From 458b9fa62ea44459de771615d43735479d10037d Mon Sep 17 00:00:00 2001
From: Esun Kim <veblush@google.com>
Date: Tue, 1 Sep 2026 13:56:26 -0700
Subject: [PATCH 1/3] Added check maintainer edits

---
 .github/pull_request_template.md             | 11 ++++
 .github/workflows/check_maintainer_edits.yml | 60 ++++++++++++++++++++
 2 files changed, 71 insertions(+)
 create mode 100644 .github/pull_request_template.md
 create mode 100644 .github/workflows/check_maintainer_edits.yml

diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 00000000000..7d8e19108d5
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,11 @@
+### Description
+
+<!-- Provide a concise description of what this PR changes and why. -->
+
+BUG=
+
+<!--
+### Checklist
+
+- [ ] "Allow edits from maintainers" is enabled
+-->
diff --git a/.github/workflows/check_maintainer_edits.yml b/.github/workflows/check_maintainer_edits.yml
new file mode 100644
index 00000000000..357cd4c0f0a
--- /dev/null
+++ b/.github/workflows/check_maintainer_edits.yml
@@ -0,0 +1,60 @@
+name: Check Maintainer Edits
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  check-maintainer-edits:
+    runs-on: ubuntu-latest
+    name: Check Maintainer Edits Permission
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Check Permission and Remind
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const author = pr.user.login;
+
+            // Skip known automated bots
+            const exemptBots = ['dependabot[bot]', 'TFLM-bot', 'github-actions[bot]'];
+            if (exemptBots.includes(author)) {
+              return;
+            }
+
+            // Only check PRs created from forks
+            const isFork = pr.head.repo && pr.head.repo.full_name !== context.payload.repository.full_name;
+            if (!isFork) {
+              return;
+            }
+
+            // If maintainer_can_modify is disabled, check if reminder was already posted
+            if (pr.maintainer_can_modify === false) {
+              const { data: comments } = await github.rest.issues.listComments({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number,
+              });
+
+              const alreadyCommented = comments.some(comment =>
+                comment.user.login === 'github-actions[bot]' &&
+                comment.body.includes('Allow edits from maintainers')
+              );
+
+              if (!alreadyCommented) {
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: pr.number,
+                  body: `Hi @${author},\n\nPlease enable "Allow edits from maintainers" in the right sidebar of this pull request so maintainers can assist with rebasing, resolving CI issues, and merging.\n\nFor instructions, see https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork`
+                });
+              }
+            }

From 055327ba6d80799db496d0618953cfc6b1609751 Mon Sep 17 00:00:00 2001
From: Esun Kim <veblush@google.com>
Date: Tue, 1 Sep 2026 14:25:45 -0700
Subject: [PATCH 2/3] Action!

---
 .github/workflows/check_maintainer_edits.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/check_maintainer_edits.yml b/.github/workflows/check_maintainer_edits.yml
index 357cd4c0f0a..9f1d63dbaa3 100644
--- a/.github/workflows/check_maintainer_edits.yml
+++ b/.github/workflows/check_maintainer_edits.yml
@@ -18,7 +18,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Check Permission and Remind
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const pr = context.payload.pull_request;

From a3aa41afb22ea13806fd2ad3529648f319b94fbb Mon Sep 17 00:00:00 2001
From: Esun Kim <veblush@google.com>
Date: Tue, 1 Sep 2026 14:35:14 -0700
Subject: [PATCH 3/3] Updated

---
 .github/workflows/check_maintainer_edits.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/check_maintainer_edits.yml b/.github/workflows/check_maintainer_edits.yml
index 9f1d63dbaa3..ffd11d44c8c 100644
--- a/.github/workflows/check_maintainer_edits.yml
+++ b/.github/workflows/check_maintainer_edits.yml
@@ -1,11 +1,14 @@
 name: Check Maintainer Edits
 
+# zizmor: ignore[dangerous-triggers]
 on:
   pull_request_target:
     types:
       - opened
       - reopened
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
   cancel-in-progress: true