fix(ci): only run snapshot acceptance for trusted editors on same-repo PRs
Fixes the first finding in darkmatter/infra#67.
update-snapshots.yaml starts on any edit to a comment that contains the Storybook marker and a newly ticked checkbox. It never checked who wrote or edited that comment, and the job runs the PR's code with the Cachix token and a write-capable darkmatter[bot] token.
This change requires, before any secret is used:
- the comment to be the one darkmatter[bot] posted,
- the editor to have write, maintain or admin access, and
- the PR branch to be in this repository, not a fork.
The same editor and same-repo check also runs for a manual dispatch with a PR number.
The workflow is disabled until this merges. Its 13 non-skipped runs all failed or were cancelled (last on Jul 22), so nothing depends on it today. After merging, re-enable it with gh workflow enable update-snapshots.yaml -R darkmatter/nixmac.
Not tested end to end, since that needs a real Storybook comment edit. The YAML parses and the new step passes shellcheck.
š¤ Generated with Claude Code
https://claude.ai/code/session_01GziRscHrScu7ad1Btf1An7
Summary by cubic
Fixes the snapshot acceptance workflow so only trusted editors can trigger it with a same-repo PR. Previously any comment edit that flipped the accept checkbox could start a job running PR code with the Cachix token and a write-capable darkmatter[bot] token. Now the comment must be the one darkmatter[bot] posted, the editor must have write, maintain, or admin access, and the PR branch must be in this repository. The same checks apply to manual dispatch with a PR number. The workflow is disabled until this merges; after merging, re-enable it with gh workflow enable update-snapshots.yaml -R darkmatter/nixmac.