diff --git a/docs/pr-review-fix-queue.md b/docs/pr-review-fix-queue.md index c1f5405..3769945 100644 --- a/docs/pr-review-fix-queue.md +++ b/docs/pr-review-fix-queue.md @@ -33,7 +33,7 @@ Configuration: | Env Var | Description | Default | |---------|-------------|---------| -| `PR_FOLLOWUP_BOT_IDENTITIES` | Comma-separated GitHub logins whose PRs are eligible | `github-actions[bot]` | +| `PR_FOLLOWUP_BOT_IDENTITIES` | Comma-separated GitHub logins whose PRs are eligible | `github-actions[bot]`, `itsmiso-ai` | | `PR_FOLLOWUP_BRANCH_OWNERS` | Comma-separated repo owners allowed for queueing | All (opt-in safety) | ### Real-time webhooks diff --git a/src/lib/pr-followup-ingestion.test.ts b/src/lib/pr-followup-ingestion.test.ts index 84abe3d..47db1c5 100644 --- a/src/lib/pr-followup-ingestion.test.ts +++ b/src/lib/pr-followup-ingestion.test.ts @@ -120,6 +120,15 @@ describe("isAllowedBotAuthor", () => { expect(isAllowedBotAuthor(undefined)).toBe(false); }); + it("defaults to itsmiso-ai + github-actions[bot] when env var is unset", () => { + delete process.env.PR_FOLLOWUP_BOT_IDENTITIES; + expect(isAllowedBotAuthor("itsmiso-ai")).toBe(true); + expect(isAllowedBotAuthor("github-actions[bot]")).toBe(true); + // Other bots still rejected by default + expect(isAllowedBotAuthor("app/smurf-bot")).toBe(false); + expect(isAllowedBotAuthor("random-bot")).toBe(false); + }); + afterEach(() => { delete process.env.PR_FOLLOWUP_BOT_IDENTITIES; }); diff --git a/src/lib/pr-followup-ingestion.ts b/src/lib/pr-followup-ingestion.ts index dd3d323..7bc907b 100644 --- a/src/lib/pr-followup-ingestion.ts +++ b/src/lib/pr-followup-ingestion.ts @@ -32,9 +32,16 @@ export interface PrFollowupConfig { /** Classification result from feedback analysis */ export type FeedbackClassification = "actionable" | "needs_human"; -// ─── Default config (no hardcoded agent names or repo names) ──────────────── - -const DEFAULT_BOT_IDENTITIES: BotIdentity[] = ["github-actions[bot]"]; +// ─── Default config ───────────────────────────────────────────────────────── +// The default bot allowlist is intentionally narrow. Operators should set +// `PR_FOLLOWUP_BOT_IDENTITIES` (comma-separated GitHub logins) to match the +// bots that author their agent PRs. Without that env var, the merge-conflict +// surfacing and other PR-followup ingestion paths will silently no-op. +// +// `itsmiso-ai` is included by default because that is the Miso author identity +// for the current `misospace/*` agent fleet. The env var still wins when set. + +const DEFAULT_BOT_IDENTITIES: BotIdentity[] = ["github-actions[bot]", "itsmiso-ai"]; function getConfig(): PrFollowupConfig { const rawIdentities = process.env.PR_FOLLOWUP_BOT_IDENTITIES;