[jatmn]

This repository has no Pullfrog workflow. This adds the same owner-command setup already working in yuoki-quinityn: only a new top-level issue or PR comment from jatmn beginning with @pullfrog and an instruction can run the agent. Other users, edits, reruns, passive mentions and automatic PR events cannot launch it.

The workflow reuses the existing account ChatGPT Codex subscription with openai/gpt-sol, preserves the verified owner role, and restricts shell access and pushes to feature branches. Pullfrog App access is confirmed; repository settings have automatic reviews/re-reviews, managed mentions, issue processing, review responses, CI autofix, labels, approving reviews and auto-merge disabled. No provider credentials are stored in GitHub or this PR.

Validation passed: six actual helper subprocess tests (issue/PR payloads, rejected identities/events/reruns, output injection, large-event fallback and malformed IDs), Python syntax, checksum-verified actionlint 1.7.12, exact comparison with the working reference after repository/prompt substitutions, and whitespace checks. The new checks workflow runs the authorization tests and actionlint without invoking a model. No gameplay, assets or release metadata changed. Related Pullfrog issue/PR searches found no duplicate work.

Activation remains pending: merge this PR to main, then use Verify manual installation in the Pullfrog console if it still reports Needs setup, and post a new owner command for the first live test. Do not use Add workflow directly. No target-specific live model run has been performed. See docs/pullfrog.md for usage and maintenance.

Summary by Sourcery

Add a verified owner-command Pullfrog integration with automated validation and setup documentation.

New Features:

• Add an owner-only Pullfrog workflow that runs explicit commands from new top-level issue and pull request comments.
• Use the existing ChatGPT subscription-backed Pullfrog integration with restricted shell access and feature-branch pushes.

Enhancements:

• Add fail-closed authorization and payload validation to prevent unauthorized triggers, reruns, edited comments, and output injection.
• Document Pullfrog setup, usage, repository settings, activation, and maintenance guidance.

CI:

• Add a validation workflow that runs authorization tests and pinned actionlint checks without invoking the agent.

Documentation:

• Document owner command syntax, activation steps, account configuration, and operational safeguards.

Tests:

• Add subprocess coverage for valid issue and pull request commands, rejected identities and events, malformed identifiers, large payloads, and output injection.

[sourcery-ai]

Hey - I've found 2 issues

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path=".github/workflows/pullfrog.yml" line_range="29" />
<code_context>
+      - name: Checkout trusted default branch
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          persist-credentials: false
+      - name: Verify owner command
</code_context>
<issue_to_address>
**Fork code runs before repository validation**

When a fork containing this workflow has Actions enabled and jatmn posts a matching command on one of its issues, a fork can copy this workflow and control the default branch checked out here, including `tools/pullfrog_command.py`. That code runs before the helper checks `repository.full_name`, so an owner comment on an issue in that fork executes untrusted code in a job granted `id-token: write`.

Require `github.repository == 'jatmn/Yuoki-Factorio-2.x'` in the job condition before checkout, and keep the checkout pinned to the trusted repository's default branch.

Also at `.github/workflows/pullfrog.yml:14-18`.
</issue_to_address>

### Comment 2
<location path="tools/pullfrog_command.py" line_range="19" />
<code_context>
+def main():
+    if (os.environ.get('GITHUB_EVENT_NAME') != 'issue_comment'
+            or os.environ.get('GITHUB_ACTOR') != OWNER
+            or os.environ.get('GITHUB_TRIGGERING_ACTOR') != OWNER
+            or os.environ.get('GITHUB_RUN_ATTEMPT') != '1'):
+        return
</code_context>
<issue_to_address>
**Every owner command is rejected**

When the workflow runs on GitHub Actions, `GITHUB_TRIGGERING_ACTOR` is not a default environment variable supplied by GitHub Actions, and the step does not map `github.triggering_actor` into the environment. The check therefore returns before writing `authorized=true`, so the Pullfrog step never runs for any command.

Pass `github.triggering_actor` to the helper through the authorization step's `env`, or remove the redundant helper check because the job condition already enforces it.
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 2 findings to address first, and this introduces a new owner authorization and trust boundary that can give a third-party agent repository access, an OIDC token, restricted shell access, and the ability to push or manage contributor issues and PRs. If the authorization or action behavior is wrong, the agent could expose credentials or make broad irreversible changes; reverting the workflow would not undo actions already taken.

Blocking findings: .github/workflows/pullfrog.yml:29, tools/pullfrog_command.py:19

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[jatmn]

@pullfrog read README.md and summarize this repository in one sentence. Do not modify files or create a PR.

[pullfrog]

This repository contains Yuoki Industries for Factorio 2.0, a mod created by YuokiTani and currently maintained by jatmn.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using gpt-6.1-sol ｜ 𝕏}