[JokeWaumans]

User description

What

Adds a host-only config.repo_context_sibling_namespaces, empty by default. It lists
org/group/workspace names, besides the reviewed repository's own, that an already-approved
repo_context_sibling_repos entry may resolve into.

Why

Sibling resolution currently requires the sibling to share the reviewed repository's
top-level namespace, which assumes a project's dependencies live beside it. Where they
don't, there is no way to opt in: one of our products pins 16 submodules spread over 5
groups and none in its own, so gitlab.expand_submodule_diffs drops every one of them.

Scope

• Empty default, so behaviour is unchanged unless an operator sets it.
• Widens namespaces only; a repository still has to be in repo_context_sibling_repos.
• Host-only: repository .pr_agent.toml and comment arguments cannot set it.
• The requester read-access check is untouched.

A shared GitProvider.is_sibling_namespace_allowed() replaces the inline comparison in the
GitLab submodule and sibling-file paths and in GitHub's get_sibling_repo.

---

PR Type

Enhancement, Tests, Documentation

---

Description

• Allow approved siblings across host-listed namespaces.

• Preserve repository allowlists and requester access checks.

• Apply shared checks across GitHub and GitLab.

• Document configuration and test namespace security boundaries.

---

File Walkthrough

	Relevant files
Configuration changes	2 files config_security.py Restrict sibling namespace configuration to host settings +5/-0      configuration.toml Define empty default for sibling namespace allowlist          +1/-0
Enhancement	3 files git_provider.py Add shared sibling namespace approval helper                          +27/-0    github_provider.py Allow host-approved namespaces when resolving GitHub siblings +2/-1      gitlab_provider.py Apply namespace approvals to siblings and submodules          +3/-2
Tests	2 files test_config_reference.py Update expected configuration count for new setting            +1/-1      test_sibling_namespace_allowlist.py Test namespace approval and retained security checks          +126/-0
Documentation	1 files configuration_reference.md Document host-only additional sibling namespace configuration +1/-0

---

---

⚙️ Agent run details

• Model: openai/gpt-6.1-sol
• Tokens: 8,749 in / 476 out / 9,225 total
• Time cost: 8.8s
• AI calls: 1

[the-pr-agent-bot]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

---

⚙️ Agent run details

• Model: openai/gpt-6.1-sol
• Tokens: 10,472 in / 114 out / 10,586 total
• Time cost: 8.9s
• AI calls: 1

[IsmaelMartinez]

Thanks @JokeWaumans for laying out the 16-submodule case so clearly. I'd like to hold this for now. The owning-namespace check is what ties an approved sibling to the projects that may consume it, and this list lifts that for every repository the host reviews, so an approved sibling's diffs or files could be posted into any project's MR that points at it, not only your product's. For one product's layout that is a wide trade, and pre-v1 we are keeping to fixes (#3147). Could you open an issue with the setup, so we can see whether others need it and whether a per-consumer mapping is the better shape?