Jordan MecomandGitHub 885bed35ee fix(workflow): bind trigger author to the signed event (#4607) ...

This change derives `trigger_author` exclusively from the signed event
pubkey. Actor tags remain available as event data but cannot override
the identity used by author-sensitive workflow conditions.

This removes the impersonation path without changing workflow
definitions or requiring stored-data migration.

## Testing

- `bin/cargo test -p buzz-workflow` at `78819df`: 154 passed, 2
Postgres-dependent tests ignored
- `git diff --check
origin/main...codex/security-workflow-trigger-author`

Originating Buzz thread:
`buzz://message?channel=3928fe05-df61-4b5d-b9c7-d623b9b10ea1&id=3c6c02312f763fbe0d2bfc33a6c1a362f91d0354f3d18b039cf7a0558c1439d1`

Signed-off-by: Jordan Mecom <jm@squareup.com>

2026-08-05 10:35:40 -07:00

..

src

fix(workflow): bind trigger author to the signed event (#4607)

2026-08-05 10:35:40 -07:00

Cargo.toml

feat(desktop): canonical <PubKey> component — hover to view/copy full keys, owner "you" labels (#1589)

2026-07-07 13:35:15 -07:00