Repository navigation
feat: implement issue #1425 — [Phase 4] A review bot that can create blocking threads but is not in dev-lead's TRUSTED_BOTS creates an unclearable merge block (graphite-app; root cause of the 2026-08-02 deadlock) - #1497
Conversation
…blocking threads but is not in dev-lead's TRUSTED_BOTS creates an unclearable merge block (graphite-app; root cause of the 2026-08-02 deadlock)
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
🤖 CodeAnt AI — Review Status
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing |
|
Warning Review limit reached
Next review available in: 43 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughThe change adds a shared reviewer-source registry helper, derives dev-lead and advisory bot lists from registry data, validates the thread-creator trust invariant, and adds documentation and Bats coverage. ChangesReviewer registry integration
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant dev-lead-reusable.yml
participant dev-lead-intent.sh
participant reviewer-sources.sh
participant reviewer-sources.tsv
participant advisory-review-gate.sh
dev-lead-reusable.yml->>dev-lead-intent.sh: provide empty TRUSTED_BOTS default
dev-lead-intent.sh->>reviewer-sources.sh: request trusted-bot CSV
reviewer-sources.sh->>reviewer-sources.tsv: read reviewer registrations
reviewer-sources.tsv-->>reviewer-sources.sh: return flagged sources
reviewer-sources.sh-->>dev-lead-intent.sh: return trusted bot list
advisory-review-gate.sh->>reviewer-sources.sh: request advisory and all logins
reviewer-sources.sh-->>advisory-review-gate.sh: return derived bot lists
Possibly related PRs
Suggested labels: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
Bot
added
the
size:L
Dev-Lead — review-changes (no-changes)No changes were needed for this PR. |
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a centralized reviewer-source registry (reviewer-sources.tsv and reviewer-sources.sh) to prevent configuration drift among third-party review bots, resolving issue #1425. It updates dev-lead-intent.sh to dynamically derive trusted bots and adds comprehensive BATS tests to enforce registry invariants. The review feedback highlights critical shell scripting issues where short-circuit && operators under set -e could cause premature script termination, and recommends refactoring the BATS tests to utilize $BATS_TEST_TMPDIR instead of manual mktemp and rm operations for better test isolation and automatic cleanup.
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
1 similar comment
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
- Replace `&&`-short-circuit guards with `if` statements in reviewer-sources.sh so `set -e` cannot swallow the diagnostic path when the manifest is absent or the invariant is violated. - Switch BATS temp files from `mktemp` to `$BATS_TEST_TMPDIR` in test_reviewer_sources.bats and test_intent_reviews.bats; drop the manual `rm -f` calls that BATS_TEST_TMPDIR makes redundant (and that leave files behind on test failure). Also plugs the previously leaked `GITHUB_OUTPUT` temp file in the TRUSTED_BOTS derivation test. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Dev-Lead — review-changes (applied)Changes committed and pushed. |
Dev-Lead — waiting on PR blockers (intent: fix-reviews)PR: #1497 |
|
No description provided. |
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
Dev-Lead — waiting on PR blockers (intent: review-changes)PR: #1497 |
|
Note @don-petry I reviewed this PR and no code changes were needed, but it still has blocking checks or reviews (failing or cancelled checks, or changes-requested reviews), so I cannot mark it done yet. I'll re-check automatically. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/lib/reviewer-sources.sh`:
- Around line 81-87: The reviewer-registry projections currently hide read
failures through process substitutions, allowing empty advisory data to pass;
update scripts/lib/reviewer-sources.sh:81-87 in
reviewer_sources_trusted_bots_csv to propagate projection failures, update
scripts/lib/advisory-review-gate.sh:35-43 and :203-207 to capture and validate
projection output before assigning ADVISORY_BOTS and RATE_LIMIT_NOTICE_BOTS, and
add missing-manifest coverage for all three projections in
tests/test_reviewer_sources.bats:38-62.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a661fd27-740b-4871-92cd-d4b45dc05dfc
⛔ Files ignored due to path filters (1)
scripts/lib/reviewer-sources.tsvis excluded by!**/*.tsv
📒 Files selected for processing (9)
.github/workflows/dev-lead-reusable.yml.github/workflows/lint.ymldocs/dev-lead/spec.mdscripts/dev-lead-intent.shscripts/lib/advisory-review-gate.shscripts/lib/reviewer-sources.shtests/dev-lead/unit/test_advisory_review_gate.batstests/dev-lead/unit/test_intent_reviews.batstests/test_reviewer_sources.bats
|
CI checks on this PR are still running. Once they complete, re-mention Posted by the donpetry-bot PR-review cascade. |
Dev-Lead — fix-reviews (applied)Changes committed and pushed. |
Auto-dismissed (#617): coderabbitai[bot] CHANGES_REQUESTED on a superseded commit. The bot re-reviews the new head automatically — a valid concern will return as a fresh review.
|
Dev-Lead — waiting on PR blockers (intent: fix-reviews)PR: #1497 |
|
Advisory bots were rate-limited; auto-approval is withheld until they recover. pr-review-sweep will re-review this PR after 2026-08-12T07:18:57Z. |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: c22ef7accacd24f753c615d8a2d032db1084c072
Review mode: triage-approved (single reviewer)
Summary
Implements the #1425 fix: a single reviewer-source registry (scripts/lib/reviewer-sources.tsv + reviewer-sources.sh) from which dev-lead's TRUSTED_BOTS, the advisory gate's ADVISORY_BOTS/RATE_LIMIT_NOTICE_BOTS, and the scorecard's REVIEWER_BOTS are derived, adding graphite-app, qodo-code-review, and codeant-ai to the trusted set and enforcing the invariant (creates review threads ⇒ dev-lead trusted) in CI. Design is sound, tests are thorough, all threads resolved, CI green.
Linked issue analysis
Closes #1425 (root cause of the 2026-08-02 merge-queue deadlock: graphite-app created blocking review threads dev-lead was not allowed to act on). The PR substantively addresses it: (1) graphite-app/qodo-code-review/codeant-ai are now dev-lead-trusted; (2) the trusted set defaults to a registry projection instead of a hardcoded list, eliminating the drift that caused the incomplete #1355 integration; (3) reviewer_sources_assert_invariant + tests/test_reviewer_sources.bats enforce the invariant so a future reviewer-source registration cannot land half-done; (4) a regression test reproduces the exact deadlock scenario (graphite inline comment → fix-reviews). Docs updated in docs/dev-lead/spec.md.
Findings
No blocking findings.
- Trust-set expansion (deliberate, per issue): dev-lead will now act on review comments from graphite-app, qodo-code-review, and codeant-ai. This is the explicit intent of owner-authored issue #1425; the intent classifier still verifies sender login and Bot type. AgentShield, Agent Security Scan, and CodeQL all pass.
- Failure-mode handling is correct: registry sourcing/parse failures hard-fail with ::error:: diagnostics rather than silently falling back; the literal fallbacks apply only when the helper file itself is absent (stripped test env), and they match the registry projections exactly.
- Minor (non-blocking): tests/dev-lead/unit/test_advisory_review_gate.bats relaxes shellcheck to --severity=warning for advisory-review-gate.sh; repo-wide shellcheck lint still runs and passes.
- Secret scan: MCP run_secret_scanning tool unavailable in this environment; gitleaks CI check passed (SUCCESS).
CI status
All checks green on c22ef7a: shellcheck, bats, unit-tests, actionlint, CodeQL (actions+python), SonarCloud quality gate, agent-shield, Agent Security Scan, gitleaks secret scan, lint, validate-* suite — all SUCCESS. CANCELLED entries are superseded duplicate runs; SKIPPED entries are ecosystem-specific dependency audits not applicable here. All 14 review threads resolved; no human-reviewer questions outstanding.
Reviewed automatically by the PR-review agent (single-reviewer mode: fable 5). Reply if you need a human review.
2 participants
User description
Closes #1425
Implemented by dev-lead agent. Please review.
CodeAnt-AI Description
Prevent review bots from creating merge blocks that dev-lead cannot clear
What Changed
Impact
✅ Fewer uncleareable merge blocks✅ Review threads from supported bots are actionable✅ No drift between bot trust and review gates💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit
Improvements
Tests