From f4fd87a6d443f6a00e904d8f2f620f162255d277 Mon Sep 17 00:00:00 2001
From: luvs01 <luvs01@hanmail.net>
Date: Fri, 7 Aug 2026 20:12:56 +0900
Subject: [PATCH] fix(ci): invalidate sponsorship after PR updates

---
 .github/scripts/pr-sponsored-surface.cjs      |  9 +++++++++
 .github/scripts/pr-sponsored-surface.test.cjs | 12 +++++++++++-
 .github/workflows/pr-hygiene.yml              | 12 ++----------
 3 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/.github/scripts/pr-sponsored-surface.cjs b/.github/scripts/pr-sponsored-surface.cjs
index 36b6e400a0..d7a21a0af6 100644
--- a/.github/scripts/pr-sponsored-surface.cjs
+++ b/.github/scripts/pr-sponsored-surface.cjs
@@ -26,6 +26,14 @@ const RESTRICTED_PREFIXES = [
   "src/oauth/",
 ];
 
+const HEAD_SPECIFIC_APPROVAL_LABELS = [
+  "test-exception-approved",
+  "suppression-approved",
+  "generated-change-approved",
+  "dependency-change-approved",
+  "maintainer-sponsored",
+];
+
 const RESTRICTED_FILES = new Set([
   // Release and packaging automation executed by the release workflow.
   "scripts/release.ts",
@@ -80,6 +88,7 @@ function assessSponsoredSurface({
 }
 
 module.exports = {
+  HEAD_SPECIFIC_APPROVAL_LABELS,
   RESTRICTED_FILES,
   RESTRICTED_PREFIXES,
   assessSponsoredSurface,
diff --git a/.github/scripts/pr-sponsored-surface.test.cjs b/.github/scripts/pr-sponsored-surface.test.cjs
index df5e96d4de..ecfe3497f6 100644
--- a/.github/scripts/pr-sponsored-surface.test.cjs
+++ b/.github/scripts/pr-sponsored-surface.test.cjs
@@ -2,7 +2,17 @@
 
 const { describe, it } = require("node:test");
 const assert = require("node:assert/strict");
-const { assessSponsoredSurface, isRestrictedPath } = require("./pr-sponsored-surface.cjs");
+const {
+  HEAD_SPECIFIC_APPROVAL_LABELS,
+  assessSponsoredSurface,
+  isRestrictedPath,
+} = require("./pr-sponsored-surface.cjs");
+
+describe("HEAD_SPECIFIC_APPROVAL_LABELS", () => {
+  it("invalidates maintainer sponsorship when the reviewed revision changes", () => {
+    assert.ok(HEAD_SPECIFIC_APPROVAL_LABELS.includes("maintainer-sponsored"));
+  });
+});
 
 describe("isRestrictedPath", () => {
   it("covers auth, workflow, release, and dependency surfaces", () => {
diff --git a/.github/workflows/pr-hygiene.yml b/.github/workflows/pr-hygiene.yml
index 4ead21bdde..875201896e 100644
--- a/.github/workflows/pr-hygiene.yml
+++ b/.github/workflows/pr-hygiene.yml
@@ -38,7 +38,7 @@ jobs:
             const { assessHygiene } = require(
               path.join(process.cwd(), ".github", "scripts", "pr-hygiene.cjs"),
             );
-            const { assessSponsoredSurface } = require(
+            const { HEAD_SPECIFIC_APPROVAL_LABELS, assessSponsoredSurface } = require(
               path.join(process.cwd(), ".github", "scripts", "pr-sponsored-surface.cjs"),
             );
 
@@ -79,12 +79,7 @@ jobs:
             // them, so a contributor cannot obtain one narrow exception and
             // then push unreviewed violations under the same label.
             if (context.payload.action === "synchronize") {
-              for (const name of [
-                "test-exception-approved",
-                "suppression-approved",
-                "generated-change-approved",
-                "dependency-change-approved",
-              ]) {
+              for (const name of HEAD_SPECIFIC_APPROVAL_LABELS) {
                 if (labels.has(name)) {
                   await github.rest.issues.removeLabel({
                     owner, repo, issue_number: pull_number, name,
@@ -93,9 +88,6 @@ jobs:
                 }
               }
             }
-            // Sponsorship is head-independent: it is about which surfaces the
-            // change touches, not about the state of a particular revision, so
-            // it is NOT cleared by the synchronize sweep above.
             const failures = [
               ...assessHygiene({ files, labels: [...labels] }),
               ...assessSponsoredSurface({