[community] Update community contributions in README#38009
Conversation
- Add newly attributed issues from Tier 0-2 analysis (Tier 1 and Tier 2 matches) - Include issue #35682 for @arthurfvives - Include issue #34949 for @dholmes - Include issue #36857 for @michen00 - Include new contributors and updates from this period - Add Tier 4 section with 5 unlinked community issues needing manual review: - #36674 (@app/github-actions) - #36651 (@brase) - #35783 (@pelikhan) - #32974 (@arthurfvives) - #32608 (@jobayer-4) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
pelikhan
deleted the
community/update-contributions-2026-06-bc3920dda9a495f3
branch
|
🧪 Test Quality Sentinel completed test quality analysis. No test files were added or modified in this PR. PR #38009 only modifies README.md (community contributions update). Test Quality Sentinel skipped. |
|
🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅ |
|
✅ Design Decision Gate 🏗️ completed the design decision gate check. No ADR enforcement needed: PR #38009 does not have the implementation label (has_implementation_label=false) and has 0 new lines of code in business logic directories (default_business_additions=0, threshold=100). Neither Condition A nor Condition B is met. |
|
✅ PR Code Quality Reviewer completed the code quality review. |
There was a problem hiding this comment.
Pull request overview
This PR updates the repository’s README.md “Community Contributions” section to refresh attributed community issue credits and add a new “Tier 4” style list of attribution candidates that require manual review.
Changes:
- Updates multiple contributor attribution rows (adds several new issue numbers, removes some existing ones).
- Adds a new “
⚠️ Attribution Candidates Need Review” section listing five recently-closed issues that lacked confirmed PR linkage.
Show a summary per file
| File | Description |
|---|---|
| README.md | Refreshes the community attribution list and adds a new manual-review candidates section. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 1/1 changed files
- Comments generated: 6
| - @AlexDeMichieli: #26645 _(direct issue)_ | ||
| - @alondahari: #21207 _(direct issue)_ | ||
| - @anthonymastreanvae: #32481 _(direct issue)_, #32479 _(direct issue)_, #30897 _(direct issue)_, #30841 _(direct issue)_ |
| - @johnpreed: #25687 _(direct issue)_, #23777 _(direct issue)_, #23212 _(direct issue)_, #21334 _(direct issue)_ | ||
| - @johnwilliams-12: #21205 _(direct issue)_ | ||
| - @jonathanpeppers: #30662 _(direct issue)_ | ||
| - @jonathanpeppers: #32893 _(direct issue)_, #30662 _(direct issue)_ |
| - @mason-tim: #33084 _(direct issue)_, #33074 _(direct issue)_, #31489 _(direct issue)_, #30336 _(direct issue)_, #29301 _(direct issue)_, #21562 _(direct issue)_ | ||
| - @MatthewLabasan-NBCU: #26289 _(direct issue)_ | ||
| - @MattSkala: #24567 _(direct issue)_, #21203 _(direct issue)_ | ||
| - @MattSkala: #24567 _(direct issue)_ |
| - @stefankrzyz: #27260 _(direct issue)_ | ||
| - @straub: #24569 _(direct issue)_ | ||
| - @strawgate: #33597 _(direct issue)_, #24422 _(direct issue)_, #24199 _(direct issue)_, #23935 _(direct issue)_, #23768 _(direct issue)_, #21157 _(direct issue)_ | ||
| - @strawgate: #33597 _(direct issue)_, #24422 _(direct issue)_, #24199 _(direct issue)_, #23935 _(direct issue)_, #23768 _(direct issue)_ |
| - @tylersmalley: #35287 _(direct issue)_ | ||
| - @verkyyi: #27407 _(direct issue)_, #27259 _(direct issue)_ | ||
| - @veverkap: #22362 _(direct issue)_, #21260 _(direct issue)_, #21257 _(direct issue)_ | ||
| - @veverkap: #22362 _(direct issue)_ |
|
|
||
| ### ⚠️ Attribution Candidates Need Review | ||
|
|
||
| The following community issues were closed during this period but could not be automatically linked to a specific merged PR. Please verify whether they should be credited: |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Skills-Based Review 🧠
Applied /grill-with-docs — documentation-only change, no blocking issues.
📋 Key Themes & Highlights
Key Themes
-
New section lifecycle: The added
⚠️ Attribution Candidates Need Reviewsection needs a clear resolution strategy — will subsequent workflow runs replace it or accumulate new candidates? If replaced each run, README readers see stale data between runs; if accumulated, the section grows unbounded. A GitHub issue per batch (opened and closed by the workflow) or a dedicated wiki page would track this more durably than in-README prose. -
Unexplained removals: Several entries are removed in this PR — entire contributor records (
@alondahari,@johnwilliams-12) and individual issues (@MattSkala #21203,@strawgate #21157,@veverkap #21260/#21257) — with no explanation in the PR description. The automated triage criteria are described for additions/Tier 0-4, but not for de-attribution. A brief note (e.g., "issues no longer meeting stateReason=COMPLETED criteria") would help human reviewers validate the removals.
Positive Highlights
- ✅ Transparent about ambiguous cases — surfacing Tier 4 candidates rather than silently dropping them is the right instinct.
- ✅ Clear labeling with (direct issue) maintains consistent attribution format throughout.
- ✅ PR description documents the full triage tier methodology (Tier 0–4), which is helpful context.
🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · 146.4 AIC · ⌖ 13.4 AIC
|
|
||
| </details> | ||
|
|
||
| ### ⚠️ Attribution Candidates Need Review |
There was a problem hiding this comment.
[/grill-with-docs] The ### ⚠️ Attribution Candidates Need Review section introduces a persistent prompt for manual review directly in the public README. Two lifecycle questions worth clarifying:
💡 Lifecycle and placement considerations
-
Replacement vs. accumulation: Will the next workflow run replace this section entirely (clean state), append new candidates, or leave resolved items in place? If items accumulate across runs without removal, the section will grow with stale data.
-
Audience fit: The README is a public-facing document;
no confirmed PR linkage foundis an internal triage signal. A dedicated GitHub issue or a wiki page might be a more appropriate home — keeping the README focused on confirmed, resolved attributions and giving maintainers a trackable item to close once the review is done.
There was a problem hiding this comment.
REQUEST_CHANGES — one high-severity injection gap in the compiler's YAML output generation plus two medium security issues.
### Blocking issues (3)
[HIGH] Unescaped target-repo → YAML injection in generated workflow (compiler_safe_outputs_steps.go:221, also push_to_pull_request_branch.go:66, compiler_safe_outputs_steps.go:347): targetRepoSlug from user frontmatter is fmt.Sprintf'd directly into repository: %s without YAML quoting. A block-scalar value with embedded newlines lets a workflow author inject arbitrary keys into the actions/checkout with: block — overriding token:, ref:, or persist-credentials:. This is the same class of injection that patch-fix-heredoc-delimiter-injection and patch-escape-mcp-template-expressions address elsewhere in this PR; repository: was missed.
[MEDIUM] normalize_github_host does not strip newlines → GITHUB_ENV injection (configure_gh_for_ghe.sh:76 and :109): The host extracted from GITHUB_SERVER_URL / GITHUB_ENTERPRISE_HOST is written verbatim to $GITHUB_ENV. The normalizer strips the URL scheme and path but not \n or \r. A host string containing a literal newline would inject an extra variable into every subsequent step's environment.
[MEDIUM] CTR-015 wildcard check omits merge-pull-request.allowed-labels (safe_outputs_allowed_labels_validation.go:39): The validator covers four handlers but silently skips merge-pull-request.AllowedLabels, allowing allowed-labels: ["*"] on that handler to bypass the restriction.
### Non-blocking (1)
[LOW] Unreachable duplicate cleanup block (configure_gh_for_ghe.sh:81-87): identical condition to the preceding block; after unset GH_HOST in the first block the second can never execute. The dead block also writes GH_HOST= (empty) vs. GH_HOST=github.com in the first — an inconsistency if the code ever becomes reachable.
🔎 Code quality review by PR Code Quality Reviewer · 88.7 AIC · ⌖ 37.1 AIC
[community] Update community contributions in README
PR #38009 ·
community/update-contributions-2026-06-bc3920dda9a495f3→main· Labels:automation,communitySummary
Automated daily update to the community contributions section in⚠️ Attribution Candidates Need Review" section surfacing 5 unlinked community issues that require manual verification.
README.md. Adds new issue attributions for 9 contributors, corrects/deduplicates existing entries for 5 contributors, and introduces a new "What changed
File:
README.md(community contributions<details>block only)New issue attributions added
@arthurfvives@dholmes@jamesadevine@JamesNK@jonathanpeppers@michen00@sg650@Yoyokrazy@yskopetsCorrections / deduplication
@alondahari@johnwilliams-12@MattSkala@strawgate@veverkapNew section: Attribution Candidates Need Review
Five community issues that were closed but could not be automatically linked to a merged PR are surfaced for manual follow-up:
@app/github-actions@brase@pelikhan@arthurfvives@jobayer-4Impact
README.md)Reviewer action required
The five issues in the Attribution Candidates Need Review section need a human to confirm or deny attribution before they can be added to the contributor list. Each was closed without a detectable keyword link to a merged PR.