Skip to content

docs: document gh api ownership enforcement [doc-updater] #1013

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jwbron merged 2 commits into from
Mar 10, 2026
Merged

docs: document gh api ownership enforcement [doc-updater] #1013

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1e15b84
docs: update gateway README with gh api ownership rules
jwbron Mar 9, 2026
8ff4d09
fix: correct policy descriptions for pr comment, review, edit, close
egg-reviewer[bot] Mar 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions gateway/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,10 +40,16 @@ The gateway sidecar is the **trusted** component that holds credentials and vali
|-----------|--------|-------|
| `git push` | Branch ownership + Phase filter | Branch has open PR authored by egg, OR branch starts with `egg-` or `egg/`, AND operation is allowed in current phase |
| `gh pr create` | Phase filter + mode policy | Operation is allowed in current phase (typically only in 'pr' phase)<br>In user mode, PR is forced to draft<br>Blocked in reviewer mode |
| `gh pr comment` | PR ownership | PR must be authored by egg |
| `gh pr comment` | Allowed on any PR | PR must exist and be accessible |
| `gh pr merge` | **BLOCKED** | No merge endpoint - human must merge via GitHub UI |
| `gh pr edit` | PR ownership | PR must be authored by egg |
| `gh pr close` | PR ownership | PR must be authored by egg |
| `gh pr edit` | PR ownership | PR must be authored by egg or configured user |
| `gh pr close` | PR ownership | PR must be authored by egg or configured user |
| `gh api PATCH repos/.../issues/comments/{id}` | Comment ownership | Comment must be authored by egg or configured user |
| `gh api PATCH repos/.../pulls/comments/{id}` | Comment ownership | Comment must be authored by egg or configured user |
| `gh api PATCH repos/.../comments/{id}` (commits) | Comment ownership | Comment must be authored by egg or configured user |
| `gh api POST repos/.../issues/{id}/labels` | Issue/PR ownership | Issue or PR must be authored by egg or configured user |
| `gh api POST repos/.../pulls/{id}/requested_reviewers` | PR ownership | PR must be authored by egg or configured user |
| `gh api POST repos/.../pulls/{id}/reviews` | Allowed on any PR | PR must exist and be accessible |

**Bot variants for ownership check**: `egg`, `egg[bot]`, `app/egg`, `apps/egg`

Expand Down
Loading