ci: document why the self-hosted lint gate allows opened/reopened fork PRs

[PastaPastaPasta]

Issue being fixed or feature implemented

is_selfhosted_allowed() in select_dynamic_runner.py described GITHUB_ACTOR as "whoever pushed the head that is about to run". That is only true for synchronize. On opened and reopened the actor is whoever opened or reopened the pull request, so the head of an allowlisted fork may have been pushed by a collaborator on that fork who is not on SELFHOSTED_LINT_AUTHORS.

That reads like a gap, and it has been reported as one. It is intended behaviour. This PR fixes the comment and explains why the behaviour is fine, so it stops being "fixed".

What was done?

Comment-only change in is_selfhosted_allowed():

• The actor comment now says the actor is whoever triggered the event: the pusher on synchronize, the person who opened or reopened the PR on opened/reopened.
• A new note explains the trust model. The gate trusts allowlisted people and the repositories they own, not individual commits:
  • Anyone an allowlisted fork owner lets push to their fork is trusted the same way as anyone with write access to a same-repo head. Same-repo heads are already allowed for any action on that basis.
  • An allowlisted user who opens, reopens or pushes to a PR is vouching for its head. synchronize already lets an allowlisted push carry someone else's earlier commits.
  • Getting code onto the runner always needs write access granted by an allowlisted person. The actor, the author and the fork owner must all be on the allowlist.
  • Limiting forks to synchronize would not change who is trusted. It would only send every first run, and every close/reopen used to retrigger CI, to hosted runners, which is exactly when the backlog rung is meant to help.

No behaviour change.

How Has This Been Tested?

• python3 .github/workflows/test_select_dynamic_runner.py: 27 tests pass.
• COMMIT_RANGE=HEAD~1..HEAD test/lint/lint-whitespace.py: clean.

Breaking Changes

None.

Checklist:

• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• I have assigned this pull request to a milestone (for repository code-owners and collaborators only)

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 25 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 5713eb8b-7131-4db6-b718-435023d67c5f

📥 Commits

Reviewing files that changed from the base of the PR and between 8819507 and 4d65f2b.

📒 Files selected for processing (2)

• .github/workflows/select_dynamic_runner.py
• .github/workflows/test_select_dynamic_runner.py

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

🕓 Review not started yet because the new head is waiting for the 30-minute push debounce.

• Request normal review — click when the PR is ready for review.
• Request priority review — click to move this review to the front of the queue.

Commit f879467. Normal review starts when eligible; priority review starts as soon as a slot is available.

[thepastaclaw]

Final validation — Phase 1 + Phase 2

Static verification at head 4d65f2b found no in-scope defects: the fork-only synchronize gate implements the stated security fix while preserving identity checks, same-repository eligibility, and hosted/Blacksmith fallback. The regression tests cover the changed action handling; the diagnostic nitpick and pre-existing CI test-wiring gap do not warrant review findings. No tests or builds were run locally; the supplied CI snapshot shows successful completed checks, with arm64 container builds, depends-source caching, and check_merge still queued, and predict_conflicts cancelled.

Review provenance

Source: reviewer 1: glm-5.3-flash (agent: phase1-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 3: gpt-6.1-sol (agent: phase2-reviewer, role: dash-core-commit-history); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

• Triage: low by gpt-6.1-sol (effort low) — The diff adds a small, well-contained event-action guard to the CI runner selector with focused regression tests, making correctness straightforward to confirm.
• Phase 1 reviewers: glm-5.3-flash — general (completed, effort high); agent phase1-reviewer
• Phase 1 model: glm-5.3-flash — zai quota: 5h 99% left, weekly 69% left; passed over gemini-3.8-flash-high (antigravity below 15% reserve: weekly 15% left, 5h 100% left)
• Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
• Phase 2 reviewers: gpt-6.1-sol — general (completed, effort medium); agent phase2-reviewer, gpt-6.1-sol — dash-core-commit-history (completed, effort medium); agent phase2-reviewer

[PastaPastaPasta]

approved