@sentry/junior-github 0.194.0 → 0.195.0

package/SETUP.md

@@ -156,7 +156,7 @@ Use `additionalUserScopes` only when a human-identity integration flow requires
 - The plugin classifies GitHub traffic from the forwarded HTTP request. Reads use `installation-read`, while `GET /user` uses `user-read`. Allowlisted App-owned mutations and Git smart-HTTP pushes use `installation-write`. User-attachment uploads to `uploads.github.com/user-attachments/assets` use `user-write`. Unknown REST writes and GraphQL mutations are denied.
 - `user-read` and explicitly human `user-write` operations require the actor, or an explicitly delegated user subject, to authorize the GitHub App through the private OAuth flow. Junior-owned issue, pull request, review, inline review comment, and branch operations do not fall back to user OAuth.
 - Headless resource-event turns use the `resource-event` system actor and may receive the same installation grants. This lets Junior respond to subscribed pull request events by committing and pushing fixes without inheriting a subscriber's OAuth credential.
-- Git commits use Junior as author and committer. Resolvable human run actors are credited once with `Co-Authored-By` trailers.
+- Git commits use Junior as author and committer. Resolvable human run actors are credited once with `Co-Authored-By` trailers. When the current actor has a linked GitHub identity, Junior prefers a GitHub noreply address so external automation can resolve a login for assignment.
 - Installation credential leases are cached on the host by grant name and reused across sandboxes until near expiry. User grants stay actor-scoped. Upstream 403 after injection clears the cached lease, issues a new token, and retries the hop once before recording permission denied.
 - Sandbox does not receive raw tokens via env; host applies Authorization header transforms for GitHub API and upload calls.
 
@@ -187,7 +187,7 @@ The plugin uses installation credentials for read-only GitHub traffic, workflow
 
 Committing and pushing code uses more than one GitHub surface:
 
-- Creating the local Git commit does not call GitHub. Junior sets the GitHub App bot as author and committer and credits resolvable human actors with `Co-Authored-By` trailers.
+- Creating the local Git commit does not call GitHub. Junior sets the GitHub App bot as author and committer and credits resolvable human actors with `Co-Authored-By` trailers, preferring a linked GitHub noreply email for the current actor when present.
 - Pushing a branch with Git smart HTTP (`git push`) uses the `installation-write` grant and requires the App installation to have `Contents: write`. Workflow-file changes also require the installation to have `Workflows: write`.
 - The smart-HTTP classifier does not distinguish Junior-managed branches or independently detect force updates or ref deletion. Use GitHub branch protection and limit the App installation to repositories where Junior may push.
 - REST Git database and ref writes are denied by the current write allowlist. Use Git smart HTTP (`git push`) for branch updates instead.

package/dist/git-config.d.ts

@@ -1,7 +1,7 @@
 /**
  * Git identity and commit-hook setup for GitHub sandboxes.
  */
-import type { Actor, SandboxPrepareHookContext } from "@sentry/junior-plugin-api";
+import type { Actor, SandboxPrepareHookContext, User } from "@sentry/junior-plugin-api";
 /**
  * Build `Co-Authored-By` trailers crediting human run actors.
  *
@@ -10,10 +10,15 @@ import type { Actor, SandboxPrepareHookContext } from "@sentry/junior-plugin-api
  * denying the commit. Dedupes by identity and resolved email so the same human
  * under two display profiles, or an actor matching the bot identity, only ever
  * produces one line.
+ *
+ * When the current actor has a linked GitHub identity, prefer that noreply
+ * address so external automation can resolve a login for assignment.
  */
 export declare function additionalActorCoauthorTrailers(args: {
     actors?: Actor[];
     botEmail: string;
+    /** Linked user for the current run actor, when already resolved. */
+    currentUser?: User;
 }): string[];
 /** Build the hook that replaces model-supplied commit attribution. */
 export declare function prepareCommitMsgHook(): string;

package/dist/index.js

@@ -3201,6 +3201,23 @@ function actorEmail(actor) {
   const email = cleanIdentityPart(actor?.email);
   return /^[^\s@<>]+@[^\s@<>]+\.[^\s@<>]+$/.test(email) ? email : void 0;
 }
+function githubNoreplyEmail(user) {
+  for (const identity of user?.identities ?? []) {
+    if (identity.provider !== "github") {
+      continue;
+    }
+    const login = cleanIdentityPart(identity.handle);
+    const userId = cleanIdentityPart(identity.providerSubjectId);
+    if (!login || login.toLowerCase().endsWith("[bot]")) {
+      continue;
+    }
+    if (/^[1-9]\d*$/.test(userId)) {
+      return `${userId}+${login}@users.noreply.github.com`;
+    }
+    return `${login}@users.noreply.github.com`;
+  }
+  return void 0;
+}
 function actorIdentityKey(actor) {
   if (actor.platform === "system") {
     return `system ${actor.name}`;
@@ -3211,6 +3228,8 @@ function additionalActorCoauthorTrailers(args) {
   if (!args.actors || args.actors.length === 0) {
     return [];
   }
+  const currentActorKey = args.actors[0] ? actorIdentityKey(args.actors[0]) : void 0;
+  const currentNoreply = githubNoreplyEmail(args.currentUser);
   const seenEmails = /* @__PURE__ */ new Set([args.botEmail.toLowerCase()]);
   const seenActors = /* @__PURE__ */ new Set();
   const trailers = [];
@@ -3220,7 +3239,7 @@ function additionalActorCoauthorTrailers(args) {
       continue;
     }
     const name = actorName(candidate);
-    const email = actorEmail(candidate);
+    const email = (currentActorKey === actorKey ? currentNoreply : void 0) || actorEmail(candidate);
     if (!name || !email) {
       continue;
     }
@@ -4350,7 +4369,7 @@ function githubPlugin(options = {}) {
         await configureGit(ctx, "credential.helper", "");
         await configureGit(ctx, "http.emptyAuth", "true");
       },
-      beforeToolExecute(ctx) {
+      async beforeToolExecute(ctx) {
         if (ctx.tool.name !== "bash") {
           return;
         }
@@ -4362,9 +4381,18 @@ function githubPlugin(options = {}) {
         ctx.env.set("JUNIOR_GIT_AUTHOR_EMAIL", botEmail);
         ctx.env.set("GIT_COMMITTER_NAME", botName);
         ctx.env.set("GIT_COMMITTER_EMAIL", botEmail);
+        let currentUser;
+        if (ctx.actor) {
+          try {
+            currentUser = (await ctx.users.resolveActor())?.user;
+          } catch {
+            currentUser = void 0;
+          }
+        }
         const actorTrailers = additionalActorCoauthorTrailers({
           actors: [...ctx.actor ? [ctx.actor] : [], ...ctx.actors ?? []],
-          botEmail
+          botEmail,
+          currentUser
         });
         ctx.env.set(
           "JUNIOR_GIT_ACTOR_COAUTHOR_TRAILERS",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-github",
-  "version": "0.194.0",
+  "version": "0.195.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -31,7 +31,7 @@
     "@sinclair/typebox": "^0.34.49",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.5.4",
-    "@sentry/junior-plugin-api": "0.194.0"
+    "@sentry/junior-plugin-api": "0.195.0"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.79.0",