[jdx]

Summary

• reserve Namespace runners and the server cache for same-repository PRs authored by jdx
• route every other PR author, including dependency bots, through GitHub-hosted runners and GitHub cache
• keep trusted-only repository secrets unavailable to non-jdx PRs

Validation

• git diff --check
• actionlint workflow and expression validation
• confirmed no dependency-bot-specific trust predicates remain

AI-assisted — Tool: Codex; model: OpenAI/GPT-5; version: unavailable.

Summary by CodeRabbit

• Chores
  • Updated pull request validation to use more appropriate execution environments based on the source and author of each change.
  • Improved handling of contributions from forks and external contributors.
  • Standardized runner selection across build, compatibility, and final verification workflows.
  • Maintained specialized execution for qualifying repository-authored pull requests.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 90dfd0a3-52c9-4dd7-a8fa-10dec6b7855d

📥 Commits

Reviewing files that changed from the base of the PR and between 4754432 and f148d06.

📒 Files selected for processing (2)

• .github/actions/mbx/action.yml
• .github/workflows/ci.yml

Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

Pull request backend and CI runner selection now uses repository origin and author identity. Pull requests authored by jdx use trusted or namespace infrastructure. Other pull requests use GitHub cache or GitHub-hosted runners.

Changes

Pull request routing policy

Layer / File(s)	Summary
Backend and CI routing conditions .github/actions/mbx/action.yml, .github/workflows/ci.yml	The backend uses the GitHub cache for forked or non-jdx pull requests. The build, ci-libgit2, ci-nolibgit2, ci-other, msrv, and final jobs use GitHub-hosted runners for non-jdx pull requests and namespace runners for jdx pull requests.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to f148d

The change limits trusted runners, cache, and secrets to same-repository pull requests authored by jdx while routing other authors through GitHub-hosted infrastructure; no actionable merge-blocking risk remains after normal checks and review.

Poem

A rabbit checks the runner lane

jdx hops through namespace rain
Other pulls use GitHub’s track
The cache keeps the backend back
CI bounds forward, neat and plain

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the CI security change that restricts trusted mbx runs to the jdx user.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR restricts trusted CI resources to same-repository pull requests opened by jdx.

• Routes all other pull requests to GitHub-hosted runners.
• Routes all other pull requests to the GitHub cache backend instead of the trusted mbx server.
• Applies the same predicate consistently across the affected CI jobs and composite action.

Confidence Score: 5/5

The PR appears safe to merge, with the runner and cache trust restrictions applied consistently.

The changed conditions preserve fork isolation and narrow privileged runner and cache-server access from most same-repository pull requests to those opened by jdx, without introducing a concrete reachable failure.

Important Files Changed

Filename	Overview
.github/actions/mbx/action.yml	Restricts the trusted mbx server backend to non-PR runs and same-repository PRs opened by jdx; no actionable defect found.
.github/workflows/ci.yml	Consistently restricts Namespace runner selection across affected jobs using the same repository-and-author predicate; no actionable defect found.

_{Reviews (1): Last reviewed commit: "security(ci): restrict trusted mbx runs ..." | Re-trigger Greptile}