Gate the \translate-resync comment trigger on commenter trust (author_association) — template-first rollout

[mmcky]

Problem

The \translate-resync comment trigger runs a secrets-using workflow (ANTHROPIC_API_KEY, services PAT) for any commenter. issue_comment workflows execute in default-branch context with full secrets access, and the sync workflows' if: conditions check only that the comment is on a PR and contains the magic string — not who wrote it. On public repos this is a cost-abuse vector: any GitHub account can comment \translate-resync on a merged PR and repeatedly trigger runner time plus Anthropic API spend. The commenter controls nothing but the trigger (translated content comes from the repo), so this is abuse/noise rather than code execution — but it should still be gated.

Surfaced by Copilot on QuantEcon/test-translation-sync#671; assessment there concluded the fix belongs in the canonical templates first, not in one harness file, because the harness exists to mirror production wiring and a one-file patch would both diverge it and leave the actual exposure open everywhere else.

Where the unguarded pattern lives

Location	Role
src/cli/commands/setup.ts (generated source workflow, ~line 160)	canonical — what --source-workflow ships
examples/README.md (3 occurrences)	canonical — documented template
docs/user/quickstart.md	canonical — documented template
test-translation-sync sync-translations-fa.yml / translation-sync.yml / sync-translations-ml.yml (#671)	harness mirrors
production source repos (e.g. lecture-python-programming/sync-translations-fa.yml)	estate

Proposed fix

Add a commenter-trust condition to the issue_comment branch of the if: in all of the above, e.g. contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association). Notes for implementation: MEMBER covers org members, COLLABORATOR covers repo collaborators, and CONTRIBUTOR (anyone with a merged PR) is deliberately excluded; if finer control is wanted, the alternative is an explicit permission-check step via the API, but the association gate is the standard low-ceremony fix.

Rollout order

1. Canonical: setup.ts generated workflow + examples/README.md + docs/user/quickstart.md (one PR here).
2. Harness: all three test-translation-sync workflows in one PR, keeping them mirrors of the updated template.
3. Estate: production source repos.

Refs QuantEcon/test-translation-sync#671.

[mmcky]

Absorbing #138 — two more items for the same template change

#138 is the same fix from a different sighting (Copilot on the intermediate zh-cn sync wiring, QuantEcon/lecture-python.myst#979, rather than QuantEcon/test-translation-sync#671). Closing it as a duplicate of this issue, which is the newer and security-labelled one and already scopes the canonical → harness → estate rollout. Copying its two items here first so nothing is lost:

• permissions: contents: read at job level on the generated source-sync workflow. The action authenticates via its github-token input (the services PAT), so the ambient GITHUB_TOKEN is unused beyond checkout. Verified on main post-v0.24.0: generateSourceWorkflowYaml in src/cli/commands/setup.ts emits no permissions: block at all. The target-repo templates (examples/review-translations.yml, examples/rebase-translations.yml) do carry one — the source-sync template is the gap.
• Require github.event.issue.pull_request. The problem statement above assumes the condition at least checks that the comment is on a PR. Verified on main it does not — setup.ts:169 tests only contains(github.event.comment.body, '\translate-resync'), so a comment on any issue fires the run too.

Why this is still open. #138's thread expected the permissions half to arrive with #161 (Wave 1, PR D). Verified against main post-v0.24.0, it did not: #161's composite guard is merged-PR ∨ resync-comment only, with no trust gate, no PR requirement and no permissions block. So the exposure is live in the canonical template and on every deployed instance.

Shape to copy. The fixed form already exists on QuantEcon/lecture-python.myst@8abdb57 (the author_association gate, the issue.pull_request requirement and the permissions block together). Deployed instances still unguarded: lecture-python-intro/sync-translations-zh-cn.yml, lecture-python-programming/sync-translations-{zh-cn,fa,fr}.yml, and the three harness workflows in test-translation-sync.

One open design question carried over from #138: whether to admit CONTRIBUTOR as well, for RA reviewers who may legitimately re-trigger a sync. OWNER/MEMBER/COLLABORATOR is the conservative set that shipped on myst#979.

[mmcky]

All three rollout steps are done. Closing.

Step	Scope	Status
1 — Canonical	setup.ts scaffolder, twelve documented copies, the harness template, plus the FAQ's stated requirements	#219, merged 2026-07-26
2 — Harness	test-translation-sync ×3	Deployed via a scoped harness run, and E2E-confirmed
3 — Estate	lecture-python-intro ×1, lecture-python-programming ×3	QuantEcon/lecture-python-intro#805 and QuantEcon/lecture-python-programming#586, merged 2026-07-26

Closing audit: 8/8 gated. Every deployed sync workflow was re-fetched from its default branch and parsed rather than grepped, so the check is against the expression GitHub evaluates after YAML folding. All carry the four conditions with balanced parens, all declare permissions: contents: read, and no copy of the pre-fix one-line form survives. An org-wide search scoped to .github/workflows/ returns exactly those eight, so the set is complete rather than merely matching the list in the original report. Full table in #220.

Step 1 turned out to be fourteen copies, not the three this issue named. The scaffolder, twelve documented copies across README / examples/ / quickstart / action-reference / the three tutorials, and the harness template. Fixing only the three would have left nine copies teaching the vulnerable shape — and the docs are how the estate gets configured, so those nine were the supply side of the exposure. A drift guard in workflow-templates.test.ts now sweeps the publishable surfaces instead of enumerating them, parses every workflow it finds, and fails per job on a missing condition, a missing contents: read, or any surviving legacy form. A doc page added tomorrow is covered the day it lands. It also asserts the workflow's association set still equals TRUSTED_ASSOCIATIONS in src/inputs.ts, so the two layers cannot drift apart.

The open design question is settled: CONTRIBUTOR stays out. Not primarily on threat-model grounds — src/inputs.ts has always enforced exactly OWNER/MEMBER/COLLABORATOR inside the action, so admitting CONTRIBUTOR at the workflow level would only buy a billed run that then no-ops. Two gates on one decision have to agree, and the outer one has to be at least as tight as the inner one. RA reviewers who need to resync should be repo collaborators, which is a permissions change rather than a loosened trigger. Recorded in D-2026-07-26-resync-trust-gate-association-set.md, including the API-permission-check alternative and why it moves the cost rather than avoiding it.

Both branches of the rewritten if: were exercised on the real Actions path, which the unit guard cannot do. The merge branch fired three green syncs across zh-cn/fa/ml and opened three translation PRs — the load-bearing check, because a mis-folded scalar does not error, it silently stops the workflow firing and looks exactly like "nothing has been merged lately". The resync branch was fired by a \translate-resync comment from a MEMBER and was admitted: the jobs started, logged the resync line, then exited on "not merged" with no model calls. That last one was the actual regression risk of this change — a botched author_association clause would have locked legitimate users out silently.

One thing deliberately not claimed. The rejection half is unverified: confirming an untrusted commenter is blocked needs an account outside the org. The gate is a contains(fromJSON(...)) over a set the action independently enforces, so the residual risk is small, but it is unmeasured and should not be described otherwise.

Two things carried forward, neither blocking

• translate setup still scaffolds the ungated shape until the next release, since the fixed scaffolder ships in the action. The [Unreleased] CHANGELOG entry is in place. Affects only newly-scaffolded repos, none of which exist yet; nothing deployed is affected.
• Moving the sync bot to a GitHub App will silently break \translate-resync — Apps always report author_association=NONE #221 — GitHub Apps always report author_association=NONE (measured on three unrelated Apps), so moving the sync bot to an App would silently stop it resyncing, while a quantecon-services machine user needs no change at all. Filed before the migration rather than after, because that failure is silent too.