[MarketDataDev03]

Lets the code review bot review pull requests opened by the SDK-sync pipeline's GitHub App (marketdata-sdk-sync[bot]), as sdk-py and sdk-java already do. An App is not a member of the organization, so the policy trusts it by name. Without this, the pipeline's pull requests here get no code review and are handed to a person.

What changes

One line in .github/code-review/policy.yml, with a comment: trusted_authors: ["marketdata-sdk-sync[bot]"]. Nothing else: backends, gate, require_ci_green, ignore_paths and the review rules stay as they are.

Proof

The same line works in the other SDKs. sdk-java and sdk-py carry this exact line, and the bot reviews the pull requests the App opens there. Each of these is authored by app/marketdata-sdk-sync, and each has a Code review check run that started and completed:

• sdk-py: sdk-sync: API 2.0.0+ffb34b7 → sdk-py (minor) sdk-py#175 · check run, success, ✅ Ready.
• sdk-java: sdk-sync: API 2.0.0+ffb34b7 → sdk-java (minor) sdk-java#99 · check run, completed, 🟡 Needs changes, revision 2. It also re-reviewed after a push.

The file parses, with the value in place:

$ python3 -c "import yaml; d = yaml.safe_load(open('.github/code-review/policy.yml')); print(d['trusted_authors'])"
['marketdata-sdk-sync[bot]']

A pull request here from the App is not possible until this merges, because the App's pull requests are not reviewed before then. The first pipeline pull request in this repository is the check here.

[marketdata-code-review]

✅ Ready — Code review

This change allows code review to run for pull requests opened by the SDK-sync GitHub App by adding its bot login to the trusted-author policy. Version impact: none; this is CI configuration only and needs no release bump.

Rating patch 6/6 (exemplary) · proof 5/6 (reproducible) · overall 5/6

---

Reviewed f20844d · revision 1 · codex (gpt-5.6-sol) · claude unavailable · rules: default, sdk

[MarketDataDev03]

@marketdata-code-review re-review

[MarketDataDev02]

Same line as sdk-py and sdk-java: the policy parses with the bot's own loader into a single trusted_authors entry, marketdata-sdk-sync[bot], which is the exact login on the App's PRs, and ignore_authors does not exclude it. The trust check only adds listed logins on top of org membership, the caller workflow has no author filter, and auto_approve and auto_merge stay off, so the App gets a review and a check and nothing more.