ci: require accepted issues for community pull requests (#4340)

Evaluate issue acceptance using trusted default-branch code and the PR author's repository permissions. Report the native workflow job result, protect enforcement files, and align PR creation and review guidance.

Closes #4339

Signed-off-by: Evan Lezar <elezar@nvidia.com>

.github/CODEOWNERS

@@ -6,7 +6,7 @@
 
 ## Merge enforcement — these paths decide who can merge, so they notify the full
 # list of maintainers to raise scrutiny on changes here.
-# 
+#
 # PR checks run local to the branch, so unless the check specifically avoids
 # using branch-local files, a PR could change its own gates and appear to pass
 # them. Covering the required checks here closes that gap.
@@ -31,5 +31,9 @@
 /tasks/scripts/check_maintainer_approval_test.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
 /tasks/scripts/alert_maintainer_change_test.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
 
+# PR issue acceptance checks
+/tasks/scripts/check_issue_acceptance.cjs @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+/tasks/scripts/check_issue_acceptance.test.cjs @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+
 # Auditable SBOM check
 /tasks/scripts/verify-image-sbom.sh @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr

.github/PULL_REQUEST_TEMPLATE.md

@@ -2,7 +2,7 @@
 <!-- 1-3 sentences: what this PR does and why -->
 
 ## Related Issue
-<!-- Every PR must close an existing issue covering its scope, except automated dependency updates. Use Closes #NNN; see CONTRIBUTING.md for the exception. -->
+<!-- Every PR must close an existing issue covering its scope, except automated dependency updates. Use Closes #NNN; see CONTRIBUTING.md for the exception. Authors without repository write access must link at least one issue with state:accepted. PR body text cannot bypass this acceptance check. -->
 
 ## Changes
 <!-- Bullet list of key changes -->

.github/workflows/pr-issue-acceptance.yml

@@ -0,0 +1,40 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: PR Issue Acceptance
+
+on:
+  pull_request_target:
+    types: [opened, edited, reopened, synchronize]
+
+permissions:
+  contents: read
+  issues: read
+  pull-requests: read
+
+concurrency:
+  group: pr-issue-acceptance-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  issue-acceptance:
+    name: OpenShell / PR Issue Acceptance
+    timeout-minutes: 5
+    if: github.repository_owner == 'NVIDIA'
+    runs-on: ubuntu-latest
+    steps:
+      # pull_request_target supplies the trusted default-branch SHA. Load
+      # only that helper; PR metadata is data, never executable code.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+          sparse-checkout: tasks/scripts/check_issue_acceptance.cjs
+          sparse-checkout-cone-mode: false
+
+      - name: Check author access and linked issue acceptance
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        with:
+          script: |
+            const check = require('./tasks/scripts/check_issue_acceptance.cjs');
+            await check({ github, context, core });

.github/zizmor.yml

@@ -9,6 +9,7 @@ rules:
       - dco.yml:3
       - e2e-label-help.yml:13
       - maintainers-change-alert.yml:6
+      - pr-issue-acceptance.yml:6
       - release-canary.yml:3
       - required-ci-gates.yml:3
       - vouch-check.yml:3