fix(github): Deny pull request approvals at egress - #1500
Merged
Conversation
Block APPROVE on review create/submit while still allowing request-changes, comment reviews, and dismissals. Inspect review REST bodies before credential grant so oversized approve attempts cannot skip the check. Co-Authored-By: David Cramer <david@sentry.io>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
dcramer
marked this pull request as ready for review
August 13, 2026 00:21
Co-Authored-By: David Cramer <david@sentry.io>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 8bad228. Configure here.
Require parseable JSON review bodies on POST /reviews so form-encoded or malformed APPROVE payloads cannot skip the no-approve gate. Empty create bodies remain allowed for pending reviews.
![sentry-warden[bot]](https://avatars.githubusercontent.com/in/2755838?s=60&v=4){kind=small}
Stop skipping GitHub body inspection when an operation is set. Plugin-tool egress always carries an operation, and that short-circuit let APPROVE create-review requests bypass the no-approve gate.
Bring in #1501's owned issue/PR update routing while keeping the no-approve review firewall. Run the review denial before owned-operation early returns, and keep plugin.ts under the line limit via a focused review-policy module. Co-Authored-By: David Cramer <david@sentry.io>
dcramer
approved these changes
Aug 13, 2026
dcramer
left a comment
dcramer
left a comment
Member
There was a problem hiding this comment.
we definitely have to move all this github stuff out of core and into the plugin
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Junior can still request changes, leave comment reviews, and dismiss its own review. It can no longer greenlight a PR.
This blocks
APPROVEat the GitHub egress grant gate for:POST /repos/{owner}/{repo}/pulls/{n}/reviewsPOST /repos/{owner}/{repo}/pulls/{n}/reviews/{id}/eventsCore now inspects those REST bodies before credential grant, including oversized bodies, so an approve attempt cannot skip the check by omitting or bloating the payload. GraphQL mutations remain denied.
Verified:
pnpm --filter @sentry/junior-github exec vitest run tests/github-plugin.test.ts -t "pull request review|denies GitHub pull request approvals"pnpm --filter @sentry/junior exec vitest run tests/integration/sandbox-egress-proxy.test.ts -t "denies oversized raw GitHub"Requested by David Cramer.
--
View Junior Session [Sentry]