From d9f5c2179c6219c92878243606aafc9bb991c304 Mon Sep 17 00:00:00 2001
From: Liangsheng Yin <hnyls2002@gmail.com>
Date: Sun, 22 Mar 2026 00:45:48 -0700
Subject: [PATCH] ci(slash-cmd): allow write-permission users to /rerun-ut on
 fork PRs (#21121)

---
 scripts/ci/utils/slash_command_handler.py | 39 +++++++++--------------
 1 file changed, 15 insertions(+), 24 deletions(-)

diff --git a/scripts/ci/utils/slash_command_handler.py b/scripts/ci/utils/slash_command_handler.py
index 971c19bc4..ae44f0905 100644
--- a/scripts/ci/utils/slash_command_handler.py
+++ b/scripts/ci/utils/slash_command_handler.py
@@ -515,19 +515,23 @@ def handle_rerun_ut(gh_repo, pr, comment, user_perms, test_spec, token):
     Handles the /rerun-ut <file>::<TestClass.test_method> command.
     Dispatches a lightweight workflow to run a single test on the correct CUDA runner.
     """
-    # SECURITY: Block /rerun-ut entirely for fork PRs. This command checks out and
-    # executes code from the PR branch on self-hosted GPU runners, which would bypass
-    # the run-ci label gate that requires maintainer review for fork PRs.
+    # SECURITY: For fork PRs, only allow /rerun-ut if the commenter has write+ permission.
+    # This command checks out and executes code from the PR branch on self-hosted GPU
+    # runners, so we must ensure the commenter is a trusted collaborator.
     is_fork = pr.head.repo is None or pr.head.repo.owner.login != gh_repo.owner.login
     if is_fork:
-        print("Permission denied: /rerun-ut is not allowed on fork PRs.")
-        comment.create_reaction("confused")
-        pr.create_issue_comment(
-            "❌ `/rerun-ut` is not available for fork PRs (security restriction).\n\n"
-            "Please ask a maintainer to add the `run-ci` label and use the normal CI flow, "
-            "or use `/rerun-failed-ci` to rerun workflows that have already passed the gate."
-        )
-        return False
+        commenter = comment.user.login
+        perm = gh_repo.get_collaborator_permission(commenter)
+        if perm not in ("admin", "write"):
+            print(f"Permission denied: /rerun-ut on fork PR by {commenter}.")
+            comment.create_reaction("confused")
+            pr.create_issue_comment(
+                "❌ `/rerun-ut` is not available for fork PRs unless the commenter "
+                "has write permission on the repo.\n\n"
+                "Please ask a maintainer to run this command, or use the normal CI flow."
+            )
+            return False
+        print(f"Fork PR, but commenter {commenter} has write+ permission. Proceeding.")
 
     if not (
         user_perms.get("can_rerun_ut", False)
@@ -711,19 +715,6 @@ def main():
         user_perms["can_rerun_failed_ci"] = True
         user_perms["can_rerun_ut"] = True
 
-    # Users with write (or higher) permission on the repo can rerun UTs on any PR,
-    # even if they are not the PR author or listed in CI_PERMISSIONS.json.
-    if not user_perms or not user_perms.get("can_rerun_ut", False):
-        perm = repo.get_collaborator_permission(user_login)
-        if perm in ("admin", "write"):
-            print(
-                f"User {user_login} has '{perm}' repo permission. "
-                "Granting can_rerun_ut."
-            )
-            if user_perms is None:
-                user_perms = {}
-            user_perms["can_rerun_ut"] = True
-
     if not user_perms:
         print(f"User {user_login} does not have any configured permissions. Exiting.")
         return