Homu users can close any PR or Issue of any other Homu enabled project

barosl / homu

A bot that integrates with GitHub and your favorite continuous integration service

http://homu.io/

MIT License

661 stars 102 forks source link

Homu users can close any PR or Issue of any other Homu enabled project #155

Open kbknapp opened 7 years ago

kbknapp commented 7 years ago

I had a PR in kbknapp/clap-rs#921 that said, "Fixes BurntSushi/ripgrep#426" in order to ping the ripgrep author. Once that PR merged, Homu closed BurntSushi/ripgrep#426 even though I have no rights to the ripgrep project.

IMO Humo should probably check if the issue it's closing is in the same repo (or maybe even just org/owner) as the merging PR.

sigmavirus24 commented 7 years ago

@kbknapp homu was designed for projects that span repositories. I'd expect this behaviour based on that understanding and the understanding that the repository owner for ripgrep set up Homu sometime back and didn't appropriately remove the authorizations.

kbknapp commented 7 years ago

@sigmavirus24 spanning multiple repositories inside a single org/user is fine and makes perfect sense. But crossing organization boundaries (or user boundaries if the repo isn't part of an org) seems wrong. The fact that the ripgrep author didn't remove the Homu authorizations is orthogonal to this issue.