirically caught when canary mirror PR vyos-bot[bot] + # @Mergifyio backport was rejected (VyOS-Networks/mirror-canary#6, + # 2026-05-26). `sender=vyosbot` retained for the 1b staggered + # migration window; removal deferred to 1b Task 12 post-PAT-revoke. + - 'sender=vyos-bot[bot]' copy: *allowed dequeue: *allowed queue: *allowed |