elastic / elastic/ai-github-actions
[workflow-patrol] Workflow drift detected: pr-conflict-addresser missing caller roles/bots guardrails
- Dominant language
- Python
- Stars
- 11
- Forks
- 16
- Avg merge
- 22h 9m
- Merged PRs (30d)
- 31
Description
## Findings
### 1. `gh-aw-pr-conflict-addresser.md` is missing caller guardrail fields used by the established bot-allowlist pattern
**Deviating workflow**
- `.github/workflows/gh-aw-pr-conflict-addresser.md`
**Majority pattern**
- Among workflows that define `allowed-bot-users`, `49/50` also define both `on.roles` and `on.bots` (98%).
- Verified examples following the majority pattern:
- `.github/workflows/gh-aw-pr-review.md:73-74`
- `.github/workflows/gh-aw-pr-review-addresser.md:65-66`
- `.github/workflows/gh-aw-pr-actions-fixer.md:58-59`
**What is different**
- `gh-aw-pr-conflict-addresser.md` defines `allowed-bot-users` (`.github/workflows/gh-aw-pr-conflict-addresser.md:44`) and uses it in the GitHub tool trust policy (`.github/workflows/gh-aw-pr-conflict-addresser.md:74`), but does not define `on.roles` or `on.bots` under `on`.
**Why this appears to be drift (not intentional)**
- The workflow already participates in the same caller-trust pattern (`allowed-bot-users` + `trusted-users`) used by peers, but is missing the caller gate fields that nearly all comparable workflows include.
- This is a public workflow and not one of the documented internal-only exceptions.
**Suggested fix**
- Add the missing caller gate fields under `on` in `.github/workflows/gh-aw-pr-conflict-addresser.md`:
- `roles: [admin, maintainer, write]`
- `bots:` with `- "${{ inputs.allowed-bot-users }}"`
## Suggested Actions
- [ ] Add `on.roles` and `on.bots` to `gh-aw-pr-conflict-addresser.md` to match the repository’s established bot-allowlist workflow pattern.
> Generated by [Internal: Workflow Patrol](https://github.com/elastic/ai-github-actions/actions/runs/34356330111) · gpt53codex · 100.9 AIC · ⌖ 4 AIC · ⊞ 23.5K · [◷](https://github.com/search?q=repo%3Aelastic%2Fai-github-actions+is%3Aissue+%22gh-aw-workflow-call-id%3A+elastic%2Fai-github-actions%2Fworkflow-patrol%22&type=issues)
> - [x] expires on Sep 16, 2026, 1:32 PM UTC
Contributor guide
Assessment
This issue has not been assessed yet.