Repository navigation
feat(pr): auto-dismiss stale bot CHANGES_REQUESTED on push (#617) - #1233
Conversation
GitHub's dismiss_stale_reviews_on_push only dismisses stale *approvals*, so a bot's CHANGES_REQUESTED (e.g. CodeRabbit) persists on a superseded commit and blocks reviewDecision even with 0 unresolved threads — a recurring agent-PR merge blocker (#617, blocker 3). On pull_request:synchronize, dismiss an allow-listed bot's CHANGES_REQUESTED review when it sits on a non-head (superseded) commit. Safe: allow-list scoped, stale-commit-only, and the bots re-review the new head automatically so a still-valid concern returns as a fresh review. Same-repo PRs only (fork tokens are read-only). Ring-0 (.github-private) first per the release strategy; promotable to the fleet later. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Juznz5V6su81ffSND8fg7s
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
|
Important Review skippedNo new commits to review since the last review. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughAdds a GitHub Actions workflow that dismisses superseded allow-listed bot ChangesStale Bot Review Dismissal
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested labels: Sequence Diagram(s)sequenceDiagram
participant PullRequest
participant GitHubActions
participant GitHubAPI
PullRequest->>GitHubActions: synchronize or review submission event
GitHubActions->>GitHubActions: verify same-repository pull request
GitHubActions->>GitHubAPI: enumerate pull request reviews
GitHubAPI-->>GitHubActions: paginated review records
GitHubActions->>GitHubAPI: dismiss qualifying superseded reviews
GitHubAPI-->>GitHubActions: dismissal results
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow to reduce agent-PR merge friction by automatically dismissing allow-listed bot CHANGES_REQUESTED reviews when they are attached to a superseded (non-head) commit on pull_request: synchronize.
Changes:
- Introduces a new
dismiss-stale-bot-reviews.ymlworkflow triggered on PR pushes (synchronize). - Uses
gh apito enumerate PR reviews and dismiss allow-listed botCHANGES_REQUESTEDreviews that are not on the current head SHA.
Dev-Lead — review-changes (applied)Changes committed and pushed. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Dev-Lead — review-changes (applied)Changes committed and pushed. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f33f0cbfbf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Dev-Lead — review-changes (applied)Changes committed and pushed. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Auto-dismissed (#617): coderabbitai[bot] CHANGES_REQUESTED on a superseded commit. The bot re-reviews the new head automatically — a valid concern will return as a fresh review.
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #1233 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #1233 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
|
@coderabbitai review |
✅ Action performedReview finished.
|
Dev-Lead — fix-reviews (no-changes)Agent reasoning |
Dev-Lead — fix-bot-comment (no-changes)Agent reasoning |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 8df0ad4952c2347fe7c4ad4c700231576406d8ef
Review mode: triage-approved (single reviewer)
Summary
Adds a new workflow (dismiss-stale-bot-reviews.yml, 78 lines) that auto-dismisses allow-listed bot (coderabbitai) CHANGES_REQUESTED reviews attached to superseded (non-head) commits, plus a documented AGENTS.md template-drift exception. Fixes #617 blocker 3: GitHub's dismiss_stale_reviews_on_push only clears stale approvals, so a stale bot CHANGES_REQUESTED blocks reviewDecision indefinitely. The implementation is defensively written: same-repo PRs only, Dependabot events skipped, allow-list scoped, stale-commit-only, all dynamic values passed via env: (no shell injection surface), enumeration and dismissal failures surface as errors.
Linked issue analysis
Issue #617 (agent-PR merge friction), blocker 3 — CodeRabbit CHANGES_REQUESTED stickiness — is substantively addressed. The PR implements the "auto-dismiss stale bot CHANGES_REQUESTED reviews on push" direction explicitly listed in the issue. Other blockers (1, 2, 4, 5) are out of scope and tracked separately; the PR does not claim to close the issue (no closing reference), which is correct.
Findings
- Risk note (triage adjustment): Triage classified this LOW; I classify it MEDIUM — it is a new automation path consuming privileged bot PATs (
DON_PETRY_BOT_GH_PAT_CLASSICfallback chain) and it modifies review-gate behavior. Still auto-approvable: blast radius is tightly bounded (allow-listed bots only, superseded commits only, bots re-review the new head, human reviews never touched, fork PRs excluded). - Workflow security:
pull_request/pull_request_reviewtriggers (notpull_request_target), no untrusted checkout, env-var-mediated inputs,$userinterpolated only after allow-list match with safely-quoted case pattern. No injection vectors found. No new secrets introduced. - Prior bot findings all resolved (10/10 threads): invalid
eventAPI param removed, enumeration/dismissal error handling added, AGENTS.md exception documented per repo standard, Dependabot skip added, dismissal-capable classic PAT used for protected branches,pull_request_review: submittedtrigger handles late-submitted stale reviews. CodeRabbit APPROVED the final head. - Minor (non-blocking): AGENTS.md says the allow-list is "currently
coderabbitai" while the workflow listscoderabbitai coderabbitai[bot]— same bot, two login forms; not worth a cycle. - Secret scan:
run_secret_scanningMCP tool not available in this session; gitleaks CI check passed and the diff contains no secret material (onlysecrets.*context references).
CI status
All required and optional checks green at 8df0ad49: actionlint, ShellCheck, shellcheck, CodeQL (actions + python), agent-shield, Agent Security Scan, gitleaks, SonarCloud, template-drift, caller-stub-freeze, validate-caller-inputs, holdout-guard, unit-tests, bats, CodeRabbit — SUCCESS. Skipped checks are conditional ecosystem audits (npm/pnpm/cargo/pip/go) not applicable to this diff.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
Why
GitHub's
dismiss_stale_reviews_on_push(on the pr-quality ruleset) only dismisses stale approvals — a bot'sCHANGES_REQUESTEDis left in place, so a stale CodeRabbit review persists on a superseded commit and blocksreviewDecisioneven with 0 unresolved threads, until CodeRabbit re-APPROVEs or someone dismisses it by hand. That's #617 blocker 3, a recurring agent-PR merge stall.What
On
pull_request: synchronize, dismiss an allow-listed bot'sCHANGES_REQUESTEDreview when it sits on a non-head (superseded) commit.Safe by construction:
coderabbitaitoday) — never touches human reviews.CHANGES_REQUESTEDon the new SHA — this only clears a block the new commit already superseded.pull-requests: writeviaGITHUB_TOKEN.Rollout
Ring-0 (
.github-private) first per the Safe Release strategy; promotable to the fleet standard later. Implements your chosen direction for #617 (keep donpetry-bot + auto-dismiss on push).Validation
YAML parses; extracted run-script
bash -n+ shellcheck clean.🤖 Generated with Claude Code
https://claude.ai/code/session_01Juznz5V6su81ffSND8fg7s
Summary by CodeRabbit
New Features
Documentation