# PR Description
The `github.event.pull_request.author_association` in the "Prevent
Unauthorized Version Updates" workflow was returning inconsistent
results by saying that MEMBERS were CONTRIBUTORS. This PR moves away
from `author_association` in favor of a whitelist text file containing
the GitHub usernames of authorized toolkit release managers.
A toolkit release manager has the following special permissions:
* Can change the version of an existing toolkit
* Can delete an existing toolkit
* Can rename an existing toolkit
# PR Description
Add checks for unauthorized actions performed on toolkits. A PR cannot
be merged if it contains an unauthorized toolkit action.
An unauthorized toolkit action is defined as:
1. The author of the PR is not an OWNER or a MEMBER of the ArcadeAI
organization
2. AND one of the following applies:
- A toolkit's version is altered (i.e., the version in
`toolkits/*/pyproject.toml`
- A toolkit is deleted
- A toolkit's PyPI package name is renamed (i.e., the name in
`toolkits/*/pyproject.toml`
