[ChiragAgg5k]

Why

Hansi never approves a pull request opened by a GitHub App bot, however clean the review is. isTrustedAuthor falls back to the collaborator permission API, and GitHub answers none for an App's bot account whatever access the App has, so the summary says the bot "does not have write access to this repository".

On Appwrite's repositories that leaves Renovate pull requests at Tier S with only a comment. On branches that require a review (for example appwrite-labs/monitoring#704) they stay blocked, 23 of them at the moment.

Fix

A bot is trusted when its pull request's branch is in the repository itself and the head commit on it is the bot's own, because only write access can put that commit there. An App that can only open pull requests can't pass this on someone else's branch. No configuration is needed, and it works per repository for every installation.

approveOutsideContributors wasn't an option: it would also approve human forks.

What stays the same

• A bot's pull request from a fork stays untrusted, and so does one whose head commit is someone else's, for example after a person pushes to the branch.
• People are still checked by association and permission.
• Open findings still cap the verdict, and a partial diff still never approves.

Worth weighing

This also covers Dependabot and any other App bot with a branch in the repository. A dependency bot's body quotes upstream release notes, so that text can now reach a review that may approve. It was already treated as untrusted input, and the approval guards outside the model still apply.

Testing

bun run check, bun run lint and bun test packages/github apps/worker pass. Against the real API, isTrustedAuthor returns true for the Renovate pull requests appwrite-labs/monitoring#704 and open-runtimes/open-runtimes#592. appwrite/cdn-for-astro#20 (a person's fork) gives botOnOwnBranch=false.

Here bun run check, bun run lint and bun run test all pass.

[hansi-codes]

🟢 Tier S · Ready to merge

The new tests exercise the bot trust checks and no actionable issues remain.

This pull request allows a GitHub App bot to count as trusted when its pull request targets a branch in the same repository and the head commit is attributed to that bot; otherwise the existing association and permission checks remain in place. It carries the pull-request and commit metadata through the GitHub client and approval guard, and adds coverage for same-repository versus fork detection, commit attribution, and lookup failures.

Latest changes: The latest commit adds tests for bot branch classification and for trusted-author decisions covering matching, mismatched, missing, and unreadable commit authors, plus fork handling.

Verdict	New comments	Fixed	Still open
✅ Approved	0	1	0

📂 Walkthrough · 7

File	Change
packages/github/src/pulls.ts	Identifies same-repository bot branches and verifies the head commit's author before trusting the bot.
packages/github/src/client.ts	Passes the expanded trust-check metadata through the Octokit client.
packages/engine/src/github.ts	Extends the engine GitHub contracts with bot branch and head SHA fields.
packages/engine/src/review-job.ts	Supplies the pull-request metadata to the approval restriction check.
packages/engine/src/testing.ts	Updates the in-memory GitHub test implementation for the expanded client contract.
packages/engine/src/chat-job.test.ts, packages/engine/src/review-job.test.ts, packages/engine/src/scope.test.ts	Adds bot branch metadata to pull-request fixtures.
packages/github/src/pulls.test.ts	Tests same-repository bot classification and commit-author-based trust, including fork and API failure cases.

✅ Fixed since the last review · 1

• Add coverage for the bot-commit trust check · packages/github/src/pulls.ts:55

---

_{Reviewed the commits since 47f3aa5 · Details · Comment @hansi-codes review to re-run, or mention @hansi-codes with a question.}

[hansi-codes]

🔵 Tier A · Looks good to merge. Summary

[hansi-codes]

🟢 Tier S · Looks good to merge. Summary