Agents: trust Copilot review identities

[justin808]

Why

React on Rails strict GitHub trust currently blocks Copilot review evidence because GitHub exposes the pull-request participant as a bare, User-shaped Copilot alias while review records use the canonical copilot-pull-request-reviewer[bot] identity.

This consumes the fail-closed canonical-node resolution merged in shakacode/agent-workflows#270 and explicitly allowlists both identities. A human account with a matching name still cannot inherit bot trust: both the configured alias and the canonical GraphQL Bot login must match.

What changed

• Allow copilot and copilot-pull-request-reviewer as actionable trusted bots.
• Pin the exact merged preflight helper and regression tests from agent-workflows#270.
• Record the two files as reviewed drift overlays while retaining the repository's global Agent Workflows source revision, avoiding unrelated workflow drift.
• Leave trusted users and metadata-only actors unchanged.

Security evidence

• Before: strict preflight on react_on_rails#4804 exited 2, blocked by the hidden User-shaped Copilot participant and canonical Copilot review author.
• After: the same live strict preflight exits 0 with SECURITY_PREFLIGHT_OK and no acknowledgement.
• Missing IDs, failed lookups, human nodes, canonical mismatches, null/blank identities, and malformed responses remain fail-closed.
• No GitHub node ID is hardcoded.

Validation

• Focused identity tests: 7 runs, 54 assertions.
• Full preflight suite: 108 runs, 913 assertions.
• Other affected pinned-helper suites: 14/81, 54/476, and 66/234.
• Drift manifest: 42 mapped, 4 excluded; 24 identical, 18 expected overlays, 0 unexpected drift.
• Agent workflow seam doctor: PASS.
• .agents/bin/validate --changed: PASS.
• CI-equivalent OSS RuboCop: 244 files, no offenses.
• Focused agent RuboCop, Prettier, pre-commit hooks, and committed diff checks: PASS.
• Pinned helper/test bytes match agent-workflows merge commit 7ef1dcad43980ac6fcb9008ddc3bc27e643b1f51 exactly.

Changelog: release-process/internal workflow policy; no product changelog entry.

Summary by CodeRabbit

• New Features

  • Improved security preflight checks by recognizing trusted bot aliases through canonical identities.
  • Added clearer reporting of which trust configuration is being used.
  • Added support for additional trusted Copilot bot identities.

• Bug Fixes

  • Prevented mismatched, unresolved, or incomplete bot identities from being trusted incorrectly.
  • Improved handling and caching of canonical bot lookups.

• Tests

  • Expanded coverage for trust configuration selection, bot identity validation, lookup failures, and caching behavior.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Walkthrough

Preflight now reports the selected trust-config source and canonicalizes bare bot participants through GitHub node IDs. Copilot bot names are added to the trusted allowlist, tests cover resolution and fail-closed cases, and drift metadata reflects the updated consumer files.

Changes

Preflight trust handling

Layer / File(s)	Summary
Trust-config source reporting .agents/skills/pr-batch/bin/pr-security-preflight, .agents/skills/pr-batch/bin/pr-security-preflight-test.rb	Trust-config resolution now reports its source, with tests covering explicit, repository, environment, user-global, and packaged fallback paths.
Canonical bot identity filtering .agents/skills/pr-batch/bin/pr-security-preflight, .agents/skills/pr-batch/bin/pr-security-preflight-test.rb, .agents/trusted-github-actors.yml, .agents/agent-workflow-drift.yml	Participant node IDs support canonical bot lookup and caching; Copilot bot names are allowlisted; canonical alias, mismatch, error, missing-ID, and cache behavior are tested; drift classifications and checksums are updated.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• shakacode/react_on_rails#4356: Earlier trust and trust-config resolution changes in the same preflight script and test harness.
• shakacode/react_on_rails#4749: Related changes to preflight trust-config loading and bot allowlisting.

Suggested labels: ready-for-hosted-ci

Suggested reviewers: copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: trusting Copilot review identities.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/trust-copilot-reviewer

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[justin808]

+ci-status

[github-actions]

CI Status

Head SHA: 5a01920d7074
Changed files: 4
Docs-only heuristic (matches ci-changes-detector metadata paths): yes
ready-for-hosted-ci label: absent
force-full-hosted-ci label: absent
Current hosted-CI waiver: not present for this SHA
Automatic release-target hosted mode: inactive
Observed exact-head coverage: modes[missing=9]; successful=0, pending=0, failed=0, missing=9

Only the required gate is active unless hosted CI is requested.

[justin808]

+ci-run-hosted

[github-actions]

Hosted CI Requested

Triggered 9 workflow(s) for 5a01920d7074.
Skipped 0 workflow(s) with equivalent exact-head coverage.
Mode: optimized hosted CI (path-selected by script/ci-changes-detector).
Added ready-for-hosted-ci, so future commits will keep running optimized hosted CI until +ci-stop-hosted is used.

View progress in the Actions tab.

[greptile-apps]

Greptile Summary

Updates the strict GitHub trust preflight to recognize Copilot’s User-shaped participant alias only after resolving the same node to an allowlisted canonical Bot identity.

• Adds canonical bot identity lookup with fail-closed handling and per-node caching.
• Adds focused coverage for successful resolution, mismatches, lookup failures, missing IDs, human nodes, blank entries, and caching.
• Adds both Copilot identities to the repository-local trusted-bot allowlist.
• Records the preflight implementation and tests as reviewed workflow overlays.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness or security issues identified.

The new exception requires independently allowlisted alias and canonical Bot identities, while missing IDs, failed or malformed lookups, human nodes, and canonical mismatches continue through the existing blocking path.

Important Files Changed

Filename	Overview
.agents/skills/pr-batch/bin/pr-security-preflight	Adds canonical GraphQL Bot resolution while retaining fail-closed behavior for absent, invalid, mismatched, and non-Bot identities.
.agents/skills/pr-batch/bin/pr-security-preflight-test.rb	Adds comprehensive regression coverage for canonical identity resolution, rejection paths, trust-config provenance, and cache reuse.
.agents/trusted-github-actors.yml	Allowlists the bare Copilot participant alias and canonical Copilot review bot identity required by the dual-match check.
.agents/agent-workflow-drift.yml	Reclassifies the updated pinned helper and test as documented overlays with their corresponding source and consumer hashes.

_{Reviews (1): Last reviewed commit: "Trust Copilot reviews without weakening ..." | Re-trigger Greptile}

[claude]

Review: Agents: trust Copilot review identities

Reviewed the diff (pr-security-preflight, its test suite, the trust allowlist, and the drift manifest). This looks solid — no blocking issues found.

Security design checks out:

• The new trusted_bare_bot_participant? path requires both the configured alias match AND a canonical GraphQL node(id:) lookup confirming __typename == "Bot" with a matching login — a human account named Copilot correctly fails the canonical check and stays untrusted (covered by test_human_login_matching_bot_base_name_is_not_trusted_as_bot).
• All failure modes fail closed: missing node id (no lookup performed), failed GraphQL lookup (rescue → cached nil), and canonical-login mismatch all end up blocked — each has a dedicated regression test.
• The canonical-node id ($id:ID!) is passed as a gh api graphql -f variable rather than string-interpolated into the query text, and Open3.capture3 uses an argv array (no shell), so there's no GraphQL/shell injection surface even though the id ultimately originates from GitHub API response data.
• canonical_bot_cache is correctly keyed/shared by node id, so repeated aliases resolving to the same bot only cost one extra API call (verified by test_bare_bot_aliases_share_canonical_node_cache).
• The new id field added to PARTICIPANT_NODES_FRAGMENT is only spliced into participants { nodes { ... } } blocks (checked all 3 call sites), so it can't break a query context where id isn't a valid selection.

Self-consistency verified locally:

• .agents/agent-workflow-drift.yml's claimed 24 identical / 18 overlay counts match grep -c on the file exactly.
• The consumer_sha256 values for both pinned files match sha256sum of the files as committed, and consumer_mode: '100755' matches the actual file mode.

Minor observations (non-blocking, pre-existing pattern, not introduced by this PR):

• The bare-alias canonical-verification path is new, but the existing trusted_bot?/bot_login_in_set? path (used for any login literally ending in [bot]) still trusts by login string alone with no __typename/id verification. That's an existing repo-wide pattern (relies on GitHub reserving the [bot] suffix for App accounts), not something this PR needs to fix, but worth keeping in mind if GitHub's alias quirks ever extend to other bots.
• trusted_bare_bot_participant?'s first-pass check uses normalized_login(login) rather than normalized_bot_login(login) — harmless today since bare aliases shouldn't carry a [bot] suffix, but slightly inconsistent with the stripping convention used everywhere else in the file.

Test coverage for the new behavior (mismatch, lookup failure, missing id, cache sharing, blank trust entries) is thorough. Nice work.

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.agents/agent-workflow-drift.yml (1)

121-145: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

Reconcile the agent-workflows PR references.

The count disposition cites PRs 198 and 270 as the retained overlays, while the pr-security-preflight reason cites 201 and 270. One of the two is wrong; this ledger is the audit trail for why these files diverge from the pinned source, so the provenance should match.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.agents/agent-workflow-drift.yml around lines 121 - 145, Reconcile the
pull-request references in the overlay ledger entries, especially the reason for
skills/pr-batch/bin/pr-security-preflight, so the cited retained overlays match
the count disposition’s PR 198 cancellation guardrail and PR 270 canonical bot
resolution. Preserve the existing provenance detail and update only the
inconsistent PR reference.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.agents/agent-workflow-drift.yml:
- Around line 121-145: Reconcile the pull-request references in the overlay
ledger entries, especially the reason for
skills/pr-batch/bin/pr-security-preflight, so the cited retained overlays match
the count disposition’s PR 198 cancellation guardrail and PR 270 canonical bot
resolution. Preserve the existing provenance detail and update only the
inconsistent PR reference.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7cbbe5e9-26a5-427c-b882-cbce10dba52d

📥 Commits

Reviewing files that changed from the base of the PR and between 1aa5d7e and 5a01920.

📒 Files selected for processing (4)

• .agents/agent-workflow-drift.yml
• .agents/skills/pr-batch/bin/pr-security-preflight
• .agents/skills/pr-batch/bin/pr-security-preflight-test.rb
• .agents/trusted-github-actors.yml

[justin808]

---

head_sha: 5a01920
triggered_gates:

• security-auth-privacy
  rollback_disposition: Code-only rollback is established by reverting PR Agents: trust Copilot review identities #4807; the previous repository trust config and pinned helper remain recoverable without data or external-state migration.
  decision: approve
  approved_by: justin808
  source: direct-user-task
  evidence: The operator set merge_authority to auto_merge_when_gates_pass and explicitly directed this task to add Copilot to the allowed whitelist and keep going; exact-head QA Evidence v2 passed at 5a01920.
  ...