Record who Junior acts for on workflow dispatches #2210

When Junior dispatches a GitHub Actions workflow, GitHub records sentry-junior[bot] as the actor. Nothing in GitHub says which person or conversation Junior was acting for. Release and dependency-bump workflows then hand off to other bots, so the end result looks like one bot asking another bot for a change, with no human anywhere in the chain.

• Issues and PRs that Junior creates through its own GitHub tools get requester attribution and a session footer. Workflow dispatches (gh workflow run or POST .../dispatches) get neither.
• Example: ref: bump taskbroker-client to 0.20.30 sentry#128507 was opened by sentry-release-bot. The bump-version run behind it was dispatched by sentry-junior[bot]. The earlier taskbroker release run was also dispatched by Junior, and its publish request (publish: getsentry/taskbroker/clients@0.20.30 publish#9978) says only "Requested by: @sentry-junior[bot]".
• The only way to trace this today is to line up timestamps with Junior's internal Sentry spans and decode the credential context in the sandbox's outbound-request URLs. For turns resumed by an event, that context names a generic system event actor rather than the person, so the link to a person comes only from the conversation.
• These workflows exist to skip normal code review for routine changes, so the missing requester is the main provenance gap. Junior has no searchable log that maps side effects like dispatches, releases, and merges to a requester and a conversation.

Raised by Markus Unterwaditzer. David Cramer agreed a log is needed.

Related: #773 (binding credential actor to instruction authority), #584 (attribution footers on created issues and PRs).

via markus.

--

View Junior Session [Sentry]