Guard issue auto-answer workflow against untrusted triggering via author_association (#5841)

* Initial plan

* Guard workflow against untrusted triggering using author_association

Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com>

* Add COLLABORATOR and CONTRIBUTOR to author_association guard

Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: trwalke <30090357+trwalke@users.noreply.github.com>

Author: 2 people

.github/workflows/main.yml

@@ -11,8 +11,15 @@ permissions:
 jobs:
   answer-issue:
     runs-on: ubuntu-latest
-    # Optional: only run for issues with a specific label
-    # if: contains(github.event.issue.labels.*.name, 'question')
+    # Only run for issues created by org members or owners (i.e., Microsoft Open Source enterprise members).
+    # github.event.issue.author_association is set by GitHub based on the issue author's relationship
+    # to this repository. MEMBER = org member, OWNER = repo/org owner. This prevents untrusted
+    # external contributors from triggering the OpenAI-backed responder and consuming secrets/tokens.
+    if: |
+      github.event.issue.author_association == 'MEMBER' ||
+      github.event.issue.author_association == 'OWNER' ||
+      github.event.issue.author_association == 'COLLABORATOR' ||
+      github.event.issue.author_association == 'CONTRIBUTOR'
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4