[tnsardesai]

Summary

The PR risk check skipped every PR with "author is not an org member", including PRs from org members.

The check read author_association from the pulls API using the workflow's github.token. GitHub reports that field relative to the caller, and the workflow token can't see private org membership, so every private member shows up as CONTRIBUTOR. The org has no public members.

This reads the value from github.event.pull_request.author_association instead, which GitHub fills in when it creates the event. Breakglass uses the payload in the same way (comment.author_association) and has merged PRs for private members, e.g. kernel/kernel#4948.

Testing

• The fake API in the tests now always reports CONTRIBUTOR, like the workflow token sees. Tests pass the payload value separately, so they fail if the check ever goes back to the API field (22 errors against the old script).
• A test asserts the workflow passes github.event.pull_request.author_association into the Gather step.
• All 40 repo tests pass and actionlint is clean.

---

Note

Low Risk
Workflow plumbing and eligibility input source only; behavior improves for private org members without broadening auto-approval beyond the existing OWNER/MEMBER rule.

Overview
Fixes the PR risk workflow so private org members are no longer incorrectly marked ineligible with “author is not an org member.”

Eligibility used author_association from the pulls API via github.token, which reports CONTRIBUTOR when the token cannot see private membership. The Gather step now passes github.event.pull_request.author_association as AUTHOR_ASSOCIATION, and pr_risk.py uses that value for the OWNER/MEMBER gate instead of the API field on the PR object.

Tests model the API always returning CONTRIBUTOR while supplying the event payload association separately, and assert the workflow wires the env var correctly.

^{Reviewed by Cursor Bugbot for commit d4395e5. Bugbot is set up for automated code reviews on this repo. Configure here.}