#33288 ci: a defaults call owner's SHIP receipt re-runs the defaults guard (#32979)

Summary

cmux-next-defaults-guard-review.yml re-runs the defaults guard when a trusted member posts a SHIP receipt comment. A private org member reads as CONTRIBUTOR to the workflow token, so this workflow skipped the receipts of lawrencecchen, a defaults call owner, on #32979 and #33111 ("The comment author is not a trusted repository member."). Each PR stayed red until a person re-ran the job by hand.

With this change, such an author also counts when they are a User listed in .github/defaults-call-owners.json at the PR's base commit. That is the same trusted file the guard reads, and the guard trusts call owners since #33111.

• The file is read with a treeless git fetch of the base commit (about 1 s and 2 MB). It is not read through the API, because the API quota ran out under load (#32983).
• Any failure trusts nobody.
• The workflow decides only whether to wake the guard. The guard still judges the receipt.

The workflow runs from main for every PR comment, so the change goes into main.

Regression command: python3 tests/test_defaults_guard_review_rerun.py

• Test commit: 1 failure, test_a_call_owner_who_reads_as_contributor_wakes_the_guard.
• Head: 14 tests OK.
• New refusal tests, all of which stay ineligible: a non-owner contributor, a Bot with an owner's login, an empty owners list, a failed git fetch, and an empty login. The fake gh fails on any contents or collaborators API call.

Observed / Not run

Observed:

• The tests above, red then green.
• The extracted is_call_owner function run against the real repo at the feat-cmux-next tip: LawrenceCChen gives owner, outsider gives not owner, and a bad sha gives not owner.

Not run: a live issue_comment run. That happens on the first owner receipt after this merges.

Changelog

none

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the defaults guard re-run workflow so a defaults call owner's SHIP receipt re-runs the guard even when the author reads as CONTRIBUTOR to the workflow token.

• A User listed in .github/defaults-call-owners.json at the base commit now counts, read via a treeless git fetch instead of the API, whose quota ran out under load (#32983).
• Any failure trusts nobody, and the guard still validates the receipt itself. The workflow runs from main for every PR comment and checks the same owners file the guard trusts.

Tests

• New tests cover a contributor call owner waking the guard, plus refusals for a non-owner contributor, a Bot with an owner's login, an empty owners list, a failed git fetch, and an empty login.