Agent Wranglers

Safety and permissions Required

Run agents in CI only for trusted people

An agent in CI starts only for people with write access to the repository. Its job holds no secrets it does not need.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Anyone can write an issue or a fork pull request, and the agent reads it as instructions. Check the author's permission before the agent starts. Give the job a read-only token and let it propose changes only as a pull request for review. Never run it on pull_request_target with code from a fork. See keep build secrets from forks.

Example

on:
  issue_comment:
    types: [created]
permissions:
  contents: read
  pull-requests: write
jobs:
  agent:
    if: contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@<full-commit-hash>
      - run: ./run-agent.sh   # opens a pull request, never pushes to main

How to check

From a test account without write access, open an issue that mentions the agent. The job does not start, and the log names the refusal.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/ci-agents-trusted-triggers.