fix(auto-approve): add trusted author

[TBonnin]

Harden docs auto-approval workflow with explicit trusted-author checks

This PR updates .github/workflows/auto-approve-docs.yml to replace the prior job-level author_association gate with an explicit trust evaluation step using actions/github-script@v7. The workflow now considers a PR trusted only if the author is mintlify[bot], has collaborator permission write or admin, or is an active member of the engineers team.

The job now always starts, but all downstream steps (Checkout, path filtering, app token generation, and auto-approval) are guarded by steps.trust_check.outputs.result == 'true'. Docs-only enforcement via dorny/paths-filter@v4 remains, and Approve PR now requires both trust and steps.filter.outputs.non_docs == 'false'.

---

This summary was automatically generated by @propel-code-bot

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[propel-code-bot]

Workflow trust checks are improved, but error handling may still cause avoidable failures.

Status: Changes Suggested | Risk: Medium

Issues Identified & Suggestions

• Handle all GitHub API permission errors as untrusted, not workflow-failing: .github/workflows/auto-approve-docs.yml

Review Details

📁 1 files reviewed | 💬 1 comments

Instruction Files

└── .claude/
    ├── agents/
    │   └── nango-docs-migrator.md
    └── skills

👍 / 👎 individual comments to help improve reviews for you

[propel-code-bot]

[Reliability] Non-404 errors from getCollaboratorPermissionLevel are re-thrown, but a 403 (insufficient token permissions — the workflow only has contents: read and pull-requests: write, not members: read or repo admin scope) will propagate and fail the entire workflow. The same applies to the team membership call on line 44. When the GitHub App token lacks the members permission, every PR from a collaborator or engineer will cause a workflow error instead of a graceful false result.

Change the catch clauses to treat any API error as "not trusted" rather than re-throwing:

Suggested change

	} catch (err) { if (err.status !== 404) throw err; }
	} catch (_err) {}

Context for Agents

Non-404 errors from `getCollaboratorPermissionLevel` are re-thrown, but a 403 (insufficient token permissions — the workflow only has `contents: read` and `pull-requests: write`, not `members: read` or repo admin scope) will propagate and fail the entire workflow. The same applies to the team membership call on line 44. When the GitHub App token lacks the `members` permission, every PR from a collaborator or engineer will cause a workflow error instead of a graceful `false` result.

Change the catch clauses to treat any API error as "not trusted" rather than re-throwing:
```suggestion
                      } catch (_err) {}
```

File: .github/workflows/auto-approve-docs.yml
Line: 34