From 3446b1aee9faada8fc6940049891dd2581146122 Mon Sep 17 00:00:00 2001
From: Jim Meyer <jimeyer@nvidia.com>
Date: Fri, 23 Oct 2026 16:36:46 -0700
Subject: [PATCH] feat(agents): allow gator to reach GHSA private forks

Widen the github-gator provider's repo-scoped rules from NVIDIA/OpenShell
to {NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*} so gator can read and
review pull requests in GitHub security advisory private forks. The search
rule already matches the forks and is unchanged.

Signed-off-by: Jim Meyer <jimeyer@nvidia.com>
---
 .../agents/gator/providers/github-gator.yaml  | 40 +++++++++----------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/scripts/agents/gator/providers/github-gator.yaml b/scripts/agents/gator/providers/github-gator.yaml
index 5d8e30238f..57d7f01fac 100644
--- a/scripts/agents/gator/providers/github-gator.yaml
+++ b/scripts/agents/gator/providers/github-gator.yaml
@@ -28,20 +28,20 @@ endpoints:
             q:
               any:
                 - "*repo:NVIDIA/OpenShell*"
-      - allow: { method: GET, path: /repos/NVIDIA/OpenShell }
-      - allow: { method: GET, path: /repos/NVIDIA/OpenShell/** }
-      - allow: { method: POST, path: /repos/NVIDIA/OpenShell/issues/*/comments }
-      - allow: { method: PATCH, path: /repos/NVIDIA/OpenShell/issues/comments/* }
-      - allow: { method: POST, path: /repos/NVIDIA/OpenShell/issues/*/labels }
-      - allow: { method: PUT, path: /repos/NVIDIA/OpenShell/issues/*/labels }
-      - allow: { method: DELETE, path: /repos/NVIDIA/OpenShell/issues/*/labels/* }
-      - allow: { method: PATCH, path: /repos/NVIDIA/OpenShell/issues/* }
-      - allow: { method: POST, path: /repos/NVIDIA/OpenShell/labels }
-      - allow: { method: PATCH, path: /repos/NVIDIA/OpenShell/labels/* }
-      - allow: { method: POST, path: /repos/NVIDIA/OpenShell/pulls/*/comments }
-      - allow: { method: POST, path: /repos/NVIDIA/OpenShell/pulls/*/reviews }
-      - allow: { method: POST, path: /repos/NVIDIA/OpenShell/pulls/*/reviews/*/comments }
-      - allow: { method: POST, path: /repos/NVIDIA/OpenShell/statuses/* }
+      - allow: { method: GET, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}" }
+      - allow: { method: GET, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/**" }
+      - allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/issues/*/comments" }
+      - allow: { method: PATCH, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/issues/comments/*" }
+      - allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/issues/*/labels" }
+      - allow: { method: PUT, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/issues/*/labels" }
+      - allow: { method: DELETE, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/issues/*/labels/*" }
+      - allow: { method: PATCH, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/issues/*" }
+      - allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/labels" }
+      - allow: { method: PATCH, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/labels/*" }
+      - allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/pulls/*/comments" }
+      - allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/pulls/*/reviews" }
+      - allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/pulls/*/reviews/*/comments" }
+      - allow: { method: POST, path: "/repos/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/statuses/*" }
   - host: api.github.com
     port: 443
     path: /graphql
@@ -59,17 +59,17 @@ endpoints:
     protocol: rest
     enforcement: enforce
     rules:
-      - allow: { method: GET, path: /NVIDIA/OpenShell }
-      - allow: { method: GET, path: /NVIDIA/OpenShell/** }
-      - allow: { method: GET, path: /NVIDIA/OpenShell.git/** }
-      - allow: { method: POST, path: /NVIDIA/OpenShell/**/git-upload-pack }
-      - allow: { method: POST, path: /NVIDIA/OpenShell.git/**/git-upload-pack }
+      - allow: { method: GET, path: "/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}" }
+      - allow: { method: GET, path: "/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/**" }
+      - allow: { method: GET, path: "/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}.git/**" }
+      - allow: { method: POST, path: "/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/**/git-upload-pack" }
+      - allow: { method: POST, path: "/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}.git/**/git-upload-pack" }
   - host: codeload.github.com
     port: 443
     protocol: rest
     enforcement: enforce
     rules:
-      - allow: { method: GET, path: /NVIDIA/OpenShell/** }
+      - allow: { method: GET, path: "/{NVIDIA,ai-openshell}/{OpenShell,OpenShell-ghsa-*}/**" }
   - host: results-receiver.actions.githubusercontent.com
     port: 443
     protocol: rest