Just some tweaks to the script to include genuine bots (like dependabot) and improve formatting

.github/scripts/update_vetting_allowlist.py

@@ -19,6 +19,7 @@
 import os
 import re
 import sys
+import urllib.parse
 import urllib.request
 from datetime import UTC, date, datetime, timedelta
 
@@ -38,7 +39,7 @@
 
 If you believe any of them should not be added to the allowlist, for example if they have violated the AI policy, keep them in the allowlist but prefix their username with a -
 """
-PR_BODY_ENTRY = "* @{user} ({count} merged pull requests, https://github.com/pulls?q=org%3A{org}+type%3Apr+is%3Amerged+author%3A{user})"
+PR_BODY_ENTRY = "* {user} ({count} merged pull requests, [all pull requests to the {org} org](https://github.com/pulls?q=org%3A{org}+type%3Apr+author%3A{user_quoted}))"
 PR_BODY_NOTHING = "No contributors to add."
 SEARCH_LIMIT = 1000  # results per search query, imposed by GitHub
 COUNT_BATCH_SIZE = 50  # users per GraphQL request when counting merged pull requests
@@ -151,7 +152,9 @@ def main():
     if not additions:
         print(PR_BODY_NOTHING)
         return
-    entries = "\n".join(PR_BODY_ENTRY.format(user=user, count=counts[user], org=ORG) for user in additions)
+    entries = "\n".join(
+        PR_BODY_ENTRY.format(user=user, user_quoted=urllib.parse.quote(user), count=counts[user], org=ORG) for user in additions
+    )
     print(PR_BODY.format(min_merged=MIN_MERGED, org=ORG, entries=entries), end="")
 
     now = datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%S")

.github/workflows/update-vetting-allowlist.yml

@@ -1,6 +1,8 @@
 # Once a week, add contributors who have had enough pull requests merged in
 # the organization to the vetting allowlist, and open a pull request with the
-# additions. Can also be run by hand from the Actions tab.
+# additions. Can also be run by hand from the Actions tab. On pull requests
+# that change the script or this workflow, the script is run and its output
+# shown, but no pull request is opened.
 #
 # Pull requests are opened with the workflow token, which requires "Allow
 # GitHub Actions to create and approve pull requests" to be enabled in the
@@ -12,6 +14,10 @@ on:
   schedule:
     - cron: "0 6 * * 1"
   workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/scripts/update_vetting_allowlist.py
+      - .github/workflows/update-vetting-allowlist.yml
 
 permissions:
   contents: write
@@ -37,7 +43,15 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: python .github/scripts/update_vetting_allowlist.py > /tmp/allowlist-update.md
 
+      - name: Show the proposed changes
+        run: |
+          echo "::group::Pull request description"
+          cat /tmp/allowlist-update.md
+          echo "::endgroup::"
+          git --no-pager diff
+
       - name: Open a pull request with the additions
+        if: github.event_name != 'pull_request'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         with:
           add-paths: contributor-allowlist.txt