github2gerrit 1.4.4__tar.gz → 2.1.0__tar.gz

{github2gerrit-1.4.4 → github2gerrit-2.1.0}/.pre-commit-config.yaml

@@ -3,6 +3,7 @@
 # SPDX-FileCopyrightText: 2025 The Linux Foundation
 
 ci:
+  autofix_prs: false
   # pre-commit.ci sandbox prevents network calls; aislop runs engines
   # that can call the network at scan time, so it cannot run there
   # either. gha-workflow-linter validates action calls over the
@@ -63,7 +64,7 @@ repos:
         types: [yaml]
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: 2700fd5671c633760d912769c041bfcde2b9a01b  # frozen: v0.15.22
+    rev: aab412d509121cb5f7533134b7e67f9fab59c682  # frozen: v0.16.4
     hooks:
       - id: ruff
         files: ^(src|scripts|tests)/.+\.py$
@@ -72,7 +73,7 @@ repos:
         files: ^(src|scripts|tests)/.+\.py$
 
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 41e691678310dfd3833f7ab4e180ddb014310356  # frozen: v2.3.0
+    rev: 7ff8d35ae36a7d2b968f2f90b4c723e292e594ee  # frozen: v2.3.1
     hooks:
       - id: mypy
         files: ^src/.+\.py$
@@ -88,7 +89,7 @@ repos:
         args: ["--no-adverb"]
 
   - repo: https://github.com/shellcheck-py/shellcheck-py
-    rev: 745eface02aef23e168a8afb6b5737818efbea95  # frozen: v0.11.0.1
+    rev: a6564f5d57444e123433a5c9af733e3975c77229  # frozen: v0.11.0.1-1
     hooks:
       - id: shellcheck
 
@@ -119,13 +120,13 @@ repos:
 
   # Requires a mirror, primary repo lacks .pre-commit-hooks.yaml
   - repo: https://github.com/DetachHead/basedpyright-prek-mirror
-    rev: d55eabd2531b4f4a4c49c30fba627ce3a636ab79  # frozen: 1.39.9
+    rev: 3c94d276aa3005fa1f5a977946c9dc106135c083  # frozen: 1.39.10
     hooks:
       - id: basedpyright
         files: ^src/.+\.py$
 
   - repo: https://github.com/lfreleng-actions/gha-workflow-linter
-    rev: cec679e88cd818179079f52925ba80b9e6cb705c  # frozen: v1.2.3
+    rev: 42aa4db931ab4c9da0930ae5ca2259ab08da79cb  # frozen: v1.5.2
     hooks:
       - id: gha-workflow-linter
 
@@ -141,12 +142,12 @@ repos:
         name: aislop
         entry: aislop ci --human
         language: node
-        additional_dependencies: ["aislop@0.13.1"]
+        additional_dependencies: ["aislop@0.14.1"]
         pass_filenames: false
         always_run: true
 
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 1a4bb160cab6417b3045e1b37b6b72449243e658  # frozen: 0.37.4
+    rev: c4654a7e007c9619a5eb63c39a456572a0fa1851  # frozen: 0.38.0
     hooks:
       - id: check-github-actions
       - id: check-github-workflows

{github2gerrit-1.4.4 → github2gerrit-2.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: github2gerrit
-Version: 1.4.4
+Version: 2.1.0
 Summary: Submit a GitHub pull request to a Gerrit repository.
 Project-URL: Homepage, https://github.com/lfreleng-actions/github2gerrit-action
 Project-URL: Repository, https://github.com/lfreleng-actions/github2gerrit-action
@@ -139,6 +139,9 @@ name: github2gerrit
 on:
   pull_request_target:
     types: [opened, reopened, edited, synchronize, closed]
+  # Re-runs when a maintainer approves a fork pull request
+  pull_request_review:
+    types: [submitted, dismissed]
   push:
     branches: [main, master]
   workflow_dispatch:
@@ -186,6 +189,9 @@ name: github2gerrit
 on:
   pull_request_target:
     types: [opened, reopened, edited, synchronize, closed]
+  # Re-runs when a maintainer approves a fork pull request
+  pull_request_review:
+    types: [submitted, dismissed]
   workflow_dispatch:
 
 permissions:
@@ -235,7 +241,7 @@ uvx github2gerrit https://github.com/onap/portal-ng-bff/pull/33
 | `GERRIT_HTTP_PASSWORD`      | No       | `""`             | Gerrit HTTP password/token for REST queries                    |
 | `ORGANIZATION`              | No       | repository owner | GitHub organization/owner used for credential derivation       |
 | `PR_NUMBER`                 | No       | `"0"`            | PR number to process; `0` processes all open PRs (dispatch)    |
-| `FETCH_DEPTH`               | No       | `"10"`           | Fetch depth for checkout                                       |
+| `FETCH_DEPTH`               | No       | `"10"`           | Git history depth: PR fetch, push checkout, reconciliation     |
 | `SUBMIT_SINGLE_COMMITS`     | No       | `"false"`        | Submit one commit at a time to Gerrit                          |
 | `USE_PR_AS_COMMIT`          | No       | `"false"`        | Use PR title and body as the commit message                    |
 | `PRESERVE_GITHUB_PRS`       | No       | `"true"`         | Do not close GitHub PRs after pushing to Gerrit                |
@@ -312,7 +318,7 @@ Input defaults match the composite action defaults.
 | `G2G_USE_SSH_AGENT`         | boolean | `true`           | Use SSH agent instead of file-based keys         |
 | `ORGANIZATION`              | string  | repository owner | GitHub organization/owner                        |
 | `PR_NUMBER`                 | string  | `"0"`            | PR to process on dispatch; `0` processes all     |
-| `FETCH_DEPTH`               | string  | `"10"`           | Fetch depth for checkout                         |
+| `FETCH_DEPTH`               | string  | `"10"`           | Git depth: PR, push, reconciliation              |
 | `SUBMIT_SINGLE_COMMITS`     | boolean | `false`          | Submit one commit at a time                      |
 | `USE_PR_AS_COMMIT`          | boolean | `false`          | Use PR title and body as the commit message      |
 | `PRESERVE_GITHUB_PRS`       | boolean | `true`           | Do not close GitHub PRs after pushing            |

{github2gerrit-1.4.4 → github2gerrit-2.1.0}/README.md

@@ -93,6 +93,9 @@ name: github2gerrit
 on:
   pull_request_target:
     types: [opened, reopened, edited, synchronize, closed]
+  # Re-runs when a maintainer approves a fork pull request
+  pull_request_review:
+    types: [submitted, dismissed]
   push:
     branches: [main, master]
   workflow_dispatch:
@@ -140,6 +143,9 @@ name: github2gerrit
 on:
   pull_request_target:
     types: [opened, reopened, edited, synchronize, closed]
+  # Re-runs when a maintainer approves a fork pull request
+  pull_request_review:
+    types: [submitted, dismissed]
   workflow_dispatch:
 
 permissions:
@@ -189,7 +195,7 @@ uvx github2gerrit https://github.com/onap/portal-ng-bff/pull/33
 | `GERRIT_HTTP_PASSWORD`      | No       | `""`             | Gerrit HTTP password/token for REST queries                    |
 | `ORGANIZATION`              | No       | repository owner | GitHub organization/owner used for credential derivation       |
 | `PR_NUMBER`                 | No       | `"0"`            | PR number to process; `0` processes all open PRs (dispatch)    |
-| `FETCH_DEPTH`               | No       | `"10"`           | Fetch depth for checkout                                       |
+| `FETCH_DEPTH`               | No       | `"10"`           | Git history depth: PR fetch, push checkout, reconciliation     |
 | `SUBMIT_SINGLE_COMMITS`     | No       | `"false"`        | Submit one commit at a time to Gerrit                          |
 | `USE_PR_AS_COMMIT`          | No       | `"false"`        | Use PR title and body as the commit message                    |
 | `PRESERVE_GITHUB_PRS`       | No       | `"true"`         | Do not close GitHub PRs after pushing to Gerrit                |
@@ -266,7 +272,7 @@ Input defaults match the composite action defaults.
 | `G2G_USE_SSH_AGENT`         | boolean | `true`           | Use SSH agent instead of file-based keys         |
 | `ORGANIZATION`              | string  | repository owner | GitHub organization/owner                        |
 | `PR_NUMBER`                 | string  | `"0"`            | PR to process on dispatch; `0` processes all     |
-| `FETCH_DEPTH`               | string  | `"10"`           | Fetch depth for checkout                         |
+| `FETCH_DEPTH`               | string  | `"10"`           | Git depth: PR, push, reconciliation              |
 | `SUBMIT_SINGLE_COMMITS`     | boolean | `false`          | Submit one commit at a time                      |
 | `USE_PR_AS_COMMIT`          | boolean | `false`          | Use PR title and body as the commit message      |
 | `PRESERVE_GITHUB_PRS`       | boolean | `true`           | Do not close GitHub PRs after pushing            |

{github2gerrit-1.4.4 → github2gerrit-2.1.0}/action.yaml

@@ -19,18 +19,13 @@ inputs:
     required: false
     default: "false"
   FETCH_DEPTH:
-    description: "Fetch depth for checkout"
-    required: false
-    default: "10"
-  SKIP_CHECKOUT:
     description: >-
-      Skip the internal repository checkout. Set when the caller has
-      already checked out the target repository at the desired ref
-      (e.g. the bundled reusable workflow, which also checks out this
-      action into the workspace and must not have it deleted by a
-      nested checkout)
+      Depth of git history fetched. Applied to the tool's own fetch of
+      refs/pull/<N>/head, to the push-event checkout, and as the git log
+      window used to find merged commits during PR reconciliation, so
+      raising it widens how far back a merged change is matched
     required: false
-    default: "false"
+    default: "10"
   PR_NUMBER:
     description: "Pull request number to process, use 0 to process all open"
     required: false
@@ -213,19 +208,32 @@ runs:
           echo "disabled=false" >> "$GITHUB_OUTPUT"
         fi
 
-    - name: "Checkout repository"
-      # yamllint disable-line rule:line-length
-      if: steps.disabled-check.outputs.disabled != 'true' && inputs.SKIP_CHECKOUT != 'true'
+    - name: "Checkout repository (push events)"
+      # Push runs reconcile merged Gerrit changes back to their GitHub
+      # PRs, which reads commit trailers with a local `git show` in the
+      # working directory. Pull request runs need no checkout: the tool
+      # fetches refs/pull/<N>/head into its own temporary directory, and
+      # checking a fork head out here would both fail under
+      # pull_request_target and expose a fork-controlled .gitreview.
+      if: >-
+        steps.disabled-check.outputs.disabled != 'true'
+        && github.event_name == 'push'
       # yamllint disable-line rule:line-length
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: ${{ inputs.FETCH_DEPTH }}
-        # Ensure we are on the PR's head SHA when triggered by PR events
-        ref: ${{ github.event.pull_request.head.sha || github.sha }}
-        # The action authenticates to Gerrit over SSH and to GitHub via an
-        # explicit GITHUB_TOKEN env var, so the checkout token does not need
-        # to be persisted into the local git config.
+        # The action authenticates to Gerrit over SSH and to GitHub via
+        # an explicit GITHUB_TOKEN env var, so the checkout token does
+        # not need to be persisted into the local git config.
         persist-credentials: false
+        # Callers may place files in the workspace that this action
+        # depends on. The bundled reusable workflow checks the action
+        # itself out to .g2g-action and then runs it from there, so a
+        # cleaning checkout would delete the action mid-run. That
+        # workflow also seeds the workspace root with the target
+        # repository first, because actions/checkout wipes a directory
+        # that is not already a git repository whatever `clean` says.
+        clean: false
 
     - name: "Setup Python"
       if: steps.disabled-check.outputs.disabled != 'true'
@@ -237,7 +245,7 @@ runs:
     - name: "Setup uv"
       if: steps.disabled-check.outputs.disabled != 'true'
       # yamllint disable-line rule:line-length
-      uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990  # v8.3.2
+      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d  # v10.0.1
       with:
         enable-cache: false
 
@@ -396,6 +404,11 @@ runs:
         GITHUB_SHA: ${{ github.sha }}
         GITHUB_BASE_REF: ${{ github.base_ref }}
         GITHUB_HEAD_REF: ${{ github.head_ref }}
+        # Full owner/repo of the PR head. Differs from GITHUB_REPOSITORY
+        # for fork pull requests, whose tree must not influence Gerrit
+        # target resolution.
+        # yamllint disable-line rule:line-length
+        PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
         GITHUB_ACTOR: ${{ github.actor }}
         SYNC_ALL_OPEN_PRS: ${{ steps.extract.outputs.sync_all }}
         PR_NUMBER: ${{ steps.extract.outputs.pr_number }}

{github2gerrit-1.4.4 → github2gerrit-2.1.0}/docs/cli.md

@@ -84,7 +84,7 @@ set by GitHub Actions) and undergo proper boolean parsing.
 | `--preserve-github-prs/--no-preserve-github-prs` | `PRESERVE_GITHUB_PRS`   | `true`  | Do not close GitHub PRs after pushing to Gerrit                                |
 | `--close-merged-prs/--no-close-merged-prs`       | `CLOSE_MERGED_PRS`      | `true`  | Close GitHub PRs when corresponding Gerrit changes merge                       |
 | `--force`                                        | `FORCE`                 | `false` | Force PR closure regardless of Gerrit change status (abandoned, etc.)          |
-| `--fetch-depth INTEGER`                          | `FETCH_DEPTH`           | `10`    | Fetch depth for checkout                                                       |
+| `--fetch-depth INTEGER`                          | `FETCH_DEPTH`           | `10`    | Git history depth: PR fetch, push checkout, reconciliation window              |
 | `--reviewers-email TEXT`                         | `REVIEWERS_EMAIL`       | `""`    | Email address(es) of reviewers (comma-separated)                               |
 | `--organization TEXT`                            | `ORGANIZATION`          | unset   | Organization (defaults to `GITHUB_REPOSITORY_OWNER` when unset)                |
 | `--github-actor TEXT`                            | `GITHUB_ACTOR`          | `""`    | GitHub actor (username) who triggered the workflow                             |
@@ -165,6 +165,7 @@ Some settings have no CLI flag and use environment variables:
 | `G2G_LOG_LEVEL`               | `WARNING`                                   | Logging level; set `DEBUG` for verbose output                                    |
 | `G2G_TOPIC_PREFIX`            | `GH`                                        | Prefix used when generating Gerrit topics                                        |
 | `G2G_SKIP_GERRIT_COMMENTS`    | `false`                                     | Skip posting back-reference comments on Gerrit changes                           |
+| `G2G_TRUSTED_ASSOCIATIONS`    | `OWNER,MEMBER,COLLABORATOR`                 | Author associations trusted to issue `@github2gerrit` comment directives         |
 | `G2G_ENABLE_DERIVATION`       | `true`                                      | Enable automatic derivation of Gerrit parameters from organization defaults      |
 | `G2G_AUTO_SAVE_CONFIG`        | context-dependent                           | Save derived parameters back to the configuration file                           |
 | `G2G_RESPECT_USER_SSH`        | `false` (`true` in direct URL mode)         | Use the local user's SSH configuration and keys instead of provided key material |

{github2gerrit-1.4.4 → github2gerrit-2.1.0}/docs/features.md

@@ -16,6 +16,7 @@ action in detail. For a quick start and the full inputs table, see the
 - [Closing Merged PRs](#closing-merged-prs)
 - [Automatic Cleanup](#automatic-cleanup)
 - [Restricting PRs to Automation Tools](#restricting-prs-to-automation-tools)
+- [Fork Pull Requests](#fork-pull-requests)
 - [Duplicate Detection](#duplicate-detection)
 - [Commit Message Normalization](#commit-message-normalization)
 - [Change-ID Reconciliation](#change-id-reconciliation)
@@ -101,6 +102,57 @@ acts on it during the next workflow run.
 - When the same command appears in more than one comment, only the latest
   occurrence takes effect.
 - The tool logs unrecognized directives at debug level and ignores them.
+- Only comments from trusted authors count. See below.
+
+### Who May Issue Commands
+
+These repositories are public, so the tool checks who wrote a comment before
+acting on it. Without that check, any GitHub user able to leave a comment
+could direct the tool.
+
+A comment counts only when GitHub reports its author's `author_association`
+as one of:
+
+| Association    | Meaning                                    |
+| -------------- | ------------------------------------------ |
+| `OWNER`        | Owns the repository                        |
+| `MEMBER`       | Member of the owning organization          |
+| `COLLABORATOR` | Invited collaborator on the repository     |
+
+`CONTRIBUTOR` is **not** trusted. It means only that the author has had a
+pull request merged at some point, which any outside contributor can achieve
+and which carries no authority.
+
+The tool ignores directives from anyone else and logs a warning naming the
+author and their association, so a refused command is visible rather than
+silently dropped.
+
+#### For contributors adding commands
+
+Adding a `CommandDefinition` to the registry gives the new command the same
+authorisation as the existing one, so long as consumers reach it through
+`github2gerrit.pr_directives`, which fetches comments, discards untrusted
+authors and parses in a single step.
+
+The parsing module performs no authorisation of its own. Calling
+`parse_commands`, `find_command` or `has_command` with comments taken straight
+from the GitHub API skips the check and recreates the original defect.
+
+Override the trusted set with `G2G_TRUSTED_ASSOCIATIONS`, a comma-separated
+list. Setting it to `OWNER` alone is the strictest useful value:
+
+```yaml
+env:
+  G2G_TRUSTED_ASSOCIATIONS: "OWNER,MEMBER"
+```
+
+An empty or blank value keeps the default rather than trusting nobody or
+everyone.
+
+Note that `MEMBER` means organization member, which is not the same as write
+access to a given repository. On a Gerrit mirror that remains the only
+available signal, because the GitHub collaborator list holds infrastructure
+accounts rather than the project's reviewers.
 
 ### Available Commands
 
@@ -284,6 +336,152 @@ Set `AUTOMATION_ONLY: "false"` to accept PRs from all users:
     GERRIT_SSH_PRIVKEY_G2G: ${{ secrets.GERRIT_SSH_PRIVKEY_G2G }}
 ```
 
+## Fork Pull Requests
+
+A pull request raised from a fork carries a tree that someone without write
+access to the base repository wrote. The tool treats that tree as untrusted
+input.
+
+### No runner checkout for pull requests
+
+The action does not check the target repository out into the runner workspace
+for pull request events. It fetches `refs/pull/<N>/head` into a private
+temporary directory instead. That ref lives on the base repository and resolves
+fork pull request heads, so the tool never contacts the fork directly.
+
+This sidesteps the `pull_request_target` checkout restriction that
+`actions/checkout` enforces, and keeps fork content out of the working
+directory, where the tool might otherwise read it as configuration.
+
+Push events still check the repository out. Those runs reconcile merged Gerrit
+changes back to their GitHub pull requests, which reads commit trailers from
+the working directory. A push carries no fork content, so the checkout is safe
+there.
+
+### Gerrit target resolution
+
+For fork pull requests the tool ignores any `.gitreview` in the pull request
+tree and resolves against the **base repository** instead. A fork could
+otherwise redirect the push to a different Gerrit project simply by editing
+`.gitreview`.
+
+The tool applies the same treatment when it cannot establish where the pull
+request head lives. Specific-PR `workflow_dispatch` runs and direct URL
+invocations carry no pull request payload, and GitHub reports a null head
+repository for a deleted fork. The tool resolves provenance through the API
+where it can, and treats whatever remains unresolved as untrusted, so a missing
+signal never earns a fork unwarranted trust.
+
+Resolution order for a fork pull request:
+
+1. `.gitreview` from the base repository at the pull request's base branch,
+   via the GitHub API or `raw.githubusercontent.com`
+2. Explicit `GERRIT_SERVER` / `GERRIT_SERVER_PORT` / `GERRIT_PROJECT` inputs
+3. Per-organization configuration file
+4. Derivation from the organization name (`gerrit.[org].org`)
+
+The lookup stops at the base branch. It does not fall back to the repository
+default branch, and it does not read `.gitreview` through the API without an
+authoritative base ref, because either would answer for a branch the pull
+request does not target — and `.gitreview` outranks the explicit inputs.
+
+The base repository's copy carries the same authority and lies outside an
+attacker's reach, so this costs no accuracy. Skipping straight to derivation
+would instead guess the Gerrit project name, and that guess goes wrong for
+repositories whose name contains a hyphen that does not mark a path separator.
+
+For the same reason, the tool drops branch names that originate in the fork
+(`GITHUB_HEAD_REF` and the pull request head ref) from base-repository
+lookups. Duplicate detection, which resolves `.gitreview` independently and
+earlier, applies the same rule.
+
+Same-repository pull requests keep their previous behaviour and still read
+`.gitreview` from the pull request tree.
+
+### Approval gating
+
+A fork pull request does not transfer to Gerrit until a maintainer approves it.
+The check runs before the tool fetches anything from the pull request and before
+it unlocks the Gerrit SSH key, so a pull request awaiting review reaches
+neither.
+
+Same-repository pull requests skip the check entirely. Pushing a branch to the
+base repository already requires write access, and automation such as
+Dependabot, pre-commit.ci and Copilot works that way, so the gate never affects
+them.
+
+#### What counts as approval
+
+An approving review, where every one of the following holds:
+
+- the reviewer's `author_association` falls in the trusted set, the same one
+  used for [comment commands](#who-may-issue-commands);
+- the review targets the pull request's **current head commit**;
+- no trusted reviewer has since requested changes; and
+- the reviewer is not the pull request author.
+
+A pull request whose provenance the tool cannot establish takes the same path as
+a fork. Approval is a question about authority, and an absent signal is not an
+answer.
+
+The gate applies to unattended runs. Running the CLI directly against a pull
+request URL does not require an approval: the operator chose that pull request
+and is using their own credentials, so they are already the authority the gate
+looks for. It exists for the automated path, where the tool acts on a shared
+identity with nobody watching.
+
+Binding to the head commit matters. GitHub keeps approvals across pushes unless
+branch protection dismisses them, so an approval that was not checked against a
+commit would let a contributor gain approval for one revision and then push a
+different one. The cost is that maintainers re-approve after each push, which is
+the correct trade.
+
+The author exclusion is belt and braces. GitHub already rejects approving your
+own pull request, and that guarantee is a large part of why the tool uses
+reviews rather than comment directives — on a Gerrit mirror the pull request
+author often holds the same organization membership as the reviewers.
+
+#### Enabling re-runs on approval
+
+`pull_request_target` carries no event for a submitted review, so approving a
+pull request does nothing unless the calling workflow listens for it:
+
+```yaml
+on:
+  pull_request_target:
+    types: [opened, reopened, edited, synchronize, closed]
+  pull_request_review:
+    types: [submitted, dismissed]
+```
+
+Without that trigger the tool only reconsiders a pull request on its next
+push, or when a maintainer dispatches the workflow by hand.
+
+#### When the gate blocks
+
+The run finishes successfully rather than failing. A pull request waiting for a
+human is not broken, and a red check would suggest otherwise.
+
+The tool posts one comment explaining what is missing, and edits that same
+comment on later runs rather than adding another. Where an approval exists but
+covers an earlier commit, the comment says so, so a maintainer who did approve
+is not told that nobody has.
+
+Once approval arrives, the tool edits that comment again to record it, so a
+transferred pull request does not keep displaying a stale block.
+
+#### If the head moves mid-run
+
+The gate reads the head commit from the API, while the workspace fetch reads
+`refs/pull/<N>/head`, which the contributor can move meanwhile. The tool
+compares the commit it fetched against the commit the maintainer approved and
+refuses a mismatch, so a push timed against a running workflow cannot slip an
+unreviewed commit into Gerrit.
+
+That refusal fails the run, unlike the ordinary blocked case, because it falls
+outside the normal course of events. The push that caused it triggers a fresh
+run, which asks for approval of the new commit in the usual way.
+
 ## Duplicate Detection
 
 Duplicate detection uses a scoring-based approach. The detector compares the

{github2gerrit-1.4.4 → github2gerrit-2.1.0}/pyproject.toml

@@ -139,6 +139,11 @@ ignore = [
 "sitecustomize.py" = ["S110", "SIM103", "SIM105", "PLW2901"]
 "src/github2gerrit/duplicate_detection.py" = ["S310"]
 "src/github2gerrit/gerrit_rest.py" = ["S310", "TRY301"]
+# S310 audits urlopen for non-HTTP schemes such as file:. This module
+# builds the URL from a literal https://raw.githubusercontent.com/ prefix
+# and passes it through _validate_raw_url, which requires scheme https and
+# host raw.githubusercontent.com before the fetch runs.
+"src/github2gerrit/gitreview.py" = ["S310"]
 
 [tool.ruff.lint.isort]
 known-first-party = ["github2gerrit"]