feat(extract): ingest selection knob + keep dotted numbers intact #151

	name: trust-gate
	on:
	pull_request:
	types: [opened, synchronize, reopened, edited]
	permissions:
	contents: read
	jobs:
	trust-gate:
	runs-on: ubuntu-latest
	steps:
	# check out the BASE ref so the classification logic is trusted, never the
	# PR head (which could tamper with pr_bot.py — itself a core path).
	- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	with:
	ref: ${{ github.event.pull_request.base.sha }}
	persist-credentials: false
	- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: "3.12"
	- name: list changed files
	env:
	GH_TOKEN: ${{ github.token }}
	run: \|
	gh pr view "${{ github.event.pull_request.number }}" \
	--repo "${{ github.repository }}" \
	--json files --jq '.files[].path' > changed.txt
	- name: fail if an untrusted author touched core
	env:
	ASSOC: ${{ github.event.pull_request.author_association }}
	ACTOR: ${{ github.event.pull_request.user.login }}
	run: \|
	if PYTHONPATH=src python -m vouch.pr_bot trust \
	--author-association "$ASSOC" --actor "$ACTOR"; then
	echo "trusted author — core edits allowed"
	exit 0
	fi
	if PYTHONPATH=src python -m vouch.pr_bot core-touched --files-file changed.txt; then
	echo "::error::untrusted author modified a core path; core changes need owner review"
	exit 1
	fi
	echo "untrusted author, no core paths touched — ok"

Navigation Menu