trust ben-s-go-updater[bot] in github-pr-reviewer TRUSTED_AUTHORS

[bborbe]

Problem

github-pr-watcher's TrustGate routes PRs from untrusted authors to human_review instead of auto-processing them (watcher/github-pr/README.md:28). TRUSTED_AUTHORS was bborbe only, so every PR opened by github-update-go-agent (author ben-s-go-updater[bot]) was marked trusted=false and got no automated review.

Observed on bborbe/git-sync#5: watcher logged

trigger executor: untrusted author pr=.../git-sync/pull/5 author=ben-s-go-updater[bot]
reason=author "ben-s-go-updater[bot]" not in trusted-authors allowlist
published CreateTaskCommand pr=bborbe/git-sync#5 sha=830732e ... trusted=false

The PR then sat at mergeStateStatus: BLOCKED with CI green and nobody reviewing it.

Change

charts/github-pr-reviewer/values.yaml — TRUSTED_AUTHORS: bborbe → bborbe,ben-s-go-updater[bot]. Chart 0.1.0 → 0.2.0.

Why this bot, and why now

Per the Auto-Merge Trust-Gated PRs goal, update-go is the designated lowest-risk first candidate: its PRs are mechanical (go.mod / go.sum + a ## Unreleased bullet, no code), the repo gate runs twice in-pod plus CI on the PR, and the author is our own App. Its stated hard prerequisite (Fix PR Reviewer Verdict-State Mismatch) completed 2026-07-23.

Scope is deliberately narrow — this is trust for review, not auto-merge. A human still clicks merge. Auto-merge is a separate goal with its own opt-in flags and open security blockers.

Other agent bots (dark-factory, build-fixer) stay untrusted: their PRs carry real code changes, so the risk argument here does not transfer.

Notes

• Login must be the <slug>[bot] form — the trust leaf does exact case-sensitive matching (pkg/trust/author_allowlist.go). The REST API's app/<slug> rendering would not match.
• helm lint passes; helm template renders TRUSTED_AUTHORS: "bborbe,ben-s-go-updater[bot]".
• Does not fix the separate defect where trusted=false tasks produce no task file at all — tracked separately.

Deploy

After release: bump chart version in quant/github-pr-reviewer/helmfile.yaml (both stages), then operator make apply.

[ben-s-pull-request-reviewer]

The diff is straightforward — version bump + TRUSTED_AUTHORS expansion with well-documented justification. No issues found.

---

PR Review Summary

The mechanical funnel ran over 66 YAML files with 0 findings. The selector guide was unavailable (toolchain gap), but this is moot: the changed files (charts/github-pr-reviewer/Chart.yaml, charts/github-pr-reviewer/values.yaml) match no judgment rule triggers — Step 4 would have short-circuited anyway for a Helm-only repo.

Manual review of the diff:

File	Change	Assessment
Chart.yaml	version: 0.1.0 → 0.2.0	Correct semver bump for feature addition
values.yaml	TRUSTED_AUTHORS expanded to include ben-s-go-updater[bot]	Legitimate; comment documents the trust rationale (mechanical PRs only, own App, no auto-merge)

No Must Fix, Should Fix, or Nice to Have issues.

{
"verdict": "approve",
"summary": "Clean PR: version bump to 0.2.0 and TRUSTED_AUTHORS allowlist expanded to include ben-s-go-updater[bot] with thorough inline justification. Mechanical funnel (66 yamls) returned zero findings. The bot's trust case is well-argued — mechanical PRs only, in-pod + CI gate, no auto-merge. No code correctness, security, or style issues.",
"comments": [],
"concerns_addressed": [
"security: Trust allowlist expanded to include ben-s-go-updater[bot] — addressed by explicit comment explaining the mechanical-only PR nature, dual in-pod gate plus CI, and no auto-merge path"
]
}