mirror of
https://github.com/anthropics/claude-plugins-official.git
synced 2026-08-13 11:57:02 -03:00
2534b1b6ab
Replace the per-username allowlist with a source-org allowlist so no individual is named in the repo. A non-member PR stays open only if it adds marketplace.json entries whose source.url is under an allowlisted prefix and changes nothing else; merge still requires CI + maintainer approval. - external-pr-allowed-sources.json: flat allowed_sources prefixes (no usernames) - scripts/external-pr-scope.js: shared additions-only / allowed-source logic - close-external-prs.yml + external-pr-scope-guard.yml: both use the shared module Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
21 lines
1001 B
JSON
21 lines
1001 B
JSON
{
|
|
"$comment": [
|
|
"Source orgs/repos from which a pull request opened by a non-member is allowed to stay",
|
|
"open (instead of being auto-closed). Used by .github/workflows/close-external-prs.yml",
|
|
"and .github/workflows/external-pr-scope-guard.yml via .github/scripts/external-pr-scope.js.",
|
|
"",
|
|
"This keys on the SOURCE repo, not on individuals — no usernames are listed. A non-member",
|
|
"PR is in scope only if it ADDS marketplace.json entries whose source.url is under one of",
|
|
"these prefixes and changes nothing else. Being in scope grants ONLY the right to open a",
|
|
"reviewable PR: all CI still runs and a maintainer approval is still required before merge.",
|
|
"",
|
|
"Matching is case-insensitive and boundary-safe on the normalized https URL (leading",
|
|
"https:// and trailing .git removed): github.com/ui5 does NOT match github.com/ui5-evil."
|
|
],
|
|
"allowed_sources": [
|
|
"github.com/UI5/",
|
|
"github.com/SAP/",
|
|
"github.com/SAP-samples/"
|
|
]
|
|
}
|