From b723a105d1b5556780f0bc3a02017567bfac3d03 Mon Sep 17 00:00:00 2001 From: JSONbored <49853598+JSONbored@users.noreply.github.com> Date: Wed, 29 Jul 2026 04:15:47 -0700 Subject: [PATCH 1/2] chore(superagent): disable contributor-trust scoring, keep the security scan MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The contributor-trust check has been posting `action_required` on established contributors' PRs — shin-core scored 10/100 "dangerous" on PR #9816 — and was a major source of manual-review volume. Two independent reasons to turn it off rather than tune it further: 1. The trustedAuthors exemption does not work. shin-core is listed in it and was still flagged. An exemption that does not exempt is worse than none: it looks handled while every affected PR still stalls. 2. Its verdict has no consumer. LoopOver now lists this check under gate.ignoredCheckRuns (#9813) on all three gate repos, so a non-passing result no longer gates, pends, or holds anything. Leaving it on produces a permanently red check on contributor PRs that nothing acts on — noise that makes good contributors think they have failed something. prScan stays enabled and still gates CI normally: that is the protection worth having, and it is a different check from the same app. trustedAuthors is kept (inert) so the history survives if this is ever revisited. --- .github/superagent.yml | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/.github/superagent.yml b/.github/superagent.yml index c6f5fa4656..e4b1aaf0bf 100644 --- a/.github/superagent.yml +++ b/.github/superagent.yml @@ -3,12 +3,24 @@ prScan: enabled: true +# Contributor-trust scoring is DISABLED (2026-07-29). Two independent reasons: +# +# 1. It does not discriminate here. Established repeat contributors with dozens of merged PRs were scored +# "dangerous" (10/100) on volume/velocity alone, with no real signal behind it. The `trustedAuthors` +# exemption below was added to fix exactly that and did NOT work — shin-core is listed and was still +# flagged `action_required` on PR #9816. An exemption that does not exempt is worse than no exemption: +# it looks handled while every affected PR still stalls. +# 2. Its verdict has no consumer left. LoopOver now lists this check under `gate.ignoredCheckRuns` +# (#9813) on all three gate repos, so a non-passing result no longer gates, pends, or holds anything. +# Leaving it enabled only produces a permanently-red check on contributor PRs that nothing acts on — +# pure noise that makes good contributors think they have failed something. +# +# The SECURITY SCAN above stays enabled and still gates CI normally: that is the protection worth having, +# and it is a different check from the same app. `trustedAuthors` is kept (inert while disabled) so the +# history is not lost if this is ever revisited. contributorTrust: - enabled: true + enabled: false blockBelowScore: 30 - # These are established, high-volume repeat contributors (dozens of merged PRs each) who kept tripping - # the trust scorer on volume/velocity alone, not on any real signal. Exempts them from contributor-trust - # scoring entirely going forward. trustedAuthors: [dhgoal, shin-core, andriypolanski] comments: From fbdf8dd705a79082a55762003ef076aeed9fc8b7 Mon Sep 17 00:00:00 2001 From: JSONbored <49853598+JSONbored@users.noreply.github.com> Date: Wed, 29 Jul 2026 04:18:15 -0700 Subject: [PATCH 2/2] chore(superagent): drop the trustedAuthors allowlist too It provably does not work (a listed author was still flagged action_required) and is inert with contributorTrust disabled. Keeping it would only suggest the repo has a working exemption mechanism that it does not. --- .github/superagent.yml | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/.github/superagent.yml b/.github/superagent.yml index e4b1aaf0bf..94e95ad417 100644 --- a/.github/superagent.yml +++ b/.github/superagent.yml @@ -6,22 +6,20 @@ prScan: # Contributor-trust scoring is DISABLED (2026-07-29). Two independent reasons: # # 1. It does not discriminate here. Established repeat contributors with dozens of merged PRs were scored -# "dangerous" (10/100) on volume/velocity alone, with no real signal behind it. The `trustedAuthors` -# exemption below was added to fix exactly that and did NOT work — shin-core is listed and was still -# flagged `action_required` on PR #9816. An exemption that does not exempt is worse than no exemption: -# it looks handled while every affected PR still stalls. +# "dangerous" (10/100) on volume/velocity alone, with no real signal behind it. A `trustedAuthors` +# allowlist was added to fix exactly that and did NOT work — shin-core was listed and still flagged +# `action_required` on PR #9816 — so it has been REMOVED rather than carried along inert and +# misleading. An allowlist that does not allow is worse than none: it looks handled while every +# affected PR still stalls. # 2. Its verdict has no consumer left. LoopOver now lists this check under `gate.ignoredCheckRuns` # (#9813) on all three gate repos, so a non-passing result no longer gates, pends, or holds anything. # Leaving it enabled only produces a permanently-red check on contributor PRs that nothing acts on — # pure noise that makes good contributors think they have failed something. # # The SECURITY SCAN above stays enabled and still gates CI normally: that is the protection worth having, -# and it is a different check from the same app. `trustedAuthors` is kept (inert while disabled) so the -# history is not lost if this is ever revisited. +# and it is a different check from the same app. contributorTrust: enabled: false - blockBelowScore: 30 - trustedAuthors: [dhgoal, shin-core, andriypolanski] comments: mode: detailed