[maralcbr]

Summary

PRs from the kernel team (.github/VOUCHED.td) now build (package, KUnit, boot) on every push, forks included, with no ci:build label. Everyone else, including omacom org members not on the list, gets checks only, as before.

 plan (pull_request)
+  status = trust(author AND pusher)    # VOUCHED.td read from the target branch via the API
+  if denounced                     → checks only (label can't override)
   if ci:build applied              → full
+  if push && vouched && !draft     → full   # forks too
   if push && label && same repo    → full
   if push && label && fork         → checks only, re-apply label
+  if push && vouched && draft      → checks only, builds once ready
   else                             → checks only

kernel-ci-approve.yml (new, pull_request_target, target-branch files only, no checkout)
  author is an outside collaborator → GitHub holds the run
    author + pusher vouched → approve-runs.py approves the held kernel-ci.yml run of the current head
    anyone else             → stays held for a maintainer

VOUCHED.td lists 16 people: the 15 current collaborators plus joshuaswarren. Org or repo access alone no longer counts, because 17 omacom org members aren't on the kernel team.

Unchanged: PR runs are still never a source of reused packages or verification records, so the merge queue builds and attests as before.

Evidence

• Replay of all 37 open PRs (real payloads) through the new plan.py + approval rule:
  • team (chriskearney, DjDeveloperr, LiamRay11, maralcbr, joshuaswarren): full; joshuaswarren's held runs get auto-approved; drafts wait
  • non-team (Ante042, audreyt, briantoll, claytonfaria, e-jung, garymeyerca, GehrmannSolutions, invaliddayta, ludagoo, n0mahd, tonibergholm, zachfleeman): light, held for a maintainer
  • all 32 org members as synthetic MEMBER PRs: the 15 listed ones full, the 17 unlisted ones light
• Tests: 130 OK (new: vouched fork builds, unlisted collaborator/member gets checks only, non-team pusher on a team PR gets checks only, denounced overrides label, approval only for the newest held run of the exact head SHA and head repo, never for others). actionlint and zizmor 1.31.1 (pedantic) are clean.
• Security review (independent): no blocking findings. The medium finding (a non-team pusher on a team PR) is fixed by requiring the pusher to be vouched for as well.
• After merge: to check live, watch for a joshuaswarren push being approved and built, and a non-team PR staying held and getting checks only.

Merge Danger

Door: two-way

Revert, or edit VOUCHED.td.

Blast Radius: CI cost

More Namespace builds: one per push on each non-draft team PR. The new pull_request_target workflow has actions: write but runs only the target branch's code. It depends on the "require approval for all outside collaborators" setting staying on.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; the previous list-test issue is fixed and no new actionable issues were found.

Summary

Team pull requests get full builds on each non-draft update when both the author and sender are vouched for.

• Listed kernel teammates get full builds on each ready pull-request push.
• Vouched outside contributors get matching held kernel CI runs approved automatically.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  E[Pull request update] --> T[Read target branch team list]
  T --> V{Author and sender vouched?}
  V -->|Yes| A[Approve held kernel CI run]
  V -->|No| M[Leave held run for a maintainer]
  A --> P[Choose run plan]
  P --> D{Non-draft team pull request?}
  D -->|Yes| F[Checks and full build]
  D -->|No| L[Checks unless a maintainer requests a build]

Loading

_{Reviews (3) · Last reviewed commit: "ci: let the vouch list test accept denou..." · Reviewed by Greptile}