Fix rebase.yml: OWNER guard, fork guard, API-based head ref, SHA-pinned checkout

[Copilot]

The existing rebase.yml had several correctness and security issues: the PR presence check was a broken string comparison, the issue_comment payload doesn't carry head.ref, actions/checkout@v6 was used without a valid ref, there was no authorization check, and no protection against fork PRs.

Changes

Authorization & trigger guard

• Added github.event.comment.author_association == 'OWNER' to the job if; non-owners cause the job to be skipped
• Fixed PR presence check from != '' to a truthy check (github.event.issue.pull_request)

Fork protection (actions/github-script@v7 step)

• Fetches PR details via github.rest.pulls.get since issue_comment payloads lack head.ref/head.sha
• Explicitly fails if head.repo is null (deleted fork) or doesn't match the base repo

Safe checkout

• Checks out using the commit SHA returned by the API rather than the branch ref, closing the TOCTOU window between the fork check and the actual checkout
• Pushes back to the named branch explicitly: git push --force-with-lease origin HEAD:<head_ref>

Permissions

• Downgraded pull-requests: write → pull-requests: read (only a read is needed to fetch PR metadata)

if: github.event.issue.pull_request
    && contains(github.event.comment.body, '@bot rebase')
    && github.event.comment.author_association == 'OWNER'

// Fork guard in github-script
if (!pr.data.head.repo || pr.data.head.repo.full_name !== `${context.repo.owner}/${context.repo.repo}`) {
  core.setFailed('Rebase is only supported for same-repo pull requests, not forks.');
  return;
}
core.setOutput('head_ref', pr.data.head.ref);
core.setOutput('head_sha', pr.data.head.sha); // used for checkout to prevent TOCTOU

Original prompt

Create a pull request in jamesmoore/novus-mail to fix the existing GitHub Actions workflow .github/workflows/rebase.yml so that it:

1. Works for same-repo pull requests only (not forks).

   • Ensure the workflow checks out the PR head branch correctly when triggered by an issue_comment event.
   • Ensure the rebase/push targets the PR head branch in the same repository.
   • Add an explicit guard to prevent running on forked PRs.

2. Adds an authorization check so the workflow only runs when the commenter has author_association of OWNER.

   • If the commenter is not OWNER, the job should be skipped.

3. Adjusts the PR detection check to a truthy check rather than comparing to an empty string.

Additional requirements:

• Keep the command trigger as @bot rebase (or equivalent) as currently used.
• Use a valid version of actions/checkout (update if needed).
• Use GitHub API (e.g., actions/github-script) or equivalent to fetch PR details (head ref, head repo, etc.) since issue_comment payload lacks head.ref.
• Ensure git push --force-with-lease pushes back to the PR head branch.
• Update permissions only as needed.
• Provide clear inline comments in the workflow explaining the guards.

Context (current file contents):

name: Rebase on Command
on:
  issue_comment:
    types: [created]
permissions:
  contents: write
  pull-requests: write
jobs:
  rebase:
    if: github.event.issue.pull_request != '' && contains(github.event.comment.body, '@bot rebase')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.event.issue.pull_request.head.ref }}
          fetch-depth: 0
      - run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git fetch origin main
          git rebase origin/main
          git push --force-with-lease

This pull request was created from Copilot chat.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[jamesmoore]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b06f2096b0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".