[maralcbr]

Summary

Follow-up to #208. The plan job read VOUCHED.td at pull_request.base.sha, which stays at the base a PR was opened against, not the current branch tip. Every PR opened before #208 merged therefore found no list.

 Read the vouch list from the target branch
-  contents/.github/VOUCHED.td?ref=$BASE_SHA                 # pull_request.base.sha
+  contents/.github/VOUCHED.td?ref=refs/heads/$BASE_REF      # integration/aurora tip

Still safe: only merged changes reach the protected branch, so a PR still can't vouch for its own author. kernel-ci-approve.yml already reads the tip (github.sha on pull_request_target) and is unchanged.

Evidence

• Before: joshuaswarren's push to ASoC: tas2764, tas2770: do not log a deferred probe as an error #166 (approval run): approved run 40161075250 for joshuaswarren (vouched). The approved run then planned checks only: no .github/VOUCHED.td at faed71028380… (base.sha of ASoC: tas2764, tas2770: do not log a deferred probe as an error #166 is the merge of arm64: configs: asahi: build the Apple watchdog driver in #171, 2026-10-21).
• After: gh api …/contents/.github/VOUCHED.td?ref=refs/heads/integration/aurora returns the 16 entries. actionlint and zizmor (pedantic) are clean.

Merge Danger

Door: two-way

Blast Radius: CI cost

Team PRs opened before #208 now build in full, as #208 intended.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] This change appears safe to merge.

Summary

Updates kernel-ci-jobs.yml to read .github/VOUCHED.td from the target branch’s current tip instead of pull_request.base.sha.

• Kernel CI reads the vouch list from the target branch’s latest tip.

_{Reviews (1) · Last reviewed commit: "ci: read the vouch list from the target ..." · Reviewed by Greptile}