#33111 defaults guard: a call owner's SHIP counts when the REST quota is spent (#32983)

Summary

The defaults guard stayed red on #32983 with a valid receipt (Review (independent-subagent): SHIP at 8af92c61... by lawrencecchen). The merge service then left the PR out as "defaults guard red".

Cause: lawrencecchen's org membership is private. The workflow's token sees a private member as CONTRIBUTOR. The guard then asks the REST API (collaborators/<login>/permission) for write access. That call uses the installation's REST quota, and other jobs use the same quota. In run 41576329148 the call got API rate limit exceeded for installation. A failed lookup trusts nobody, so the guard rejected the receipt. The error message gave no reason ("needs a comment or review whose first line is ..."). It was not an old guard version: scripts/ci/defaults_guard.py is the same at the PR base c2933eb2bdf4 and at feat tip.

Fix:

• A receipt from a call owner in .github/defaults-call-owners.json is trusted without the REST lookup. The guard reads that file from the trusted base, and the same file already lets these owners approve a default directly.
• Other private members are still looked up. If a lookup fails for a reason other than 404, a new error line names the receipt that was not counted and says to re-run the check when the quota resets.

Regression command: python3 tests/test_defaults_guard.py

• Base (6723a4ee9c5, tests only): 2 failures. test_a_call_owners_receipt_ships_with_the_rest_quota_spent reproduces #32983 (owner receipt, CONTRIBUTOR association, rate-limited lookup) and gives the same warning and error as the CI log. test_a_receipt_whose_lookup_failed_is_named_in_the_error also fails.
• Head: 67 tests OK.

Changes to existing tests: the private-member fixtures used austinywang, who is a call owner. They now use a non-owner login, so they still test the lookup path. The "outsider" CONTRIBUTOR receipt now uses the login outsider, not the call owner teamleaderleo.

Observed / Not run

Observed:

• Job log of run 41576329148 (#32983): ::warning ... lawrencecchen: gh: API rate limit exceeded for installation, followed by the "needs a review" error.
• orgs/manaflow-ai/public_members/lawrencecchen returns 404 (the membership is private).
• I ran the fixed guard functions on #32983's live GraphQL data, with the association changed to CONTRIBUTOR and a rate-limited lookup. The result was ('ship', 'review (independent-subagent)'), with no lookup.
• python3 tests/test_defaults_guard.py red then green as above; scripts/cmux-next/prepush-gate.py clean.

Not run: a live pull_request_target run of this guard. The workflow checks out the guard from the PR base, so this change is first used by PRs whose base contains it.

Changelog

none

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the defaults guard so a call owner's SHIP receipt counts even when the GitHub REST quota is spent (#32983), and errors now name the receipt when a lookup fails for any reason other than 404.

• A call owner's receipt is trusted without a REST permission lookup, since the owners file is read from the trusted base.
• Non-owner members are still looked up; the error output now tells the re-run to wait for the quota to reset.