From e77aa991e83048088cfb23ae2fb15aca8c7224e9 Mon Sep 17 00:00:00 2001
From: Eric Skram <eric@skram.com>
Date: Mon, 26 Oct 2026 13:30:03 -0600
Subject: [PATCH] Skipped the linked-issue check for GitHub App bot PRs

---
 .github/scripts/linked-issue.js      | 8 +++++++-
 .github/scripts/linked-issue.test.js | 5 ++++-
 .github/workflows/linked-issue.yml   | 4 ++--
 README.md                            | 2 +-
 4 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/.github/scripts/linked-issue.js b/.github/scripts/linked-issue.js
index 6fb97fc..1615586 100644
--- a/.github/scripts/linked-issue.js
+++ b/.github/scripts/linked-issue.js
@@ -7,4 +7,10 @@ function hasLinearKey(title, body, branch) {
   return KEY.test([title, body, branch].join('\n'));
 }
 
-module.exports = { hasLinearKey };
+// GitHub App bots (Dependabot, schema generators) open PRs with no issue.
+// Only org admins can install apps, so a person cannot use this to skip.
+function isBot(user) {
+  return user.type === 'Bot';
+}
+
+module.exports = { hasLinearKey, isBot };
diff --git a/.github/scripts/linked-issue.test.js b/.github/scripts/linked-issue.test.js
index 827d949..4fbdb6a 100644
--- a/.github/scripts/linked-issue.test.js
+++ b/.github/scripts/linked-issue.test.js
@@ -1,5 +1,5 @@
 const assert = require('node:assert/strict');
-const { hasLinearKey } = require('./linked-issue.js');
+const { hasLinearKey, isBot } = require('./linked-issue.js');
 
 assert.ok(hasLinearKey('Fix login', '', 'user/abc-42'), 'lowercase branch key');
 assert.ok(hasLinearKey('Fix login', 'Fixes ABC-123', 'user/fix-login'), 'key in body');
@@ -8,4 +8,7 @@ assert.ok(!hasLinearKey('Fix login', null, 'user/fix-login'), 'empty body, no ke
 for (const s of ['UTF-8', 'ISO-8601', 'CVE-2024-1234', 'RFC-9110', 'TLS-1']) {
   assert.ok(!hasLinearKey(s, '', 'main'), `${s} is not a key`);
 }
+assert.ok(isBot({ login: 'dependabot[bot]', type: 'Bot' }), 'Dependabot is a bot');
+assert.ok(isBot({ login: 'nps-schema-doc-generator[bot]', type: 'Bot' }), 'app bot');
+assert.ok(!isBot({ login: 'someone', type: 'User' }), 'a person is not a bot');
 console.log('ok');
diff --git a/.github/workflows/linked-issue.yml b/.github/workflows/linked-issue.yml
index 4881bfe..f3445b6 100644
--- a/.github/workflows/linked-issue.yml
+++ b/.github/workflows/linked-issue.yml
@@ -28,8 +28,8 @@ jobs:
               ...context.repo,
               pull_number: context.payload.pull_request.number,
             });
-            if (pr.user.login === 'dependabot[bot]') return;
-            const { hasLinearKey } = require(`${process.env.GITHUB_WORKSPACE}/central/.github/scripts/linked-issue.js`);
+            const { hasLinearKey, isBot } = require(`${process.env.GITHUB_WORKSPACE}/central/.github/scripts/linked-issue.js`);
+            if (isBot(pr.user)) return;
             if (!hasLinearKey(pr.title, pr.body, pr.head.ref)) {
               core.setFailed('Add a Linear issue key, for example ABC-123, to the PR title, body, or branch name.');
             }
diff --git a/README.md b/README.md
index 9956809..b4489a3 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ Workflows that GitHub runs on pull requests in every North Pole Security reposit
 
 The `linked-issue` check fails when a pull request has no Linear issue key. A key is 2 to 5 letters, a dash, and a number, for example `ABC-123`. The check looks in the pull request title, the body, and the branch name. It ignores case.
 
-The check does not count common tokens such as `SHA-256`, `UTF-8`, and `CVE-2024-1234` as keys. Pull requests from Dependabot pass.
+The check does not count common tokens such as `SHA-256`, `UTF-8`, and `CVE-2024-1234` as keys. Pull requests from GitHub App bots, such as Dependabot, pass.
 
 If the check fails, add the key to the title or the body. Then push a commit or run the check again. GitHub does not run the check again when you only edit the title or the body.