feat(tcfeed): stop asking repositories that have already said no to strangers - #140
Merged
Merged
Conversation
…trangers
mempool/mempool restricts interactions to prior contributors. The issue
was refused, and the run then forked the repository, cloned it, wrote
two files, pushed a branch and asked for a pull request — which was
refused on the identical ground:
Interactions on this repository have been restricted to prior
contributors only. (createIssue)
Interactions on this repository have been restricted to prior
contributors only. (createPullRequest)
A repository with that setting has said no to everybody it has not met,
in advance and in general. There is nothing to learn from asking twice
in two ways, and the second attempt is a fork and a push into somebody's
notification feed to reach the same answer.
Detected from the refusal rather than asked in advance, because it
cannot be asked: GET /repos/{owner}/{repo}/interaction-limits requires
admin rights on the repository and answers 403 for restricted and
unrestricted repositories alike. Verified against mempool/mempool and
ashinn/chibi-scheme — identical 403 from both, so the endpoint cannot
tell them apart from outside.
Matched on the sentence rather than a status code: the failure arrives
as a GraphQL error with no distinguishing code, and both the plural
"Interactions ... have been" and the singular "Interaction ... has been"
forms exist depending on which restriction is set. Unrelated failures
still report as before.
Verified end to end against the repository that caused it:
· mempool/mempool — skipped: restricted to prior contributors
one line, and nothing forked, cloned, pushed or opened.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ThreatCrush Security Scan69 finding(s) HIGH/CRITICAL: 12 | MEDIUM: 56 | LOW: 1
…and 19 more. Full results in the Security tab. Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
mempool/mempoolrestricts interactions to prior contributors. The issue was refused — and the run then forked the repository, cloned it, wrote two files, pushed a branch and asked for a pull request, which was refused on the identical ground:A repository with that setting has said no to everybody it hasn't met, in advance and in general. There's nothing to learn from asking twice in two ways, and the second attempt is a fork and a push into somebody's notification feed to reach the same answer.
Why it's detected from the refusal, not asked in advance
Because it can't be asked.
GET /repos/{owner}/{repo}/interaction-limitsrequires admin rights on the repository and answers403for restricted and unrestricted repositories alike. Verified against bothmempool/mempoolandashinn/chibi-scheme— identical 403 — so the endpoint cannot tell them apart from outside.Matched on the sentence rather than a status code: the failure arrives as a GraphQL error with no distinguishing code, and both the plural "Interactions … have been" and singular "Interaction … has been" forms exist depending on which restriction is set. Unrelated failures still report as before.
Verification
End to end against the repository that caused it:
One line — nothing forked, cloned, pushed or opened. Regex checked against both phrasings plus two unrelated errors to confirm it doesn't over-match.
🤖 Generated with Claude Code