Bryan Thompson 2534b1b6ab

refactor(ci): key external-PR allowlist on source org, not individuals ...

Replace the per-username allowlist with a source-org allowlist so no
individual is named in the repo. A non-member PR stays open only if it
adds marketplace.json entries whose source.url is under an allowlisted
prefix and changes nothing else; merge still requires CI + maintainer
approval.

- external-pr-allowed-sources.json: flat allowed_sources prefixes (no usernames)
- scripts/external-pr-scope.js: shared additions-only / allowed-source logic
- close-external-prs.yml + external-pr-scope-guard.yml: both use the shared module

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-25 11:35:27 -05:00

..

discover_bumps.py

Add auto-SHA-bump workflow for marketplace plugins (#1392)

2026-04-17 09:12:36 -07:00

external-pr-scope.js

refactor(ci): key external-PR allowlist on source org, not individuals

2026-06-25 11:35:27 -05:00

validate-frontmatter.ts

fix(ci): skip frontmatter validation for files nested inside skill content

2026-02-17 17:12:34 -08:00