Skip to content

Commit fbdf8dd

Browse files
committed
chore(superagent): drop the trustedAuthors allowlist too
It provably does not work (a listed author was still flagged action_required) and is inert with contributorTrust disabled. Keeping it would only suggest the repo has a working exemption mechanism that it does not.
1 parent b723a10 commit fbdf8dd

1 file changed

Lines changed: 6 additions & 8 deletions

File tree

.github/superagent.yml

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,22 +6,20 @@ prScan:
66
# Contributor-trust scoring is DISABLED (2026-07-29). Two independent reasons:
77
#
88
# 1. It does not discriminate here. Established repeat contributors with dozens of merged PRs were scored
9-
# "dangerous" (10/100) on volume/velocity alone, with no real signal behind it. The `trustedAuthors`
10-
# exemption below was added to fix exactly that and did NOT work — shin-core is listed and was still
11-
# flagged `action_required` on PR #9816. An exemption that does not exempt is worse than no exemption:
12-
# it looks handled while every affected PR still stalls.
9+
# "dangerous" (10/100) on volume/velocity alone, with no real signal behind it. A `trustedAuthors`
10+
# allowlist was added to fix exactly that and did NOT work — shin-core was listed and still flagged
11+
# `action_required` on PR #9816 — so it has been REMOVED rather than carried along inert and
12+
# misleading. An allowlist that does not allow is worse than none: it looks handled while every
13+
# affected PR still stalls.
1314
# 2. Its verdict has no consumer left. LoopOver now lists this check under `gate.ignoredCheckRuns`
1415
# (#9813) on all three gate repos, so a non-passing result no longer gates, pends, or holds anything.
1516
# Leaving it enabled only produces a permanently-red check on contributor PRs that nothing acts on —
1617
# pure noise that makes good contributors think they have failed something.
1718
#
1819
# The SECURITY SCAN above stays enabled and still gates CI normally: that is the protection worth having,
19-
# and it is a different check from the same app. `trustedAuthors` is kept (inert while disabled) so the
20-
# history is not lost if this is ever revisited.
20+
# and it is a different check from the same app.
2121
contributorTrust:
2222
enabled: false
23-
blockBelowScore: 30
24-
trustedAuthors: [dhgoal, shin-core, andriypolanski]
2523

2624
comments:
2725
mode: detailed

0 commit comments

Comments
 (0)