From 0c3ac315317f53160838f2d21eeda2a0891f2443 Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Tue, 26 May 2026 22:43:25 +0300 Subject: feat(commands): allow vyos-bot[bot] App identity as Mergifyio sender MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The mirror-pipeline App vyos-bot[bot] issues @Mergifyio backport commands as part of the algorithm's step 6. Under the prior PAT auth, the comment author was the `vyosbot` GitHub user account, which the existing third allowlist condition matches. Under the new App auth (rolled out as Mirror Pipeline Rollout 1), the author is the App identity vyos-bot[bot] — distinct from the user, no team membership. Mergify currently rejects with 'Command disallowed due to command restrictions'. Empirically verified on canary VyOS-Networks/mirror-canary#6 on 2026-05-26: Mergify rejected the App's command with the exact format that lists the three currently-allowed senders. Adding this fourth condition allows the App to issue all 9 Mergifyio slash commands (backport / copy / dequeue / queue / rebase / refresh / requeue / squash / update) via the shared YAML anchor. `sender=vyosbot` (the legacy user identity) is RETAINED here — Rollout 1's staggered migration leaves some consumers on PAT during Tasks 5-10. Removing `vyosbot` is deferred to 1b Task 12 cleanup, after Task 11 PAT revocation. Parent plan: ~/.claude/plans/2026-05-26-mirror-mergify-app-allowlist.md Canary evidence: ~/.claude/plans/2026-05-26-mirror-rollout-1a-expanded-canary-tests.md Task B.1.5 --- .mergify.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.mergify.yml b/.mergify.yml index 55eff24..7ba0f73 100644 --- a/.mergify.yml +++ b/.mergify.yml @@ -202,6 +202,15 @@ commands_restrictions: - sender=@vyos/maintainers - sender=@VyOS-Networks/maintainers - sender=vyosbot + # vyos-bot[bot] is the App identity that replaces the legacy vyosbot + # user PAT under Mirror Pipeline Rollout 1 (PAT → App migration). + # The App's GitHub login is literal `vyos-bot[bot]`. Single-quoted + # to keep YAML parsers from interpreting `[bot]` as flow-sequence + # syntax. Empirically caught when canary mirror PR vyos-bot[bot] + # @Mergifyio backport was rejected (VyOS-Networks/mirror-canary#6, + # 2026-05-26). `sender=vyosbot` retained for the 1b staggered + # migration window; removal deferred to 1b Task 12 post-PAT-revoke. + - 'sender=vyos-bot[bot]' copy: *allowed dequeue: *allowed queue: *allowed -- cgit v1.2.3