From 7175837986cc5cc3deb47433616def23cc5e8995 Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Sat, 1 Aug 2026 12:54:43 -0700 Subject: [PATCH] chore(contributor-check): bump AGT pin to 359a6b8 (2026-07-31) The pin was 410fb2cc (2026-06-09), so every agentrust-io repo has been running detection logic roughly two months stale. The change that matters is the fail-closed risk ordering. At the old pin RISK_ORDER was {LOW:1, MEDIUM:2, HIGH:3, UNKNOWN:0}, so UNKNOWN sorted BELOW LOW and never met the MEDIUM comment threshold. A check that errored or got rate-limited was therefore silently dropped and read as clean. It is now {LOW:1, MEDIUM:2, UNKNOWN:3, HIGH:4}: an undetermined result outranks LOW and MEDIUM and gets surfaced. Also picks up ~360 lines of contributor_check.py hardening: org-backed and prior-interaction credibility tiers, the maintainer allowlist that can only soften HIGH to MEDIUM and never grant LOW, and guards against star-bought repos and two-account merge rings. Verified no breaking change: contributor_check_action.py CLI arguments are unchanged, and .github/actions/contributor-check/ upstream is byte-identical between the two pins. brand_comment.py matches the footer by prefix, so branding still applies. --- .github/actions/contributor-check/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/contributor-check/action.yml b/.github/actions/contributor-check/action.yml index 8e95b51..5e4790f 100644 --- a/.github/actions/contributor-check/action.yml +++ b/.github/actions/contributor-check/action.yml @@ -48,7 +48,7 @@ runs: uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: repository: microsoft/agent-governance-toolkit - ref: 410fb2ccf2bd9ff74ea2d67450f018316efb0556 + ref: 359a6b8cf453f95d6bc9caf932057e1e78ccffd9 # main as of 2026-07-31 persist-credentials: false sparse-checkout: scripts path: _agt