ci: allowlist bot authors for e2e tests (#3248)

.github/workflows/ci.yml

@@ -87,7 +87,7 @@ jobs:
           fi
           echo "Author: $AUTHOR"
           case "$AUTHOR" in
-            wwwillchen|keppo-bot|keppo-bot[bot]|dyad-assistant|azizmejri1)
+            wwwillchen|keppo-bot|keppo-bot\[bot\]|dyad-assistant|azizmejri1|RyanGroch)
               echo "is_privileged=true" >> $GITHUB_OUTPUT
               ;;
             *)
@@ -99,7 +99,7 @@ jobs:
       # The "image" field is a JSON-encoded array string so that fromJSON() in runs-on
       # can produce the correct label(s) for both GitHub-hosted and self-hosted runners.
       #
-      # Privileged authors (wwwillchen, keppo-bot/keppo-bot[bot], dyad-assistant, azizmejri1):
+      # Privileged authors (wwwillchen, keppo-bot/keppo-bot[bot], dyad-assistant, azizmejri1, RyanGroch):
       #   - Self-hosted macOS ARM64 runners, no Windows, no sharding.
       #
       #   build (macOS self-hosted) ──> e2e-tests (macOS self-hosted, shard 1/1)

rules/git-workflow.md

@@ -65,6 +65,10 @@ When running GitHub Actions with `pull_request_target` on cross-repo PRs (from f
 
 Actions performed using the default `GITHUB_TOKEN` (including labels added by `github-actions[bot]` via `actions/github-script`) do **not** trigger `pull_request_target` or other workflow events. This is a GitHub limitation to prevent infinite loops. If one workflow adds a label that should trigger another workflow (e.g., `label-rebase-prs.yml` adds `cc:rebase` to trigger `claude-rebase.yml`), the label-adding step must use a **PAT** or **GitHub App token** (e.g., `PR_RW_GITHUB_TOKEN`) instead of `GITHUB_TOKEN`.
 
+## Bash `case` allowlists in workflows
+
+When matching GitHub bot logins in Bash `case` patterns, escape literal square brackets. For example, `keppo-bot[bot]` is parsed as a character class and does not match the login; use `keppo-bot\[bot\]`.
+
 ## GitHub API calls with special characters
 
 When using `gh api` to post comments or replies containing backticks, `$()`, or other shell metacharacters, the security hook will block the command. Instead of passing the body inline with `-f body="..."`, write a JSON file and use `--input`: