[jaredcatkinson]

Updates two Tier Zero privilege zone rules to match the current GitHub model:

• Match the lowercase all_repo_admin role name so the synthetic all-repository administrator role is included.
• Require token_expired: false for all-repository PATs, excluding expired tokens while retaining the existing repository-control write permission filter.

Validation: parsed all 12 privilege zone rule JSON files and verified their required fields; checked both query properties against the collector models; git diff --check passed. Live Cypher execution was not performed.

Ticket: BED-10432

Summary by CodeRabbit

• Bug Fixes
  • Repository administrator roles using the lowercase all_repo_admin name are now recognized.
  • Expired personal access tokens are no longer included when matching tokens with repository write access.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

Two privilege-zone rule queries have updated matching conditions. The role query searches for all_repo_admin, and the personal access token query excludes expired tokens. The repository scope and write-permission checks remain unchanged.

Changes

Privilege-zone rules

Layer / File(s)	Summary
Update rule query filters extension/privilege_zone_rules/t0-all-repo-admin-role.json, extension/privilege_zone_rules/t0-pats-all-repos.json	The role query now searches for all_repo_admin instead of ALL_REPO_ADMIN. The personal access token query now matches only tokens where token_expired is false; its repository scope and permission criteria remain unchanged.

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Suggested reviewers: jonasbk

Merge Risk: Minimal · up to e5833

The updated rules target the intended role and token states and are ready to merge.

Security architecture risk: Low · up to e5833

The changes adjust Tier Zero classification without adding permission grants. The token-expiration filter matches the existing collector model. Risk remains low, but the synthetic role’s stored name and behavior against deployed graph data have not been confirmed.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The relevant scope is organization-wide privilege classification: the role represents administrator inheritance across repositories, and the PAT rule selects all-repository tokens with repository-control write permissions. No expansion of underlying GitHub authority is demonstrated.

Trust Boundaries and Controls

• inferred — The changed declarations consume collected identity and token properties for classification rather than directly enforcing GitHub access. The external consumer’s downstream use of Tier Zero membership remains unverified.

Resilience and Maintainability Implications

• inferred — The explicit false predicate excludes unknown or absent expiration values as well as expired tokens. Current model output supplies the required boolean, but coverage of older or externally ingested graph records is unverified; exclusion from this classifier must not be interpreted as proof that a token lacks authority.

Hardening Proposals

• proposed — Validate the queries against the ingestion contract using a materialized synthetic administrator role and PAT records with false, true, and missing expiration values. Confirm the intended classification of unknown values before relying on the new results operationally.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the issue and summarizes the main change: fixing GitHub Tier Zero privilege zone rules.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks each rule at night
The role name now reads just right
Expired tokens leave the queue
The write checks stay as they were
Then hops away beneath the moon}

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a64e8e49-514c-44bc-b6c1-aa404f6529c3

Commits

Reviewing files that changed from the base of the PR and between 5c25924 and e5833a4.

Files selected for processing: 2

• extension/privilege_zone_rules/t0-all-repo-admin-role.json
• extension/privilege_zone_rules/t0-pats-all-repos.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.