[smith-xyz]

What changed

The first cut of this workflow gated the test checkbox on author_association in OWNER / MEMBER / COLLABORATOR. In production that gate rejects the very person it was written for:

$ gh api .../runs/39970144512/jobs -> ARM step log
AUTHOR_ASSOCIATION: CONTRIBUTOR
not armed: checkbox ticked by CONTRIBUTOR; needs the automerge label from a maintainer

author_association is computed from the base repo, so a PR opened from a fork is CONTRIBUTOR even when its author is an org owner with admin on the repo. Since the fork workflow (origin=smith-xyz, PR head smith-xyz:branch) is how PRs actually arrive here, the checkbox could never arm anything.

The fix

Ask the API for the author's real permission instead of trusting the association:

gh api repos/$REPO/collaborators/$AUTHOR/permission --jq .permission   # -> admin|maintain|write|triage|read

The checkbox counts for admin, maintain, or write. Anything else falls back to the automerge label, which needs triage or better to apply.

Verified against the API rather than assumed: a probe workflow run with a plain workflow token (permissions: contents: write, pull-requests: write) returns 200 {"permission": "admin"} for a smith-xyz fork PR whose author_association is CONTRIBUTOR. GET /orgs/{org}/members/{login} is not usable there (302, needs read:org), and the org membership is not public, so the collaborators endpoint is the one anchor a token can read.

Behaviour, all 15 cases

PR state	Author permission	Result
checkbox ticked	admin / maintain / write	armed
checkbox ticked	read / triage / no access	declined, label needed
checkbox ticked	outside contributor	declined
automerge label	anything	armed
no label, no checkbox	anything	declined
any of the three checkbox wordings	admin	armed
already armed	anything	no-op, never disarms

Merge commit only, and arming still needs the PR to be open, non-draft, and based on development.

Also in here

The file has to sit on the default branch for pull_request_target to fire at all (this repo defaults to main, code lives on development), which is why the companion PR targets main. Identical file, one commit each.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: smith-xyz

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [smith-xyz]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment