fix(webhook): scope the label public-surface trigger to disposition labels only by JSONbored · Pull Request #9176 · JSONbored/loopover

JSONbored · 2026-07-27T05:42:25Z

Summary

fix(webhook): catch a base retarget with no new commit, tighten event health, and stop label/issue churn from going stale #9169 added "labeled"/"unlabeled" to PR_PUBLIC_SURFACE_ACTIONS unconditionally so a maintainer adding/removing the manual-review hold re-syncs immediately instead of waiting for the sweep — but the implementation fired on any label change, not just the manual-review hold. Tagging a PR bug now ran the full public-surface publish pipeline too, which broke test/unit/queue-4.test.ts's noisy-PR-event debounce test on main.
Fix: shouldProcessPullRequestPublicSurface now checks the label that actually changed (payload.label.name) against the repo's resolved disposition labels (manual-review, ready-to-merge, changes-requested, migration-collision, pending-closure — the same set resolveAgentDispositionLabels already resolves elsewhere in this file). Only a match takes the immediate path; anything else — including a missing/absent label payload — stays debounced to the ~2-minute sweep, same as before fix(webhook): catch a base retarget with no new commit, tighten event health, and stop label/issue churn from going stale #9169.
Also corrected a stale comment in src/github/webhook-coalesce.ts that claimed labeled/unlabeled never triggers the public-surface pipeline (already inaccurate after fix(webhook): catch a base retarget with no new commit, tighten event health, and stop label/issue churn from going stale #9169, doubly so now).

Scope

The PR title follows type(scope): short summary Conventional Commit format.
This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
Closes orb(webhook): #9169's labeled/unlabeled public-surface trigger fires on ANY label, not just disposition labels — breaks the noisy-PR-event debounce #9175 (opened to document this regression before filing the fix).

Validation

git diff --check
npm run typecheck
Targeted tests: npx vitest run test/unit/queue-4.test.ts test/unit/pr-labeled-public-surface.test.ts test/unit/queue-2.test.ts test/unit/github-pr-actions.test.ts test/unit/github-client.test.ts test/unit/github-webhook-coalesce.test.ts test/unit/issue-label-churn-upsert.test.ts test/unit/project-tracker-adapter.test.ts test/unit/queue-lifecycle-guards.test.ts test/unit/queue.test.ts test/integration/orb-installations.test.ts test/integration/orb-relay.test.ts — all green, including two new regression tests pinning both the "no label field" and "explicitly-disabled disposition label" branches, and two new tests in pr-labeled-public-surface.test.ts covering another disposition label (ready-to-merge) and the noisy-label contrast case.

If any required check was skipped, explain why:

Did not run the full npm run test:ci / npm run test:coverage / ui:* gate this pass (targeted-tests + typecheck only, as directed). This is an owner PR against JSONbored/loopover, so it is not subject to the one-shot contributor gate; CI will run the full suite on push regardless.

Safety

No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — N/A, no auth/session changes.
API/OpenAPI/MCP behavior is updated and tested where needed. — N/A, no public API/OpenAPI/MCP surface changed.
UI changes use live API data or real empty/error/loading states. — N/A, no UI changes.
UI Evidence — N/A, no visible UI change.
Public docs/changelogs are updated. — N/A, internal webhook-processing behavior only.

Notes

No generated artifacts to regenerate (no API/schema, wrangler binding, env.* read, or migration changes).

…abels only (#9175) #9169 added "labeled"/"unlabeled" to PR_PUBLIC_SURFACE_ACTIONS unconditionally so the manual-review hold re-syncs immediately, but that also made every unrelated label change (e.g. tagging a PR "bug") run the full public-surface publish pipeline, breaking the noisy-PR-event debounce. Now only a label matching one of the resolved disposition labels (manual-review, ready-to-merge, changes-requested, migration-collision, pending-closure) triggers the immediate path; anything else stays debounced to the sweep. Closes #9175

superagent-security · 2026-07-27T05:42:59Z

Superagent didn't find any vulnerabilities or security issues in this PR.

codecov · 2026-07-27T05:54:53Z

❌ 5 Tests Failed:

Tests completed	Failed	Passed	Skipped
21887	5	21882	21

View the top 3 failed test(s) by shortest run time

test/unit/setup-wizard-docs-parity.test.ts > self-host GitHub App manifest <-> docs parity (#2542) > the docs page's events sentence names every buildManifest default_event, and only those

Stack Traces | 0.0127s run time

AssertionError: expected [ 'check run', 'check suite', …(5) ] to deeply equal [ 'check run', 'check suite', …(10) ]

- Expected
+ Received

  [
    "check run",
    "check suite",
-   "deployment status",
-   "issue comment",
    "issues",
    "pull request",
    "pull request review",
-   "pull request review thread",
    "push",
-   "repository",
    "status",
-   "workflow run",
  ]

 ❯ test/unit/setup-wizard-docs-parity.test.ts:65:31

test/unit/backfill.test.ts > GitHub backfill > refreshes installation health from live GitHub App metadata

Stack Traces | 0.0197s run time

AssertionError: expected [ { installationId: 123, …(19) } ] to deeply equal ArrayContaining{…}

- Expected
+ Received

- ArrayContaining [
-   ObjectContaining {
+ [
+   {
      "accountLogin": "JSONbored",
+     "authMode": "local",
+     "checkedAt": "2026-07-27T05:44:44.632Z",
+     "errorSummary": undefined,
+     "eventRemediation": [
+       {
+         "action": "No change needed.",
+         "event": "issues",
+         "ok": true,
+       },
+       {
+         "action": "No change needed.",
+         "event": "issue_comment",
+         "ok": true,
+       },
+       {
+         "action": "No change needed.",
+         "event": "pull_request",
+         "ok": true,
+       },
+       {
+         "action": "Subscribe to the pull_request_review webhook event.",
+         "event": "pull_request_review",
+         "ok": false,
+       },
+       {
+         "action": "No change needed.",
+         "event": "repository",
+         "ok": true,
+       },
+       {
+         "action": "Subscribe to the check_run webhook event.",
+         "event": "check_run",
+         "ok": false,
+       },
+       {
+         "action": "Subscribe to the check_suite webhook event.",
+         "event": "check_suite",
+         "ok": false,
+       },
+     ],
+     "events": [
+       "issues",
+       "issue_comment",
+       "pull_request",
+       "repository",
+       "installation_repositories",
+     ],
      "installationId": 123,
-     "missingEvents": [],
+     "installedReposCount": 0,
+     "missingEvents": [
+       "pull_request_review",
+       "check_run",
+       "check_suite",
+     ],
      "missingPermissions": [],
-     "status": "healthy",
+     "optionalPermissions": {
+       "checks": "write",
+     },
+     "optionalVisibleEvents": [
+       "installation_target",
+       "installation_repositories",
+     ],
+     "permissionRemediation": [
+       {
+         "action": "No change needed.",
+         "currentAccess": "read",
+         "ok": true,
+         "permission": "metadata",
+         "requiredAccess": "read",
+       },
+       {
+         "action": "No change needed.",
+         "currentAccess": "write",
+         "ok": true,
+         "permission": "pull_requests",
+         "requiredAccess": "read",
+       },
+       {
+         "action": "No change needed.",
+         "currentAccess": "write",
+         "ok": true,
+         "permission": "issues",
+         "requiredAccess": "write",
+       },
+     ],
+     "permissions": {
+       "checks": "write",
+       "issues": "write",
+       "metadata": "read",
+       "pull_requests": "write",
+     },
+     "registeredInstalledCount": 0,
+     "repairSteps": [
+       "Update the GitHub App permissions and subscribed events.",
+       "Approve the changed permissions or reinstall the app on the target account.",
+       "Run refresh-installation-health after GitHub sends the updated installation payload.",
+       "Recheck /v1/readiness and this installation health endpoint.",
+     ],
+     "repositorySelection": "selected",
+     "requiredEvents": [
+       "issues",
+       "issue_comment",
+       "pull_request",
+       "pull_request_review",
+       "repository",
+       "check_run",
+       "check_suite",
+     ],
+     "requiredPermissions": {
+       "issues": "write",
+       "metadata": "read",
+       "pull_requests": "read",
+     },
+     "status": "needs_attention",
    },
  ]

 ❯ test/unit/backfill.test.ts:1369:37

test/unit/backfill.test.ts > GitHub backfill > reports installation health from stored permissions and events

Stack Traces | 0.0844s run time

AssertionError: expected { installationId: 123, …(19) } to match object { status: 'needs_attention', …(3) }
(22 matching properties omitted from actual)

- Expected
+ Received

@@ -1,10 +1,13 @@
  {
    "missingEvents": [
      "issues",
      "issue_comment",
+     "pull_request_review",
      "repository",
+     "check_run",
+     "check_suite",
    ],
    "missingPermissions": [
      "pull_requests",
      "issues",
    ],

 ❯ test/unit/backfill.test.ts:686:37

test/unit/backfill.test.ts > GitHub backfill > uses installation source for queued segment jobs and sparse live installation fallback metadata

Stack Traces | 0.113s run time

AssertionError: expected [ { installationId: 123, …(19) } ] to deeply equal ArrayContaining{…}

- Expected
+ Received

- ArrayContaining [
-   ObjectContaining {
+ [
+   {
      "accountLogin": "JSONbored",
+     "authMode": "local",
+     "checkedAt": "2026-07-27T05:44:48.221Z",
+     "errorSummary": undefined,
+     "eventRemediation": [
+       {
+         "action": "Subscribe to the issues webhook event.",
+         "event": "issues",
+         "ok": false,
+       },
+       {
+         "action": "Subscribe to the issue_comment webhook event.",
+         "event": "issue_comment",
+         "ok": false,
+       },
+       {
+         "action": "Subscribe to the pull_request webhook event.",
+         "event": "pull_request",
+         "ok": false,
+       },
+       {
+         "action": "Subscribe to the pull_request_review webhook event.",
+         "event": "pull_request_review",
+         "ok": false,
+       },
+       {
+         "action": "Subscribe to the repository webhook event.",
+         "event": "repository",
+         "ok": false,
+       },
+       {
+         "action": "Subscribe to the check_run webhook event.",
+         "event": "check_run",
+         "ok": false,
+       },
+       {
+         "action": "Subscribe to the check_suite webhook event.",
+         "event": "check_suite",
+         "ok": false,
+       },
+     ],
      "events": [],
      "installationId": 123,
+     "installedReposCount": 1,
      "missingEvents": [
        "issues",
        "issue_comment",
        "pull_request",
+       "pull_request_review",
        "repository",
+       "check_run",
+       "check_suite",
      ],
      "missingPermissions": [
        "metadata",
        "pull_requests",
        "issues",
      ],
+     "optionalPermissions": {
+       "checks": "write",
+     },
+     "optionalVisibleEvents": [
+       "installation_target",
+       "installation_repositories",
+     ],
+     "permissionRemediation": [
+       {
+         "action": "Set repository permission metadata to read.",
+         "currentAccess": "missing",
+         "ok": false,
+         "permission": "metadata",
+         "requiredAccess": "read",
+       },
+       {
+         "action": "Set repository permission pull_requests to read.",
+         "currentAccess": "missing",
+         "ok": false,
+         "permission": "pull_requests",
+         "requiredAccess": "read",
+       },
+       {
+         "action": "Set repository permission issues to write.",
+         "currentAccess": "missing",
+         "ok": false,
+         "permission": "issues",
+         "requiredAccess": "write",
+       },
+     ],
      "permissions": {},
+     "registeredInstalledCount": 1,
+     "repairSteps": [
+       "Update the GitHub App permissions and subscribed events.",
+       "Approve the changed permissions or reinstall the app on the target account.",
+       "Run refresh-installation-health after GitHub sends the updated installation payload.",
+       "Recheck /v1/readiness and this installation health endpoint.",
+     ],
      "repositorySelection": "selected",
+     "requiredEvents": [
+       "issues",
+       "issue_comment",
+       "pull_request",
+       "pull_request_review",
+       "repository",
+       "check_run",
+       "check_suite",
+     ],
+     "requiredPermissions": {
+       "issues": "write",
+       "metadata": "read",
+       "pull_requests": "read",
+     },
      "status": "needs_attention",
    },
  ]

 ❯ test/unit/backfill.test.ts:4724:34

test/integration/api.test.ts > api routes > serves installation repair diagnostics and refreshes installation health

Stack Traces | 0.135s run time

AssertionError: expected { …(12) } to match object { refreshed: true, …(2) }
(37 matching properties omitted from actual)

- Expected
+ Received

@@ -1,10 +1,14 @@
  {
    "installation": {
-     "missingEvents": [],
+     "missingEvents": [
+       "pull_request_review",
+       "check_run",
+       "check_suite",
+     ],
      "missingPermissions": [],
-     "status": "healthy",
+     "status": "needs_attention",
    },
    "refreshed": true,
    "requiredPermissions": {
      "checks": "write",
      "issues": "write",

 ❯ test/integration/api.test.ts:2364:35

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

JSONbored self-assigned this Jul 27, 2026

JSONbored merged commit 5f4edf9 into main Jul 27, 2026
3 of 4 checks passed

JSONbored deleted the claude/charming-clarke-d69af8 branch July 27, 2026 05:47

loopover-orb Bot added the gittensor:bug Gittensor-scored bug fix — scores a 0.05x multiplier. label Jul 27, 2026

This was referenced Jul 27, 2026

fix(review): finalize CI-stuck silence, post a waiting placeholder, and name every silent AI-review skip #9180

Merged

fix(test,docs): resync installation-health fixtures and self-host docs with the #9169 required-events expansion #9203

Merged

github-actions Bot mentioned this pull request Jul 27, 2026

chore(release): cut orb-v3.5.0 #9419

Merged

Navigation Menu

Uh oh!

fix(webhook): scope the label public-surface trigger to disposition labels only - #9176

fix(webhook): scope the label public-surface trigger to disposition labels only#9176
JSONbored merged 1 commit into
mainfrom
claude/charming-clarke-d69af8

JSONbored commented Jul 27, 2026

Uh oh!

superagent-security Bot commented Jul 27, 2026

Uh oh!

Uh oh!

codecov Bot commented Jul 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

JSONbored commented Jul 27, 2026

Summary

Scope

Validation

Safety

Notes

Uh oh!

superagent-security Bot commented Jul 27, 2026

Uh oh!

Uh oh!

codecov Bot commented Jul 27, 2026

❌ 5 Tests Failed:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant