feat(review): skip AI review, gate evaluation, and publish for known automation-bot PRs

[JSONbored]

Summary

• Release-please's github-actions[bot], Renovate, and Dependabot PRs currently still pay full AI-review + gate-evaluation cost even though their public surface is already suppressed elsewhere — this closes that gap by skipping the whole webhook pass (and every re-entry path: scheduled sweep, CI-completion re-review, linked-issue-change re-review) as soon as the PR is confirmed automation-bot-authored.
• Security: the webhook-entry check requires the live event sender (payload.sender, GitHub-attested, non-spoofable) to itself be one of the three protected bot logins with type: "Bot" — not just the PR's stored author — so a contributor who gains push access to an existing bot PR's branch still gets full review of their own commits (synchronize can't ride the bot's original authorship to dodge review). Re-entry paths (no live webhook actor available) use only the immutable stored author, which was already verified against the live actor at the PR's original opened event.
• Default-on globally (GITTENSORY_SKIP_AUTOMATION_BOT_PRS), with a per-repo inherit/off/enabled override (repository_settings.skip_automation_bot_authors, mirrors moderation_gate_mode's shape) for repos that want it forced on or off regardless of the global default.

Test plan

• npm run typecheck
• npm run test:ci (full unsharded gate: coverage, engine/driver parity, workers, mcp/miner pack, openapi/settings-parity, docs/manifest drift, ui lint/typecheck/test/build)
• npm audit --audit-level=moderate
• New pure-function security tests (test/unit/automation-bot-skip.test.ts) — pin the exploit-resistance guarantee (human sender on an existing bot PR is never skipped) plus every inherit/off/enabled combination
• New DB round-trip tests (test/unit/repository-settings-skip-automation-bot-authors.test.ts)
• New end-to-end webhook + re-entry tests (test/unit/queue.test.ts): genuine bot skip, exploit-attempt non-skip, per-repo off/enabled overrides, sweep re-entry skip
• 100% line + branch coverage confirmed via lcov on every new/changed line

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	ecfa05f	Commit Preview URL Branch Preview URL	Jul 11 2026, 12:22 AM

[codecov]

Codecov Report

❌ Patch coverage is 87.50000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.22%. Comparing base (3ae7ece) to head (c2f230c).
⚠️ Report is 19 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/queue/processors.ts	75.00%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4659      +/-   ##
==========================================
- Coverage   94.22%   94.22%   -0.01%     
==========================================
  Files         441      442       +1     
  Lines       38741    38757      +16     
  Branches    14117    14126       +9     
==========================================
+ Hits        36504    36518      +14     
  Misses       1577     1577              
- Partials      660      662       +2     

Files with missing lines	Coverage Δ
src/db/repositories.ts	96.72% <100.00%> (+<0.01%)	⬆️
src/db/schema.ts	73.07% <ø> (ø)
src/openapi/schemas.ts	100.00% <ø> (ø)
src/settings/automation-bot-skip.ts	100.00% <100.00%> (ø)
src/types.ts	100.00% <ø> (ø)
src/queue/processors.ts	95.66% <75.00%> (-0.05%)	⬇️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 Gittensory review result - fixes required

_{Review updated: 2026-07-11 00:26:42 UTC}

15 files · 1 AI reviewer · 2 blockers · readiness 93/100 · CI failing · blocked

🛑 Suggested Action - Manual Review

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Review summary
This PR adds a config-driven skip for AI review/gate/publish on confirmed automation-bot PRs (release-please, Renovate, Dependabot), wiring the check into both the fresh webhook path (gated on the live, non-spoofable `payload.sender` plus stored author) and all re-entry paths (gated on stored author only, which was already verified against sender at PR-open time). The schema/migration/repository/types/openapi layers are all updated in parity, the migration is a simple additive `ALTER TABLE ... ADD COLUMN ... NOT NULL DEFAULT 'inherit'` (idempotency-safe as long as 0140 is never re-numbered), and the security reasoning for using live sender vs. stored author is sound and is directly exercised by an exploit-attempt test (`queue.test.ts`, human pushing to an existing bot PR's branch is not skipped). The PR description does not link or close any tracked issue, which this repo's contribution policy requires before a PR can be treated as merge-ready.

Blockers

• No linked/closed issue in the PR description — per this repo's contribution policy every external PR must close or clearly reference an eligible open issue, and this one (a new default-on behavior change to the review pipeline) doesn't cite one, so it can't be marked merge-ready without that link being added or justified.
• codecov/patch is failing at 87.50% against a 99% target, and the likely gap is the untested `console.warn` audit-failure branch in `src/queue/processors.ts` around line 6181 (the `.catch()` on `recordAuditEvent` inside the new skip block) — add a test that forces `recordAuditEvent` to reject and asserts the webhook still returns/records `processed` despite the audit-log failure.

Nits — 5 non-blocking

• The `console.warn` at `src/queue/processors.ts:6181` is legitimate best-effort error logging (not debug leftover), but per the coverage note above it currently has no test exercising the rejection path — worth pairing with a test rather than leaving it as the only uncovered branch in this diff.
• `resolveSkipAutomationBotPullRequests`'s per-repo override is intentionally symmetric (both `off` and `enabled` fully override the global default), unlike `moderation_gate_mode`'s global-is-authoritative asymmetry — the doc comment explains why, but worth a second maintainer sign-off since it's a deliberate divergence from the established pattern in this codebase.
• `skipAutomationBotAuthors` is optional in `RepositorySettings` (`src/types.ts`) purely so existing fixtures don't need touching, per its own comment — fine, but confirm no caller reads it without going through `getRepositorySettings`'s normalization (which always populates it), or a raw partial object could reach `resolveSkipAutomationBotPullRequests` with `undefined` and silently behave as `inherit` in an unexpected place.
• Add the missing issue link/reference to the PR description so the automated eligibility gate and future readers can trace the motivation.
• Add a test asserting the `recordAuditEvent(...).catch(...)` branch in `processGitHubWebhook` (processors.ts ~6172-6181) to close the coverage gap and confirm audit-log failures don't block or un-skip the webhook.

Why this is blocked

• No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
• Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

CI checks failing

• validate
• validate-code

Signal	Result	Evidence
Code review	❌ 2 blockers	1 reviewer
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 48 registered-repo PR(s), 40 merged, 275 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 48 PR(s), 275 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 48 PR(s), 275 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.
• Explain no-issue PR.
• Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/	desktop			—
/	mobile			—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review