Agent Wranglers

AID-29Required

Run agents in CI only for trusted people

An agent in CI starts only for people with write access to the repository. Its job holds no secrets it does not need.

By Agent Wranglers. Updated .

How to do it

Anyone can write an issue or a fork pull request, and the agent reads it as instructions. Check the author's permission before the agent starts. Give the job a read-only token and let it propose changes only as a pull request for review. Never run it on pull_request_target with code from a fork. See keep build secrets from forks. Text from issues and pull requests never goes into the job's shell commands, as Keep untrusted text out of CI scripts says.

Examples

YAML example

on:
  issue_comment:
    types: [created]
permissions:
  contents: read
  pull-requests: write
jobs:
  agent:
    if: contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<full-commit-hash>
      - run: ./run-agent.sh   # opens a pull request, never pushes to main

How to check

From a test account without write access, open an issue that mentions the agent. The job does not start, and the log names the refusal.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/ci-agents-trusted-triggers">Agent Wranglers AI-assisted development playbook</a>. In code you write, add a comment next to it with the same link.