v2.23.2

Fixed

• Bitbucket verdict owners: only an account ID or a UUID grants, and the owners file comes from the target branch (#1071). This is a behavior change. It closes two ways in which a commenter could pass as an owner in v2.23.1.
  • A nickname is not a unique identifier. An @nickname on a * line of .bitbucket/CODEOWNERS no longer authorizes a commenter. Only an account_id or a {uuid} grants. The review logs a warning that names each ignored @nickname. Replace each one with an account_id or a {uuid}. A person who is listed only by nickname gets the permission lookup, so they see the “not listed” reply until you change the file.
  • The owners file is now always read from origin/<BASE_REF>. It no longer follows AI_POLICY_SOURCE, and the file in the pull request checkout is never read. With workspace, a pull request could add its own author to the list in v2.23.1. A pipeline that set AI_POLICY_SOURCE=workspace and relied on an owners file in the pull request must merge that file into the target branch. policy.yml still follows AI_POLICY_SOURCE.
  • If BASE_REF is empty, the review logs a warning and uses no owners file. If origin/<BASE_REF> is missing, the review also uses no owners file. In both cases the permission lookup decides.