What changed, and why it matters
This commit adds a GitHub Actions workflow that automatically assigns a newly opened pull request to the person who created it. It is a repository-management convenience bot with no connection to product security, cryptography, wallet operations, or firmware behavior.
No security action required. Review as a normal CI/process change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The new workflow .github/workflows/bot-auto-assign.yml triggers on pull_request: opened, requests only pull-requests: write permission, and uses actions/github-script@v8 to call github.rest.issues.addAssignees with the PR author’s login. It logs a skip message if the user is not assignable and fails the job on API errors. The workflow is restricted to the trezor/trezor-firmware repository via an if guard.
Changed components
.github/workflows/bot-auto-assign.ymlInspect captured patch +37 / −0
diff --git a/.github/workflows/bot-auto-assign.yml b/.github/workflows/bot-auto-assign.yml
new file mode 100644
index 00000000..adecafef
--- /dev/null
+++ b/.github/workflows/bot-auto-assign.yml
@@ -0,0 +1,37 @@
+name: "[Bot] auto-assign PR author"
+
+on:
+ pull_request:
+ types: [opened]
+
+permissions:
+ pull-requests: write
+
+jobs:
+ auto-assign:
+ # run only in 'trezor/trezor-firmware' repository
+ if: github.repository == 'trezor/trezor-firmware'
+ runs-on: ubuntu-latest
+ steps:
+ - name: Assign PR author to PR
+ uses: actions/github-script@v8
+ with:
+ script: |
+ const author = context.payload.pull_request.user.login;
+
+ try {
+ const response = await github.rest.issues.addAssignees({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ issue_number: context.issue.number,
+ assignees: [author]
+ });
+ const isAssigned = (response.data.assignees || []).some(
+ a => a.login === author
+ );
+ if (!isAssigned) {
+ core.info(`Could not assign ${author} (not assignable in this repo). Skipping.`);
+ }
+ } catch (e) {
+ core.setFailed(`Failed to assign ${author}: ${e.status ?? "unknown"} ${e.message}`);
+ }
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.