fix: skip no-op PRs from MAX_PRS budget in pr-review workflow by claude[bot] · Pull Request #10 · petry-projects/.github-private

claude · 2026-04-16T01:46:42Z

Summary

Fixes #7: MAX_PRS was being consumed by already-reviewed (no-op) PRs, stalling the backlog.

Changes

scripts/review-one-pr.sh (pushed)

No-op exit code changed from 0 → 100 (sentinel value)
The review loop can now detect no-ops without ambiguity

.github/workflows/pr-review.yml (needs manual push — see below)

Enumerate step no longer truncates with head -n MAX_PRS; all candidates are passed to the review loop
Review step counts only actual reviews toward MAX_PRS; no-ops (exit 100) are skipped without counting

How it works

Before: enumerate did head -n $MAX_PRS, so 10 no-ops = 10 budget consumed, 0 real reviews.

After: the loop iterates all candidates until MAX_PRS actual reviews are posted:

rc=0
bash scripts/review-one-pr.sh "$pr_url" || rc=$?
if [ "$rc" -eq 100 ]; then
  skipped_noops=$((skipped_noops + 1))   # no-op: don't count
else
  actual=$((actual + 1))                 # real review: count it
fi

⚠️ Workflow file push blocked — action needed

GH_PAT lacks the workflows permission scope needed to push .github/workflows/pr-review.yml. The full diff is committed locally on branch claude/issue-7-20260416-0130.

To complete the fix, either:

Add Bash(git push:*) to claude_args allowedTools in .github/workflows/claude.yml and re-trigger this issue with the claude label.
Or push the workflow file manually from the local branch.

Closes #7

Generated with Claude Code

Co-authored-by: don-petry <don-petry@users.noreply.github.com>

The review-one-pr.sh script already exits with code 100 for no-ops, but the workflow was counting them toward MAX_PRS budget. Now: - Review loop processes ALL candidates (not truncated to MAX_PRS) - Only non-no-op PRs count toward the MAX_PRS budget - Loop stops after MAX_PRS actual reviews are posted - This unblocks the backlog from being stuck on already-reviewed PRs Fixes #7 (completes PR #10)

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com>

The review-one-pr.sh script already exits with code 100 for no-ops, but the workflow was counting them toward MAX_PRS budget. Now: - Review loop processes ALL candidates (not truncated to MAX_PRS) - Only non-no-op PRs count toward the MAX_PRS budget - Loop stops after MAX_PRS actual reviews are posted - This unblocks the backlog from being stuck on already-reviewed PRs Fixes #7 (completes PR #10)

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com>

The review-one-pr.sh script already exits with code 100 for no-ops, but the workflow was counting them toward MAX_PRS budget. Now: - Review loop processes ALL candidates (not truncated to MAX_PRS) - Only non-no-op PRs count toward the MAX_PRS budget - Loop stops after MAX_PRS actual reviews are posted - This unblocks the backlog from being stuck on already-reviewed PRs Fixes #7 (completes PR #10)

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com>

The review-one-pr.sh script already exits with code 100 for no-ops, but the workflow was counting them toward MAX_PRS budget. Now: - Review loop processes ALL candidates (not truncated to MAX_PRS) - Only non-no-op PRs count toward the MAX_PRS budget - Loop stops after MAX_PRS actual reviews are posted - This unblocks the backlog from being stuck on already-reviewed PRs Fixes #7 (completes PR #10)

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> Co-authored-by: don-petry <don-petry@users.noreply.github.com>

… default `claude` engine — `COPILOT_API_MODEL: unbound variable` (#774) * Add scheduled PR review agent Hourly GitHub Action that enumerates open PRs (authored by or review-requested from @me), classifies risk via Claude Code, and auto-approves LOW/MEDIUM PRs that pass quality gates while escalating HIGH-risk or gated PRs for human review. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Use Claude Code OAuth token instead of API key Routes agent runs through the Max plan subscription rather than per-token API billing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Enforce single-PR scope and default to dry-run - Prompt now hard-forbids enumeration commands and acting on any PR other than $PR_URL. Earlier dry-run revealed the agent was reviewing the entire backlog in a single invocation, ignoring the per-PR loop. - DRY_RUN now defaults to true unless repo variable LIVE_MODE=true, so the hourly cron is safe by default until the operator opts in. - AGENT.md documents the LIVE_MODE switch and corrects PAT scopes (Issues needs write to create the needs-human-review label). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add 3-model council + commit-SHA-aware iterative review The single-prompt reviewer is replaced by a council of 3 Claude models, each with a focused lens, and a synthesizer that combines them: - Security (Opus 4.6) - auth, secrets, injection, supply chain - Correctness (Sonnet 4.6) - logic, issue alignment, tests, CI - Maintainability (Haiku 4.5) - standards, conventions, clarity - Synthesizer (Sonnet 4.6) - max risk, escalate-if-any, dedupe, post Council members run in parallel, write JSON verdicts to /tmp/council/, and never touch GitHub. The synthesizer is the only actor that posts. Every posted review embeds an HTML marker on line 1:  scripts/review-one-pr.sh checks for that marker before spending tokens: - Marker SHA == current head SHA -> skip (already reviewed). - Marker SHA != current head SHA -> re-review (handles iterative cycles). - No marker -> first review. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Upgrade maintainability lens from Haiku 4.5 to Sonnet 4.6 Haiku couldn't follow the agentic instructions — it asked for env vars instead of reading them and executing the gh commands. All three council members now use models capable of multi-step tool use. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Go-live improvements for PR review agent (#2) - Upgrade actions/checkout v4→v5 (Node.js 20 deprecation) - Add MAX_PRS cap (default 10) to stay within 60-min job timeout - Filter drafts at enumeration (--draft=false) - Fix jq operator-precedence bug in idempotency check - Add truncation notice log, inline jq comments, docs updates Council-reviewed: 2 rounds (escalated round 1 on jq bug, approved round 2) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude delegation, auto-merge, and rebase handling (#3) - Post structured fix-request comments on escalated PRs in Claude-enabled orgs - Claude's workflow trigger picks up the comment automatically (no @claude tag) - On approval: auto-merge (--auto --squash), rebase if behind, remove label - Cycle guard (MAX_REVIEW_CYCLES=3) prevents infinite delegation loops - New repo variables: CLAUDE_ORGS, MAX_REVIEW_CYCLES Council-reviewed: dispatch hit rate limit but architecture validated against petry-projects/.github claude-code-reusable.yml workflow — event flow confirmed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Optimize review: small-PR and incremental fast paths (#4) * Add review mode optimization: small-PR and incremental fast paths PRs are now routed to the cheapest review path: - Small PRs (<10 lines): single Opus call (1 invocation vs 4) - Re-reviews (prior marker at different SHA): single Opus call with prior review context, focused on what changed since last review - First review of non-small PRs: full 3-member council (unchanged) New files: - prompts/single-review.md: combined council+synth prompt for single reviewer mode, handles both small and incremental paths New config: - SMALL_PR_THRESHOLD repo variable (default 10) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Replace parallel council with cascading review tiers Haiku triage → Sonnet deep review → Opus security audit, where each tier only fires if the previous one escalated. This replaces the 3-parallel-members + synthesizer architecture. Cost impact: - ~80% of PRs: Haiku + Opus confirm (2 calls, ~30s vs 4 calls, ~5 min) - ~15%: + Sonnet (3 calls, ~2.5 min) - ~5%: full cascade (4 calls, ~5.5 min) Haiku works by receiving pre-fetched context (no tool use needed), which sidesteps the agentic limitations found earlier. New files: - prompts/triage.md — Tier 1: Haiku fast classification - prompts/deep-review.md — Tier 2: Sonnet full review - prompts/security-audit.md — Tier 3: Opus security audit - prompts/cascade-action.md — posts review from any resolving tier Re-reviews (prior marker at different SHA) pass prior review context to the triage, enabling faster incremental checks. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix review council findings: 4 major + 3 minor issues Major fixes: - Replace invalid 'repository' gh field with 'headRepository'/'headRepositoryOwner' across script and all prompts - Add 'triage-approved' as valid REVIEW_MODE in single-review.md with dedicated mode description - Fix PRIOR_REVIEW_BODY selector: head -1 → tail -1 to match most-recent SHA - Update dangling 'synthesize.md step 9a' reference to cascade-action.md Minor fixes: - Validate PRIOR_REVIEW_BODY contains marker before exporting (anti-injection) - Write prior review body to temp file to avoid E2BIG on large reviews - Remove dead SONNET_RC=$? variable; add || true for set -e safety - Delete orphaned prompts/council/ files (no longer referenced by cascade) - Fix incremental-mode compare command: document how to derive owner/repo from headRepository metadata Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add Claude Code workflow (#8) Implement the org-level reusable workflow caller pattern from petry-projects/.github. This thin caller delegates all logic to claude-code-reusable.yml and triggers on PR events, issue comments, and labeled issues. Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * feat: add Copilot engine support via REVIEW_ENGINE toggle (#5) * feat: add Copilot engine support via REVIEW_ENGINE toggle Abstract LLM invocation into scripts/engine.sh so both Claude and Copilot engines use the same cascade logic, prompts, and actions — just different CLIs and model families. Key changes: - scripts/engine.sh: new LLM abstraction layer with run_triage/run_agentic dispatching to claude or copilot CLI based on REVIEW_ENGINE variable - scripts/review-one-pr.sh: refactored to source engine.sh, engine-agnostic variable names (DELEGATION_ORGS, AI_DELEGATION_ENABLED, DEEP/AUDIT tiers) - All prompts updated: engine-agnostic tier names, ENGINE_LABEL footers, removed hardcoded model names from prose - Workflow: conditional CLI install, REVIEW_ENGINE/COPILOT_GITHUB_TOKEN vars, DELEGATION_ORGS with CLAUDE_ORGS backward compat fallback - AGENT.md/README.md: documented both engine options and setup Model mapping: Triage: Haiku 4.5 / GPT-5-mini Deep: Sonnet 4.6 / GPT-5.2 Audit: Opus 4.6 / GPT-5.4 Action: Sonnet/Opus / GPT-5.2/5.4 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update prompts/cascade-action.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update prompts/cascade-action.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: address PR review comments - Fix Copilot CLI install to use gh extension instead of npm - Replace speculative GPT-5 models with verified identifiers (gpt-4o-mini, o1, o1-pro) - Fix cascade-action.md deprecated alias to reference CLAUDE_ENABLED - Change 'Claude delegation' to 'AI delegation' in synthesize.md - Add triage-approved to mode schema in single-review.md - Align log label with JSON field in review-one-pr.sh - Remove unused SMALL_PR_THRESHOLD from workflow - Add $OUTPUT_FILE to inputs in deep-review.md and security-audit.md Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * feat: update to latest GPT-5 models for Copilot engine - Use gpt-5-mini for triage (lightweight, faster) - Use gpt-5.2 for deep review and action (improved reasoning) - Use gpt-5.4 for security audit and single reviewer (most advanced) Based on latest GitHub Copilot model support in 2025-2026. Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> * feat: inline Claude Code workflow to access repo secrets directly (#9) Replaces the thin org-level reusable workflow caller with the full inlined workflow so CLAUDE_CODE_OAUTH_TOKEN and GH_PAT_WORKFLOWS can be accessed from this repo's own secrets. Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: cross-engine adversarial rubber duck review (#11) * feat: add cross-engine adversarial "rubber duck" review to PR cascade At tier 2, the deep review now runs in parallel with an adversarial "rubber duck" reviewer from the opposite engine (Claude↔Copilot). A synthesis step merges both verdicts before deciding to approve or escalate. Different model families catch different blind spots — this approach closes ~75% of the performance gap between tiers. Graceful degradation: if the rubber duck fails (missing creds, CLI unavailable), the cascade continues with the primary review only. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address rubber duck review findings and Copilot comments - Strip opposing engine credentials in run_duck to prevent cross-engine secret leakage (CLAUDE_CODE_OAUTH_TOKEN/COPILOT_GITHUB_TOKEN) - Add timeout 300 to both duck CLI paths to prevent hangs - Add $OUTPUT_FILE to rubber-duck.md inputs section - Add TIER2_RESULT alias at tier 3 handoff (documents combined vs deep) - Fail fast on primary CLI install; || true only for duck engine - Add default/error branch to run_duck case statement - Fix final_risk → risk terminology in synthesize-duck.md - Add explicit severity bump mapping (info→minor, minor→major) - Set DUCK_VALID=false on synthesis fallback for accurate FINAL_TIER - Kill duck process early if deep review fails to avoid wasted latency Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: filter already-reviewed PRs from backlog to unblock queue * docs: clarify PR review batching issue * fix: complete PR #10 fix - don't count no-ops toward MAX_PRS budget The review-one-pr.sh script already exits with code 100 for no-ops, but the workflow was counting them toward MAX_PRS budget. Now: - Review loop processes ALL candidates (not truncated to MAX_PRS) - Only non-no-op PRs count toward the MAX_PRS budget - Loop stops after MAX_PRS actual reviews are posted - This unblocks the backlog from being stuck on already-reviewed PRs Fixes #7 (completes PR #10) * feat: CI gate + poll-loop rebase wait across all review prompts (#14) * feat: CI gate + poll-loop rebase wait across all review prompts 1. CI gate (review-one-pr.sh step 1b): skip PRs with failing or in-progress checks before spending any LLM tokens. Exits with code 100 (no-op sentinel) so skipped PRs don't count against the MAX_PRS budget. Empty statusCheckRollup (no CI) is treated as passing. 2. Poll loop (cascade-action, single-review, synthesize): replace the fixed sleep with a bounded poll (6×5 s) that exits as soon as mergeStateStatus is no longer BEHIND, eliminating the race between update-branch and the subsequent auto-merge call. 3. Triage cleanup: remove the now-redundant "no failing CI" criterion since failing-CI PRs are blocked by the shell gate before triage runs. Renumber remaining criteria. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address Copilot review comments + document bot account setup review-one-pr.sh: - Combine headRefOid + statusCheckRollup into a single gh pr view call to reduce API calls and rate-limit exposure - Tighten CI classification to strict-success: pending check first, then require ALL items to be SUCCESS/passing — any other conclusion (NEUTRAL, SKIPPED, STALE, STARTUP_FAILURE, etc.) now counts as failing rather than silently passing through - Clarify exit-code 100 comment to reflect its broader "skip sentinel" meaning (already-reviewed, ci-failing, ci-pending) prompts (cascade-action, single-review, synthesize): - Initialise REBASE_STATUS="BEHIND" before the poll loop so the variable is always set; add explicit post-loop guard — if still BEHIND after 30s, skip auto-merge entirely and let the next cycle retry AGENT.md: - Document the reviewer identity constraint (self-approval is blocked) - Add step-by-step bot account creation and classic PAT setup instructions - Renumber existing setup steps 2→3, 3→4, 4→5 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: filter failing/pending CI PRs at enumeration stage in list-prs.sh Add --checks passing to both gh search prs queries so PRs with failing or in-progress CI never enter the candidate pool. Previously they were fetched, consumed a CANDIDATE_LIMIT slot, and only skipped once review-one-pr.sh ran the per-PR CI gate. Two-layer defence now: 1. list-prs.sh — --checks passing excludes them from the candidate list 2. review-one-pr.sh — strict jq CI gate catches anything that slips through (e.g. PRs passed via PR_URL_OVERRIDE) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: treat SKIPPED/NEUTRAL CI conclusions as passing; drop admin:org scope review-one-pr.sh: - Extend is_success to include SKIPPED and NEUTRAL conclusions alongside SUCCESS. SKIPPED covers path-filtered workflow jobs (e.g. claude-issue skips on non-issue events); NEUTRAL covers informational checks that don't gate merging. Both were previously falling through to "failing", permanently blocking review of any PR with a skipped check. AGENT.md: - Remove admin:org from the bot PAT scope recommendation. The scope is not needed for PR approval or auto-merge — repo scope is sufficient. admin:org grants full org administration (member management, billing, team settings) which is excessive blast radius for a review bot token. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: replace --checks passing with --checks success in list-prs.sh (#15) GitHub CLI changed the valid values for `gh search prs --checks` from accepting "passing" to only allowing {pending|success|failure}. All workflow runs have been failing since this change with: invalid argument "passing" for "--checks" flag: valid values are {pending|success|failure} "success" is semantically identical to the old "passing" — it filters to PRs where all CI checks have completed with a passing status. Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: update repo references from self to pr-review-agent * feat: add car-hunt skill for used vehicle research and ranking CPM-based (cost per remaining mile) ranking of Honda/Toyota listings across AutoTrader, CarGurus, and Facebook Marketplace. Includes live reliability research step (Consumer Reports, JD Power, RepairPal, CarComplaints) before searching, NHTSA recall/complaint API deep-dive, and optional Google Sheet write-back. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: fix FB Marketplace links, improve AutoTrader fetch, add Sheets export step - AutoTrader: stop trying to WebFetch JS-rendered search pages; use WebSearch site:autotrader.com to find individual listing URLs, then WebFetch those (they have real HTML data) - FB Marketplace: never output generic placeholder links; use real item URLs if Google indexes them, otherwise surface a manual search URL and one placeholder row explaining why - Step 6: document CSV→Sheets export via Drive MCP create_file, including base64 encoding, column format, and share URL construction Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: add Craigslist as explicit source, enforce real-URL-only link rule - Add Craigslist section with regional sites (bham, huntsville, chattanooga, atlanta), correct search URL pattern with sort/filter params, and WebFetch approach (CL uses plain HTML, works reliably) - Link integrity rule: every Link column value must be a real listing URL from WebFetch/WebSearch or a manual search URL clearly labeled — never a homepage, never a constructed/guessed URL - Update WebSearch fallback section to cover all sources uniformly Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: split zip/radius questions, rename MAX_MILES to MAX_ODOMETER Question 4 was ambiguous — users confused "Max miles?" (meant odometer) with search radius. Now asks zip and radius as separate questions (#4 and #5) and renames the variable to MAX_ODOMETER with explicit "(highest mileage on the car itself)" clarification. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: include self-authored PRs awaiting review in agent enumeration (#16) * fix: fix Craigslist link approach, add date_posted with 21-day staleness filter Craigslist search pages are JS-gated so WebFetch fails; switch to WebSearch (site:craigslist.org) as primary approach, with direct URL as fallback. Add date_posted field to every listing and drop any listing posted more than 21 days ago as likely-sold. Also fix MAX_MILES → MAX_ODOMETER in the Craigslist search URL template. Add Posted column to ranked table and Step 6 sheet schema. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: include self-authored PRs awaiting review in agent enumeration Remove --checks success filter from authored PR search to include PRs that require code review (e.g., compliance fixes). CI validation still occurs per-PR in review-one-pr.sh as a second layer of defence. This enables the review agent to detect and approve self-authored PRs that are blocked by review requirements but have passing CI checks. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add doors/transmission fields, update-mode sheet, fix CarGurus/Craigslist approach - Fix CarGurus URL section: direct URL pattern 404s, switch to WebSearch-first approach - Fix Craigslist primary: regional page WebFetch with pagination (was site: WebSearch which returns category pages) - Add doors (2/4) and transmission (Auto/Manual) to data extraction, output table, and sheet schema - Add exhaustive coverage mandate: paginate all sources, never stop early, report coverage in output - Add AutoTrader outage handling: note 503 in summary, fall back to WebSearch cache - Add update mode for Step 6: single persistent sheet, deduplicate by URL, mark stale listings - Update sheet columns to include Doors/Trans; fix MIME type note (text/csv only, not xlsx) - Update scheduling defaults: ZIP=35243, RADIUS=200, MAX_PRICE=6000, YEAR_MIN=2002, MAX_ODOMETER=250000 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add hard disqualification filters for finance-speak, title issues, and scam signals Skip any listing mentioning down/monthly payments, no title/lien/salvage, or scam contact redirects (broken messenger, email-only, urgency pricing). Log disqualified listings separately rather than silently dropping them. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add Distance to Car field using Nominatim geocoding + Haversine formula Geocode user ZIP and each listing city via free Nominatim API (no key needed), compute straight-line distance × 1.3 road correction factor, display as "~X mi" in output table (Dist column) and sheet schema. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address low result count — batch URL extraction, preview-filter before fetch, target 50+ raw Score candidates from search-page preview data first to avoid fetching every listing page; only deep-fetch those passing price/mileage preview. Clarifies why ~15 results was happening and mandates 50+ raw candidates. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: make cascade-action prompt explicit about gh pr review --approve The agent was posting comments instead of approval reviews because the prompt was too high-level. Rewritten step 5 to contain explicit bash code blocks that the agent can directly execute, with clear use of: - gh pr review --approve (not gh pr comment) - Proper body passing via temp file to handle newlines/special chars - Explicit variable extraction and idempotency checks This ensures the review posts as an APPROVED review, not a COMMENTED review, so GitHub branch protection recognizes it and auto-merge triggers. * improve: make cascade-action body composition and escalation more explicit - Fix variable expansion in escalation comment by using COMMENT_END instead of 'COMMENT' - Make step 4 explicit with bash code that extracts JSON fields and builds body - Handle findings array iteration and formatting with jq - Support cross-engine agreement section only when tier is deep+duck - Use temp file for comment composition to handle variables correctly * refactor: move review posting logic from agent prompts to bash script This addresses the critical issue where the agent was posting comments instead of approval reviews. Instead of relying on the agent to execute bash commands correctly, we now: 1. Have the agent generate only the verdict JSON with the review body 2. Use a new post-pr-review.sh script to handle all GitHub interactions 3. This removes the ambiguity about whether to post as review or comment Changes: - New scripts/post-pr-review.sh: handles review posting, rebasing, auto-merge, labels - Simplify cascade-action.md: agent just outputs verdict JSON, doesn't post - Simplify single-review.md: agent just outputs verdict JSON, doesn't post - Update review-one-pr.sh: capture verdict JSON and call post-pr-review.sh The verdict JSON includes the complete review body, so the agent can still compose the full markdown review. The bash script handles all GitHub interactions (posting reviews, enabling auto-merge, managing labels). This is more reliable because bash + gh CLI is deterministic, while agent behavior is less predictable. * add: cleanup script to fix PRs with comment approvals instead of review approvals Script identifies PRs that have the agent's marker comment but no actual approval reviews (symptom of the original bug), and posts proper approval reviews + enables auto-merge. Usage: bash scripts/fix-stuck-prs.sh [dry_run=true|false] * fix: cleanup script now requires bot account token GitHub blocks self-approvals, so cleanup must run with the bot account's GH_TOKEN (petry-review-bot), not the PR author's token. * add: workflow to fix stuck PRs using bot account token Allows running the cleanup script via workflow_dispatch with access to GH_PAT (bot account token) from repo secrets. * fix: pass GH_PAT to checkout action so workflow uses bot account * debug: simplify account check, add authentication debug output * docs: add comprehensive petry-review-bot setup instructions * docs: add GitHub App setup guide (recommended approach) GitHub App is the secure, recommended way to automate PR reviews: - Fine-grained permissions - JWT tokens that auto-expire - No human account needed - Better audit trail - GitHub's recommended approach Replaces the bot user account approach with a more secure alternative. * docs: add comprehensive GitHub App setup documentation - SETUP.md: Quick reference guide with configuration and troubleshooting - IMPLEMENTATION.md: Technical deep dive on architecture and design decisions - DOCUMENTATION.md: Index of all documentation files - Updated README.md with status and quick links - Updated GITHUB_APP_SETUP.md with implementation notes and actual app ID - Workflows use GitHub App token generation instead of static PATs Covers the transition from bot user account to GitHub App authentication for improved security and maintainability. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: silence auth check in fix-stuck-prs when using GitHub App token GitHub App tokens don't have user scope, so 'gh api user' returns 403. This is fine - the script still works for PR operations. Suppress the error so the script completes successfully with app-token fallback label. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: use explicit author instead of @me in stuck PR search GitHub App tokens don't have user identity, so @me search doesn't work. Use explicit 'don-petry' author instead to find PRs to fix. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: avoid subshell in while loop to preserve variable state Using pipe in while loop created subshell where PROBLEM_PRS and FIXED_PRS counters were incremented but changes didn't persist to parent shell. Fixed by using process substitution for input instead of pipe. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * docs: add comprehensive status report for GitHub App setup - Overview of completed work - GitHub App authentication details - 24 stuck PRs successfully fixed with approval reviews - Architectural decisions and rationale - Configuration guide and usage examples - Known limitations and troubleshooting System is now fully operational with GitHub App token authentication, comprehensive documentation, and all infrastructure in place. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * docs: document stuck PR cleanup status and script fixes Added documentation for: - GitHub App token compatibility fixes in fix-stuck-prs.sh * Changed @me to explicit author (app tokens have no identity) * Fixed subshell variable scope (process substitution vs pipe) * Silenced expected 403 auth check error - Current status: 24 PRs have approvals but remain OPEN * Auto-merge failed due to missing GitHub App permission * Approvals satisfy branch protection requirement * Next: expand permissions or manually merge Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: update list-prs.sh to search all repos by owner instead of @me GitHub App tokens don't have user identity, so @me/@review-requested searches fail. Changed to enumerate all repos in don-petry and petry-projects, then search for open PRs within each repo. This covers the full scope: - All open PRs in personal don-petry repos - All open PRs in petry-projects org repos Resolves 6 consecutive workflow failures due to zero PRs being enumerated. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * docs: add investigation report for PR review agent workflow failures * fix: move env section before steps in workflow to fix YAML structure GitHub Actions requires env section to come before steps in job definition. Moving env definition up and setting GH_TOKEN only in steps that need it. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * script: add backfill-approvals to retroactively apply real approvals Converts PRs with agent approval comments (but no real GitHub approvals) to have actual APPROVED reviews. Needed for PRs reviewed before the gh pr review --approve fix was applied. Usage: scripts/backfill-approvals.sh # dry-run (preview changes) scripts/backfill-approvals.sh false # apply real approvals Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * feat: add backfill-approvals workflow to run as GitHub App bot Runs backfill-approvals.sh via GitHub Actions so the approvals are posted by the bot identity, not the PR author — GitHub rejects self-approvals. Also fixes subshell counter bug in the script (piped while loop lost variable state; switched to process substitution). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: convert inner while loop to process substitution to preserve counters Both the outer repo loop and inner PR loop were piped subshells, causing all counter increments (approved/skipped/failed) to be lost. The summary always showed 0. Fixed by using < <(...) process substitution for both loops. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * car-hunt: add VIN-deep-dive flow, printable checklists, location-tier ranking - Step 5.5 pre-test-drive flow: NHTSA VIN decode + per-VIN unrepaired-recall automation via Chrome MCP (Honda LWC owner portal documented as not automatable; NHTSA web form works). - §F printable test-drive checklist generator (reportlab/Platypus PDF) with cold-start, model-specific red flags, negotiation table, walk-away rules. - §G fraud / paperwork verification checklist (vehicle-agnostic, reusable): walk-away triggers, VIN three-location match, curbstoning, odometer fraud, bill of sale, title transfer, payment protection, stolen-vehicle, title- jumping, after-purchase steps. - Step 5.25 head-to-head comparison template with information-asymmetry rule. - Step 3 Location Quality Tier scoring (Birmingham AL metro table A/B/C/D) with adj-CPM modifier; sheet schema gains Adj.CPM + Tier columns. - Hard-disqualification rules added: non-running engine keywords, mileage inconsistency, mandatory description scrape. - Drive MCP overwrite limitation documented; sheet ID now read from memory rather than hardcoded. - FB Marketplace operational facts: Birmingham AL city ID 107739635926718, /search? vs /vehicles? query handling, React-controlled inline composer, send-button selector, seller-name extraction regex. - scheduled-tasks/used-car-search-{morning,afternoon}: tier A/B priority flag, sheet ID read from memory. - Reference PDF generator scripts checked in for reuse. * fix: re-approve PRs where approval predates last commit (stale approval) Instead of skipping PRs that already have any APPROVED review, skip only those where reviewDecision is not REVIEW_REQUIRED. This handles PRs where a bot approval was posted before a new commit was pushed — GitHub's ruleset engine treats those approvals as stale even with dismiss_stale_reviews=false. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: robustly extract JSON verdict from mixed claude --print output (#17) Claude's --print mode can prefix the JSON verdict with conversational preamble text, causing jq to fail with parse errors. Add extract_verdict_json to engine.sh and wire all three cascade action call sites in review-one-pr.sh to use it. Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * fix: extract_verdict_json — check dest file first (agent Bash-write style) The cascade-action agent writes its verdict JSON to \$OUTPUT_FILE via a Bash tool call, then prints a text summary to stdout. The previous fix only scanned stdout (the .raw file), which contained no JSON. The agent- written file at \$dest (= \$OUTPUT_FILE) was already correct — just not checked. Now check \$dest first before falling back to stdout scan. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Enforce MAX_REVIEW_CYCLES cap before running the cascade (#18) * fix: enforce MAX_REVIEW_CYCLES cap with human-escalation marker Previously MAX_REVIEW_CYCLES only gated AI delegation in post-pr-review.sh — the cascade itself ran on every cron tick regardless of how many cycles had accumulated. Real-world result: a PR could rack up 9+ review cycles (we observed exactly that on ContentTwin#100) before any cap took effect. Add a pre-cascade check in review-one-pr.sh: when the count of existing `` markers is at or above MAX_REVIEW_CYCLES (default 3), post one escalation comment marked ``, label needs-human-review, request don-petry, and exit 100 (skip sentinel — doesn't burn the MAX_PRS budget). The escalation marker doubles as the no-spam guard: subsequent runs detect it and exit 100 immediately. Also reuse a single `gh pr view` for both the cycle count and the escalation-marker check. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * review feedback: surface escalation-comment failures, drop dead unset - Drop `2>/dev/null || true` on `gh pr comment` so a failed escalation post is visible in the workflow log instead of silently leaving the PR with no marker (which would re-trigger the cap path next tick). - Reword the cycle-count comment from "AI delegation loops" to "review loops" — the cap also catches cascade-only loops where every cycle approves and a new commit lands before merge. - Remove the redundant `unset PR_BODIES` — never exported, no leakage. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * Reliability hardening: session circuit breaker, timeouts, retry, dedup (#20) * feat: session circuit breaker, per-tier timeouts, retry, and triage hard-fail Reliability hardening for the PR review agent. 1. Session circuit breaker (.github/workflows/pr-review.yml): on any non-zero, non-100 exit from review-one-pr.sh (general failure or rate limit on the fallback engine), break the per-PR loop, log a clear error annotation naming the failing PR and reason, and exit the step with code 1 so the run shows red. Prevents one systemic problem from silently burning the entire candidate pool. 2. Per-tier timeouts (scripts/engine.sh): triage/deep/audit/action/duck each get their own bounded timeout (180/600/600/300/300s defaults, env-overridable). Previously only the duck had a timeout — a hung tier could burn the whole 60min job budget. 3. Retry-with-backoff on transient errors (scripts/engine.sh): triage retries once on 124/137/143 (timeout / signal kill) since its caller captures stdout via $(...) so retries are safe. Deliberately NOT applied to run_agentic/run_duck where stdout is redirected to a file — a retry there would corrupt the partial first-attempt output. 4. Triage non-JSON now hard-fails (scripts/review-one-pr.sh): replaces the silent fallback that synthesized a fake "escalate=MEDIUM" verdict and proceeded to deep review. With the new circuit breaker, loud failure is the right call — masking a broken triage was burning tokens on every PR while the workflow looked healthy. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: stop stacking duplicate agent reviews on the same PR Two bugs were causing the agent to leave multiple comments on the same PR. Together they produced 10 stacked APPROVED reviews on petry-projects/ContentTwin#100. Bug A — idempotency check is order-dependent (review-one-pr.sh): The previous marker-discovery code did: ((.reviews // []) + (.comments // [])) | .[].body | grep marker | tail -1 This relies on the array concatenation order, not chronological order. When old agent comments existed alongside newer agent reviews, tail -1 picked the comment-array marker (older) over the review-array marker (newer), causing the script to think the head SHA hadn't been reviewed and re-run. Replaced with a single jq pipeline that tags each item with submittedAt / createdAt, sorts by timestamp, and takes the actual most-recent marker. Bug B — no cleanup of prior agent items (post-pr-review.sh): After successfully posting a new review/comment, prior agent items were left in place, accumulating forever. Added mark_prior_agent_items_obsolete which, after a successful post: - dismisses prior APPROVED/COMMENTED/CHANGES_REQUESTED agent reviews via the GitHub dismissal API (UI shows them struck-through as Dismissed) - edits prior agent comments to wrap their body in a collapsed <details> block with a "Superseded by re-review at <SHA>" summary, plus a `` sentinel for idempotency All cleanup API calls are best-effort — failures don't break the workflow. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(cleanup): warn on API failures, preserve global newest, file-stage JSON Three fixes to mark_prior_agent_items_obsolete from the review of PR #20: 1. ::warning:: annotations on every cleanup API failure (review/comment list-fetch, individual review dismissal, individual comment fetch+edit). Previously these were silenced with `|| true`, so a permissions change on the dismissal endpoint would let duplicates stack indefinitely with no signal in the Actions UI. Cleanup is still non-fatal — the new post has already landed — but failures are now visible. 2. Preserve the globally-latest agent item across BOTH categories, not the newest of each category separately. The earlier code split reviews and comments and applied `[:-1]` to each, which left a stale fix-request comment in place when the new post was a review (or vice versa). The one-off cleanup of ContentTwin#100 hit exactly this case: 12 stacked reviews collapsed to 1, but a stale comment from 2026-04-25 (SHA cd9132d6) was preserved as "newest comment" even though the latest review at SHA 3af8c8ee was newer overall. Now: compute the max timestamp across both feeds, exclude items at that timestamp. 3. Stage API responses to disk (`mktemp` + `jq <file>`) instead of routing through `--argjson "$var"`. The old approach broke on rare unescaped control chars in user-authored comment bodies (jq refused to parse the resulting shell-vared JSON). File-based input sidesteps the shell pipeline entirely. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * Remove car-hunt skill and scheduled tasks (moved to don-petry/don-petry) (#21) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: apply Copilot fallback hardening and reuse GH_PAT for Copilot auth - Use secrets.GH_PAT (existing personal account token with Copilot subscription) instead of a separate COPILOT_GITHUB_TOKEN secret - Pin actions/create-github-app-token to SHA (v3.1.1) for supply chain safety - Add post-install verification for gh-copilot extension with warning on failure - Guard Copilot fallback path: skip PR gracefully if extension is not installed Addresses issue #24 workflow fixes (1-3) that could not land via PR #25 due to GitHub App lacking workflows permission. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: switch Copilot engine to gh built-in and fix app-id deprecation - Remove gh extension install (github/gh-copilot conflicts with built-in alias) - Replace with gh copilot --version check using COPILOT_GITHUB_TOKEN (GH_PAT) - Update all engine.sh copilot invocations from bare `copilot` binary to `gh copilot suggest --target shell` with GH_TOKEN overridden to GH_PAT so the user token (with Copilot subscription) is used, not the App token - Fix actions/create-github-app-token: app-id → client-id (same secret value, just the renamed input in v3.x) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: harden Copilot fallback path and remove stale worktrees (#25) - gh-copilot install: add --force flag and post-install verification warning so silent failures due to built-in alias conflict are visible in workflow logs instead of being silently swallowed by `|| true` - fallback pre-flight check: verify `gh extension list | grep copilot` before switching to Copilot engine; if unavailable, skip the PR and continue the batch rather than session-aborting and dropping all remaining candidates (fixes the 27-PR drop on run #503) - pin actions/create-github-app-token to SHA for v3.1.1 (Node.js 24 compatible) to prevent hard break on 2026-06-02 when GitHub forces Node.js 24 as default runtime - remove 6 stale Claude Code worktrees from git tracking; add .gitignore entry to prevent future worktrees from being committed (eliminates exit-128 warning on every actions/checkout post-job sweep) Closes #24 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: petry-projects-pr-review-agent[bot] <petry-projects-pr-review-agent[bot]@users.noreply.github.com> * ci: add pre-flight dedup check to prevent duplicate claude-issue PRs (#26) Before invoking Claude on a labeled issue, a new shell step queries for any open PR with a branch matching claude/issue-NNN-* (or a body containing "Closes #NNN"). If one is found it posts a comment on the issue pointing to the existing PR and skips the Claude step entirely. A secondary prompt instruction tells Claude to check first and push to the existing branch rather than opening a new PR. Motivated by issue petry-projects/google-app-scripts#171, where the claude label was re-applied three times and each run created a fresh PR unaware of the prior attempts. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor: migrate to machine user PAT auth (closes #27) (#28) * refactor: migrate from GitHub App to machine user PAT auth Closes #27 GitHub Apps cannot be listed in CODEOWNERS, blocking PRs in repos with require_code_owner_review: true. Switch all workflows to use a machine user account's fine-grained PAT (DON_PETRY_BOT_GH_PAT secret), which can join an org team listed in CODEOWNERS. Workflows: removed actions/create-github-app-token steps in pr-review, fix-stuck-prs, backfill-approvals, and daily-pr-review-health. All now use secrets.DON_PETRY_BOT_GH_PAT directly. Docs: renamed GITHUB_APP_SETUP.md to MACHINE_USER_SETUP.md with full rewrite covering account creation, CODEOWNERS config, PAT generation, and rotation. Updated auth sections in IMPLEMENTATION.md, SETUP.md, STATUS.md, DOCUMENTATION.md, README.md. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor: switch to org-scoped PAT secret DON_PETRY_BOT_PETRY_PROJECT_PAT Replace DON_PETRY_BOT_GH_PAT with DON_PETRY_BOT_PETRY_PROJECT_PAT — the new fine-grained PAT scoped to the petry-projects org (resource owner = petry-projects). The previous PAT was scoped to the donpetry-bot personal namespace and had no repository access. The old DON_PETRY_BOT_GH_PAT secret is retained for any future use against don-petry's personal repos. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore: ignore .claude/scheduled_tasks.lock state file --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * refactor: merge approval repair scripts into single automation - Consolidate backfill-approvals.sh and fix-stuck-prs.sh into repair-pr-approvals.sh - Iterate all repos in both orgs instead of assuming author - Verify no existing APPROVED review before posting - Copy original agent comment as review body - Enable auto-merge when posting approval if needed - Single workflow with 30-min timeout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add @mention trigger for on-demand PR reviews (#30) Adds repository_dispatch support so commenting @petry-review-bot on any PR fires an immediate review without waiting for the hourly schedule. - pr-review.yml: new `repository_dispatch` trigger (type: pr-review-mention), per-PR concurrency group for mention runs, FORCE_REVIEW and DRY_RUN env vars that handle both workflow_dispatch and repository_dispatch paths - review-one-pr.sh: FORCE_REVIEW=true bypasses idempotency so a mention always runs a fresh cascade even if the head SHA hasn't changed - templates/mention-listener.yml: deploy to petry-projects/.github; listens for @petry-review-bot, validates commenter trust, posts ack, sends repository_dispatch (requires Contents:write, not Actions:write) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: harden rebase, review dismissal, and health log diagnostics (#40) Addresses 4 code-actionable recommendations from health check report #33: - [CRITICAL] Make rebase/branch-update non-fatal — 403/504 during rebase emits ::warning:: instead of aborting the batch session (#34) - [MEDIUM] Add retry with exponential backoff (3 attempts) for transient 5xx on update-branch API; break immediately on 4xx (#37) - [MEDIUM] Guard review dismissal with state re-check before calling dismiss API, preventing 422s from race conditions (#38) - [LOW] Surface missing log warnings in health check script (#39) - Fix: skip auto-merge when branch is still BEHIND after failed rebase Closes #34, closes #37, closes #38, closes #39 * refactor: migrate to org-wide .github-private convention (#41) * refactor: parametrize hardcoded identity values for org migration Replace all hardcoded references to don-petry, petry-review-bot, and don-petry/pr-review-agent with environment variables that default to the current values. This allows the agent to be configured for different orgs/users via repo variables. Changes: - Scripts use $REVIEWER_USER, $TARGET_ORG, $BOT_USER, $AGENT_REPO - Prompts no longer reference specific GitHub usernames - Workflows use org-level GH_PAT_WORKFLOWS secret instead of repo-level DON_PETRY_BOT_PETRY_PROJECT_PAT - Health check uses context.repo.owner/repo for issue creation - Variables are set in workflow env block with defaults Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: add Copilot custom agent profiles for org-wide use Create /agents/ directory with three agent profiles: - pr-reviewer: Multi-tier cascading PR review - feature-ideator: Feature idea generation and prioritization - compliance-auditor: Org standards compliance checking These are Copilot custom agent profiles that become available org-wide in the .github-private repo convention. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Squashed 'frameworks/bmad-method/' content from commit e36f219c git-subtree-dir: frameworks/bmad-method git-subtree-split: e36f219c81b6010d4aae423ba12f49edb5b6e31a * Squashed 'frameworks/spec-kit/' content from commit 11f49ebf git-subtree-dir: frameworks/spec-kit git-subtree-split: 11f49ebfb2f6af55345cb4bd9a7906acd211e56f * Squashed 'frameworks/gsd/' content from commit 304c1a13 git-subtree-dir: frameworks/gsd git-subtree-split: 304c1a1302564c45af252bbba4bcc5350e7dac3a * docs: update README for .github-private org infrastructure role Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * ci: add dependabot-automerge.yml workflow (#73) Adds the required dependabot-automerge.yml workflow from the org standard template (petry-projects/.github/standards/workflows/). This is a thin caller stub that delegates to the org-level reusable workflow. Closes #48 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * fix(pr-review): unblock queue starvation from self-authored PRs (#96) (#97) * fix(pr-review): unblock queue starvation from self-authored PRs (#96) A self-authored PR sorted first in the candidate list and triggered "Can not approve your own pull request" — which the session-fatal abort treated like an engine error, skipping all 28 remaining PRs on every run. - list-prs.sh: filter out PRs authored by REVIEWER_USER at enumeration - post-pr-review.sh: catch the GraphQL self-approval error and exit 100 (no-op) instead of 1, so a stray self-PR can no longer abort the batch - engine.sh: gh copilot renamed --target to --agent; fix the rubber-duck invocations so tier-2 cross-engine review works again - review-one-pr.sh: stop appending a duplicate "0" to REVIEW_CYCLE when grep -c finds no markers under set -o pipefail (was breaking the cycle-cap integer comparison) https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * fix(pr-review): authenticate as bot, harden enumeration, address review - Workflow now runs as AGENT_USER (default don-petry-bot), distinct from REVIEWER_USER (the human, don-petry). The self-approval rejection that caused #96 came from the agent and the human sharing one identity. - list-prs.sh filters self-authored PRs against AGENT_USER, and validates AGENT_USER against the GitHub username charset before interpolating into the jq filter (Copilot review feedback). - review-one-pr.sh uses printf '%s\n' instead of echo for PR_BODIES, since PR body content is user-authored and could begin with -n/-e or contain backslash escapes (Copilot review feedback). - AGENT.md guideline updated to reflect that self-authored PRs are intentionally excluded (CodeRabbit review feedback). Operator note: rotate the GH_PAT_WORKFLOWS secret to a token owned by don-petry-bot (with read:org added) for the bot-account behavior to take effect at runtime. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * refactor(pr-review): collapse to single BOT_USER, route escalations via CODEOWNERS Drop AGENT_USER and REVIEWER_USER. The workflow now has one identity: BOT_USER (default don-petry-bot), which both owns the repos to scan and gets filtered out as the self-approval blocker. Human escalation no longer hard-codes a single reviewer; instead, scripts/request-codeowners- review.sh parses CODEOWNERS in the PR's repo and requests review from every @user / @org/team mention. - list-prs.sh: BOT_USER for both gh-repo-list and self-author filter - review-one-pr.sh, post-pr-review.sh: replace --user "$REVIEWER_USER" with the CODEOWNERS helper - repair-pr-approvals.sh: same gh-repo-list switch - pr-review.yml: drop AGENT_USER/REVIEWER_USER, set BOT_USER default to don-petry-bot - AGENT.md: updated guideline to describe single-identity model https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * refactor(pr-review): extract batch loop, hoist env, drop redundant step Workflow YAML drops from 231 to 111 lines by moving the per-PR review loop into scripts/review-batch.sh. The script can be syntax-checked and exercised locally; the workflow now just wires env vars and dispatches. - Hoist GH_TOKEN, MAX_PRS, CANDIDATE_LIMIT to job-level env (were repeated on individual steps). - Inline `gh auth status` into the install step; remove the standalone Verify auth step (its only output was a one-line auth dump). - Drop the `if: steps.list.outputs.count != '0'` guard and the step's `id`/output: review-batch.sh handles empty input as a no-op. - Collapse the duplicated summary-string branch in the review loop into a single template with a conditional fragment. No behavior change. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * perf(pr-review): cache claude-code CLI install across runs `npm install -g @anthropic-ai/claude-code` ran on every workflow start (~30s). Switch to a per-user npm prefix (~/.npm-global) and cache that directory via actions/cache, keyed on CLAUDE_CODE_VERSION + runner OS. A `command -v claude` guard makes the install a no-op on cache hit, so the only cost on subsequent runs is the cache restore. CLAUDE_CODE_VERSION defaults to 'latest' (cache persists until manually flushed); set the repo variable to pin a specific version for fully reproducible caching. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig --------- Co-authored-by: Claude <noreply@anthropic.com> * chore: rename GH_PAT_WORKFLOWS secret to DON_PETRY_BOT_GH_PAT (#99) The previous name was generic and didn't tell you which account the PAT belonged to. The new name makes the binding explicit: this secret is the PAT owned by don-petry-bot, used as BOT_USER throughout the PR-review workflows. Operator follow-up before this can be merged: - Add a new repo secret DON_PETRY_BOT_GH_PAT containing the bot's PAT (with repo, workflow, and read:org scopes). - After merge, the old GH_PAT_WORKFLOWS secret can be deleted. Affected workflows: - pr-review.yml (1 use) - claude.yml (4 uses, with || github.token fallback) - daily-pr-review-health.yml (1 use) - repair-pr-approvals.yml (1 use) scripts/pr_review_health.sh's error message is updated to point at the new name as well. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig Co-authored-by: Claude <noreply@anthropic.com> * chore: remove frameworks directory (#101) Co-authored-by: Gemini CLI <gemini-cli@example.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore all erroneously deleted files (items 4-34) (#104) * revert: restore .github/workflows/daily-pr-review-health.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore .github/workflows/repair-pr-approvals.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore agents/pr-reviewer.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/cascade-action.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/deep-review.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/rubber-duck.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/security-audit.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/shared.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/single-review.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/synthesize-duck.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/synthesize.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/triage.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/engine.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/list-prs.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/post-pr-review.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/pr_review_health.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/repair-pr-approvals.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/request-codeowners-review.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/review-batch.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/review-one-pr.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore templates/mention-listener.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore AGENT.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore BOT_SETUP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore DOCUMENTATION.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore IMPLEMENTATION.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore MACHINE_USER_SETUP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore PR_REVIEW_AGENT_FAILURE_REPORT.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore PR_REVIEW_FAILURE_INVESTIGATION.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore SETUP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore STATUS.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore README.md to pre-change state Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore .github/workflows/daily-pr-review-health.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat: add Gemini Pro support and optimize PR review fallback chain (#102) * Merge main and resolve conflicts * Enhance pr-review workflow: add Gemini support and refactor fallback logic * Address Copilot review comments: tighten regex, fix fallback summary, and align docs * docs: move agent documentation to docs/ folder and rename files * docs: align secret names and fix casing in index * docs: organize pr-review-agent documentation under dedicated folder * Address final PR comments: tighten regex, add preflight checks, fix bot names, and cleanup docs --------- Co-authored-by: Gemini CLI <gemini-cli@example.com> * fix(pr-review): gate rate-limit detection on non-zero exit code Broad patterns like `plan.*limit` and `claude.*usage` could match content in a successful triage summary, triggering a false-positive engine fallback. Guard the check with TRIAGE_RC != 0 so it only fires when the provider command actually failed. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix(claude): sync inlined workflow with org standard (#109) * fix(claude): sync inlined workflow with org standard Brings the inlined claude.yml up to parity with petry-projects/.github/.github/workflows/claude-code-reusable.yml. Changes: 1. Bot allow list for pull_request_review_comment Add coderabbitai[bot], Copilot, copilot-pull-request-reviewer[bot], and gemini-code-assist[bot] alongside the existing OWNER/MEMBER/ COLLABORATOR check. These bots have author_association 'NONE' so their review comments were always skipped. 2. check_run trigger + claude-ci-fix job Port the CI failure auto-fix feature from the reusable. When a check fails on a PR, Claude diagnoses and fixes it automatically. Adapted to use DON_PETRY_BOT_GH_PAT (this repo's secret name). 3. claude-code-action SHA bump: v1.0.89 → v1.0.119 Update both the claude and claude-issue jobs. 4. paths-ignore on pull_request trigger Prevents the workflow from firing on PRs that only change claude.yml itself, avoiding the Anthropic OIDC validation failure (workflow file must match default branch at token exchange). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(claude): guard bot allow list against fork PRs Same fix as petry-projects/.github PR #238 — add same-repo guard for bot-triggered pull_request_review_comment runs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(claude): address ci-fix self-loop and fork PR security - Replace Claude Code name prefix check with explicit job name list to correctly prevent self-loops (check_run names for inlined workflows are bare job names, not workflow-prefixed) - Add fork PR trust gate in Resolve PR number step: verify head repo matches target repo before running Claude with privileged credentials Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: replace inlined claude.yml with standard thin-caller stub The inlined version embedded all three jobs (claude, claude-ci-fix, claude-issue) directly and threaded DON_PETRY_BOT_GH_PAT through checkout tokens and github_token, causing the bot's PAT to author PRs and comments instead of github-actions[bot]. Replace with the standard thin caller that delegates to the org-level reusable workflow (claude-code-reusable.yml@v1) via secrets: inherit, which is the correct pattern per: petry-projects/.github/standards/workflows/claude.yml * ci: pin dependabot-automerge reusable workflow to SHA (#130) Pin petry-projects/.github reusable workflow from @v1 to commit SHA 0cb4bba11d7563bf197ad805f12fb8639e4879e4 to satisfy the action-pinning compliance policy. Closes #116 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix: replace gh copilot suggest with GitHub Models REST API (#151) * fix: replace gh copilot suggest with GitHub Models REST API (#147) The `gh copilot suggest -p "$(cat <file>)"` invocation failed with "Invalid command format" because: 1. The `-p` flag is not valid syntax in modern `gh copilot` built-in versions. 2. `gh copilot suggest` is a shell-command suggestion tool; it does not accept large PR prompts or return structured JSON responses. 3. Passing a multi-thousand-line prompt via `$(cat ...)` can hit ARG_MAX. The non-zero exit was then misclassified by the rate-limit detector, which aborted the entire session and skipped all remaining PRs in the queue. Fix: replace all three copilot invocations (run_triage, run_agentic, run_duck) with a new `copilot_chat` helper that calls the GitHub Models REST API directly via curl. The API is OpenAI-compatible, versioned via `X-GitHub-Api-Version`, stable against gh CLI version changes, and accepts arbitrary prompt sizes using python3 for safe JSON encoding. Additional changes: - Add `COPILOT_API_MODEL` var (default `openai/o4-mini`) overrideable via env. - run_agentic/run_duck copilot cases now also write output to $OUTPUT_FILE so callers that check that path directly (deep review, audit) find the JSON. - Rate-limit responses (HTTP 429) are echoed to stdout so the existing `is_rate_limited()` detector fires correctly for engine fallback. - Add pre-flight smoke test in review-batch.sh: tests GitHub Models API connectivity with a one-liner prompt before processing any PRs, so auth or model errors surface immediately as a clear setup failure. - Add tests/test_copilot_chat.sh: unit tests for the JSON payload builder with edge-case prompts (quotes, newlines, # headings, large diffs, Unicode). Closes #147 Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * fix: scope COPILOT_API_MODEL export to copilot engine only Move the `export COPILOT_API_MODEL` from the common exports block into the `copilot)` case where the variable is set, so it is not exported as an empty/unset variable when the engine is `claude` or `gemini`. The `copilot_chat` fallback `${COPILOT_API_MODEL:-openai/o4-mini}` …

The review-one-pr.sh script already exits with code 100 for no-ops, but the workflow was counting them toward MAX_PRS budget. Now: - Review loop processes ALL candidates (not truncated to MAX_PRS) - Only non-no-op PRs count toward the MAX_PRS budget - Loop stops after MAX_PRS actual reviews are posted - This unblocks the backlog from being stuck on already-reviewed PRs Fixes #7 (completes PR #10)

… default `claude` engine — `COPILOT_API_MODEL: unbound variable` (#774) * Add scheduled PR review agent Hourly GitHub Action that enumerates open PRs (authored by or review-requested from @me), classifies risk via Claude Code, and auto-approves LOW/MEDIUM PRs that pass quality gates while escalating HIGH-risk or gated PRs for human review. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Use Claude Code OAuth token instead of API key Routes agent runs through the Max plan subscription rather than per-token API billing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Enforce single-PR scope and default to dry-run - Prompt now hard-forbids enumeration commands and acting on any PR other than $PR_URL. Earlier dry-run revealed the agent was reviewing the entire backlog in a single invocation, ignoring the per-PR loop. - DRY_RUN now defaults to true unless repo variable LIVE_MODE=true, so the hourly cron is safe by default until the operator opts in. - AGENT.md documents the LIVE_MODE switch and corrects PAT scopes (Issues needs write to create the needs-human-review label). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add 3-model council + commit-SHA-aware iterative review The single-prompt reviewer is replaced by a council of 3 Claude models, each with a focused lens, and a synthesizer that combines them: - Security (Opus 4.6) - auth, secrets, injection, supply chain - Correctness (Sonnet 4.6) - logic, issue alignment, tests, CI - Maintainability (Haiku 4.5) - standards, conventions, clarity - Synthesizer (Sonnet 4.6) - max risk, escalate-if-any, dedupe, post Council members run in parallel, write JSON verdicts to /tmp/council/, and never touch GitHub. The synthesizer is the only actor that posts. Every posted review embeds an HTML marker on line 1:  scripts/review-one-pr.sh checks for that marker before spending tokens: - Marker SHA == current head SHA -> skip (already reviewed). - Marker SHA != current head SHA -> re-review (handles iterative cycles). - No marker -> first review. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Upgrade maintainability lens from Haiku 4.5 to Sonnet 4.6 Haiku couldn't follow the agentic instructions — it asked for env vars instead of reading them and executing the gh commands. All three council members now use models capable of multi-step tool use. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Go-live improvements for PR review agent (#2) - Upgrade actions/checkout v4→v5 (Node.js 20 deprecation) - Add MAX_PRS cap (default 10) to stay within 60-min job timeout - Filter drafts at enumeration (--draft=false) - Fix jq operator-precedence bug in idempotency check - Add truncation notice log, inline jq comments, docs updates Council-reviewed: 2 rounds (escalated round 1 on jq bug, approved round 2) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude delegation, auto-merge, and rebase handling (#3) - Post structured fix-request comments on escalated PRs in Claude-enabled orgs - Claude's workflow trigger picks up the comment automatically (no @claude tag) - On approval: auto-merge (--auto --squash), rebase if behind, remove label - Cycle guard (MAX_REVIEW_CYCLES=3) prevents infinite delegation loops - New repo variables: CLAUDE_ORGS, MAX_REVIEW_CYCLES Council-reviewed: dispatch hit rate limit but architecture validated against petry-projects/.github claude-code-reusable.yml workflow — event flow confirmed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Optimize review: small-PR and incremental fast paths (#4) * Add review mode optimization: small-PR and incremental fast paths PRs are now routed to the cheapest review path: - Small PRs (<10 lines): single Opus call (1 invocation vs 4) - Re-reviews (prior marker at different SHA): single Opus call with prior review context, focused on what changed since last review - First review of non-small PRs: full 3-member council (unchanged) New files: - prompts/single-review.md: combined council+synth prompt for single reviewer mode, handles both small and incremental paths New config: - SMALL_PR_THRESHOLD repo variable (default 10) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Replace parallel council with cascading review tiers Haiku triage → Sonnet deep review → Opus security audit, where each tier only fires if the previous one escalated. This replaces the 3-parallel-members + synthesizer architecture. Cost impact: - ~80% of PRs: Haiku + Opus confirm (2 calls, ~30s vs 4 calls, ~5 min) - ~15%: + Sonnet (3 calls, ~2.5 min) - ~5%: full cascade (4 calls, ~5.5 min) Haiku works by receiving pre-fetched context (no tool use needed), which sidesteps the agentic limitations found earlier. New files: - prompts/triage.md — Tier 1: Haiku fast classification - prompts/deep-review.md — Tier 2: Sonnet full review - prompts/security-audit.md — Tier 3: Opus security audit - prompts/cascade-action.md — posts review from any resolving tier Re-reviews (prior marker at different SHA) pass prior review context to the triage, enabling faster incremental checks. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix review council findings: 4 major + 3 minor issues Major fixes: - Replace invalid 'repository' gh field with 'headRepository'/'headRepositoryOwner' across script and all prompts - Add 'triage-approved' as valid REVIEW_MODE in single-review.md with dedicated mode description - Fix PRIOR_REVIEW_BODY selector: head -1 → tail -1 to match most-recent SHA - Update dangling 'synthesize.md step 9a' reference to cascade-action.md Minor fixes: - Validate PRIOR_REVIEW_BODY contains marker before exporting (anti-injection) - Write prior review body to temp file to avoid E2BIG on large reviews - Remove dead SONNET_RC=$? variable; add || true for set -e safety - Delete orphaned prompts/council/ files (no longer referenced by cascade) - Fix incremental-mode compare command: document how to derive owner/repo from headRepository metadata Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add Claude Code workflow (#8) Implement the org-level reusable workflow caller pattern from petry-projects/.github. This thin caller delegates all logic to claude-code-reusable.yml and triggers on PR events, issue comments, and labeled issues. Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * feat: add Copilot engine support via REVIEW_ENGINE toggle (#5) * feat: add Copilot engine support via REVIEW_ENGINE toggle Abstract LLM invocation into scripts/engine.sh so both Claude and Copilot engines use the same cascade logic, prompts, and actions — just different CLIs and model families. Key changes: - scripts/engine.sh: new LLM abstraction layer with run_triage/run_agentic dispatching to claude or copilot CLI based on REVIEW_ENGINE variable - scripts/review-one-pr.sh: refactored to source engine.sh, engine-agnostic variable names (DELEGATION_ORGS, AI_DELEGATION_ENABLED, DEEP/AUDIT tiers) - All prompts updated: engine-agnostic tier names, ENGINE_LABEL footers, removed hardcoded model names from prose - Workflow: conditional CLI install, REVIEW_ENGINE/COPILOT_GITHUB_TOKEN vars, DELEGATION_ORGS with CLAUDE_ORGS backward compat fallback - AGENT.md/README.md: documented both engine options and setup Model mapping: Triage: Haiku 4.5 / GPT-5-mini Deep: Sonnet 4.6 / GPT-5.2 Audit: Opus 4.6 / GPT-5.4 Action: Sonnet/Opus / GPT-5.2/5.4 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update prompts/cascade-action.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update prompts/cascade-action.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: address PR review comments - Fix Copilot CLI install to use gh extension instead of npm - Replace speculative GPT-5 models with verified identifiers (gpt-4o-mini, o1, o1-pro) - Fix cascade-action.md deprecated alias to reference CLAUDE_ENABLED - Change 'Claude delegation' to 'AI delegation' in synthesize.md - Add triage-approved to mode schema in single-review.md - Align log label with JSON field in review-one-pr.sh - Remove unused SMALL_PR_THRESHOLD from workflow - Add $OUTPUT_FILE to inputs in deep-review.md and security-audit.md Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * feat: update to latest GPT-5 models for Copilot engine - Use gpt-5-mini for triage (lightweight, faster) - Use gpt-5.2 for deep review and action (improved reasoning) - Use gpt-5.4 for security audit and single reviewer (most advanced) Based on latest GitHub Copilot model support in 2025-2026. Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> * feat: inline Claude Code workflow to access repo secrets directly (#9) Replaces the thin org-level reusable workflow caller with the full inlined workflow so CLAUDE_CODE_OAUTH_TOKEN and GH_PAT_WORKFLOWS can be accessed from this repo's own secrets. Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: cross-engine adversarial rubber duck review (#11) * feat: add cross-engine adversarial "rubber duck" review to PR cascade At tier 2, the deep review now runs in parallel with an adversarial "rubber duck" reviewer from the opposite engine (Claude↔Copilot). A synthesis step merges both verdicts before deciding to approve or escalate. Different model families catch different blind spots — this approach closes ~75% of the performance gap between tiers. Graceful degradation: if the rubber duck fails (missing creds, CLI unavailable), the cascade continues with the primary review only. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address rubber duck review findings and Copilot comments - Strip opposing engine credentials in run_duck to prevent cross-engine secret leakage (CLAUDE_CODE_OAUTH_TOKEN/COPILOT_GITHUB_TOKEN) - Add timeout 300 to both duck CLI paths to prevent hangs - Add $OUTPUT_FILE to rubber-duck.md inputs section - Add TIER2_RESULT alias at tier 3 handoff (documents combined vs deep) - Fail fast on primary CLI install; || true only for duck engine - Add default/error branch to run_duck case statement - Fix final_risk → risk terminology in synthesize-duck.md - Add explicit severity bump mapping (info→minor, minor→major) - Set DUCK_VALID=false on synthesis fallback for accurate FINAL_TIER - Kill duck process early if deep review fails to avoid wasted latency Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: filter already-reviewed PRs from backlog to unblock queue * docs: clarify PR review batching issue * fix: complete PR #10 fix - don't count no-ops toward MAX_PRS budget The review-one-pr.sh script already exits with code 100 for no-ops, but the workflow was counting them toward MAX_PRS budget. Now: - Review loop processes ALL candidates (not truncated to MAX_PRS) - Only non-no-op PRs count toward the MAX_PRS budget - Loop stops after MAX_PRS actual reviews are posted - This unblocks the backlog from being stuck on already-reviewed PRs Fixes #7 (completes PR #10) * feat: CI gate + poll-loop rebase wait across all review prompts (#14) * feat: CI gate + poll-loop rebase wait across all review prompts 1. CI gate (review-one-pr.sh step 1b): skip PRs with failing or in-progress checks before spending any LLM tokens. Exits with code 100 (no-op sentinel) so skipped PRs don't count against the MAX_PRS budget. Empty statusCheckRollup (no CI) is treated as passing. 2. Poll loop (cascade-action, single-review, synthesize): replace the fixed sleep with a bounded poll (6×5 s) that exits as soon as mergeStateStatus is no longer BEHIND, eliminating the race between update-branch and the subsequent auto-merge call. 3. Triage cleanup: remove the now-redundant "no failing CI" criterion since failing-CI PRs are blocked by the shell gate before triage runs. Renumber remaining criteria. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address Copilot review comments + document bot account setup review-one-pr.sh: - Combine headRefOid + statusCheckRollup into a single gh pr view call to reduce API calls and rate-limit exposure - Tighten CI classification to strict-success: pending check first, then require ALL items to be SUCCESS/passing — any other conclusion (NEUTRAL, SKIPPED, STALE, STARTUP_FAILURE, etc.) now counts as failing rather than silently passing through - Clarify exit-code 100 comment to reflect its broader "skip sentinel" meaning (already-reviewed, ci-failing, ci-pending) prompts (cascade-action, single-review, synthesize): - Initialise REBASE_STATUS="BEHIND" before the poll loop so the variable is always set; add explicit post-loop guard — if still BEHIND after 30s, skip auto-merge entirely and let the next cycle retry AGENT.md: - Document the reviewer identity constraint (self-approval is blocked) - Add step-by-step bot account creation and classic PAT setup instructions - Renumber existing setup steps 2→3, 3→4, 4→5 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: filter failing/pending CI PRs at enumeration stage in list-prs.sh Add --checks passing to both gh search prs queries so PRs with failing or in-progress CI never enter the candidate pool. Previously they were fetched, consumed a CANDIDATE_LIMIT slot, and only skipped once review-one-pr.sh ran the per-PR CI gate. Two-layer defence now: 1. list-prs.sh — --checks passing excludes them from the candidate list 2. review-one-pr.sh — strict jq CI gate catches anything that slips through (e.g. PRs passed via PR_URL_OVERRIDE) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: treat SKIPPED/NEUTRAL CI conclusions as passing; drop admin:org scope review-one-pr.sh: - Extend is_success to include SKIPPED and NEUTRAL conclusions alongside SUCCESS. SKIPPED covers path-filtered workflow jobs (e.g. claude-issue skips on non-issue events); NEUTRAL covers informational checks that don't gate merging. Both were previously falling through to "failing", permanently blocking review of any PR with a skipped check. AGENT.md: - Remove admin:org from the bot PAT scope recommendation. The scope is not needed for PR approval or auto-merge — repo scope is sufficient. admin:org grants full org administration (member management, billing, team settings) which is excessive blast radius for a review bot token. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: replace --checks passing with --checks success in list-prs.sh (#15) GitHub CLI changed the valid values for `gh search prs --checks` from accepting "passing" to only allowing {pending|success|failure}. All workflow runs have been failing since this change with: invalid argument "passing" for "--checks" flag: valid values are {pending|success|failure} "success" is semantically identical to the old "passing" — it filters to PRs where all CI checks have completed with a passing status. Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: update repo references from self to pr-review-agent * feat: add car-hunt skill for used vehicle research and ranking CPM-based (cost per remaining mile) ranking of Honda/Toyota listings across AutoTrader, CarGurus, and Facebook Marketplace. Includes live reliability research step (Consumer Reports, JD Power, RepairPal, CarComplaints) before searching, NHTSA recall/complaint API deep-dive, and optional Google Sheet write-back. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: fix FB Marketplace links, improve AutoTrader fetch, add Sheets export step - AutoTrader: stop trying to WebFetch JS-rendered search pages; use WebSearch site:autotrader.com to find individual listing URLs, then WebFetch those (they have real HTML data) - FB Marketplace: never output generic placeholder links; use real item URLs if Google indexes them, otherwise surface a manual search URL and one placeholder row explaining why - Step 6: document CSV→Sheets export via Drive MCP create_file, including base64 encoding, column format, and share URL construction Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: add Craigslist as explicit source, enforce real-URL-only link rule - Add Craigslist section with regional sites (bham, huntsville, chattanooga, atlanta), correct search URL pattern with sort/filter params, and WebFetch approach (CL uses plain HTML, works reliably) - Link integrity rule: every Link column value must be a real listing URL from WebFetch/WebSearch or a manual search URL clearly labeled — never a homepage, never a constructed/guessed URL - Update WebSearch fallback section to cover all sources uniformly Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: split zip/radius questions, rename MAX_MILES to MAX_ODOMETER Question 4 was ambiguous — users confused "Max miles?" (meant odometer) with search radius. Now asks zip and radius as separate questions (#4 and #5) and renames the variable to MAX_ODOMETER with explicit "(highest mileage on the car itself)" clarification. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: include self-authored PRs awaiting review in agent enumeration (#16) * fix: fix Craigslist link approach, add date_posted with 21-day staleness filter Craigslist search pages are JS-gated so WebFetch fails; switch to WebSearch (site:craigslist.org) as primary approach, with direct URL as fallback. Add date_posted field to every listing and drop any listing posted more than 21 days ago as likely-sold. Also fix MAX_MILES → MAX_ODOMETER in the Craigslist search URL template. Add Posted column to ranked table and Step 6 sheet schema. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: include self-authored PRs awaiting review in agent enumeration Remove --checks success filter from authored PR search to include PRs that require code review (e.g., compliance fixes). CI validation still occurs per-PR in review-one-pr.sh as a second layer of defence. This enables the review agent to detect and approve self-authored PRs that are blocked by review requirements but have passing CI checks. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add doors/transmission fields, update-mode sheet, fix CarGurus/Craigslist approach - Fix CarGurus URL section: direct URL pattern 404s, switch to WebSearch-first approach - Fix Craigslist primary: regional page WebFetch with pagination (was site: WebSearch which returns category pages) - Add doors (2/4) and transmission (Auto/Manual) to data extraction, output table, and sheet schema - Add exhaustive coverage mandate: paginate all sources, never stop early, report coverage in output - Add AutoTrader outage handling: note 503 in summary, fall back to WebSearch cache - Add update mode for Step 6: single persistent sheet, deduplicate by URL, mark stale listings - Update sheet columns to include Doors/Trans; fix MIME type note (text/csv only, not xlsx) - Update scheduling defaults: ZIP=35243, RADIUS=200, MAX_PRICE=6000, YEAR_MIN=2002, MAX_ODOMETER=250000 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add hard disqualification filters for finance-speak, title issues, and scam signals Skip any listing mentioning down/monthly payments, no title/lien/salvage, or scam contact redirects (broken messenger, email-only, urgency pricing). Log disqualified listings separately rather than silently dropping them. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add Distance to Car field using Nominatim geocoding + Haversine formula Geocode user ZIP and each listing city via free Nominatim API (no key needed), compute straight-line distance × 1.3 road correction factor, display as "~X mi" in output table (Dist column) and sheet schema. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address low result count — batch URL extraction, preview-filter before fetch, target 50+ raw Score candidates from search-page preview data first to avoid fetching every listing page; only deep-fetch those passing price/mileage preview. Clarifies why ~15 results was happening and mandates 50+ raw candidates. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: make cascade-action prompt explicit about gh pr review --approve The agent was posting comments instead of approval reviews because the prompt was too high-level. Rewritten step 5 to contain explicit bash code blocks that the agent can directly execute, with clear use of: - gh pr review --approve (not gh pr comment) - Proper body passing via temp file to handle newlines/special chars - Explicit variable extraction and idempotency checks This ensures the review posts as an APPROVED review, not a COMMENTED review, so GitHub branch protection recognizes it and auto-merge triggers. * improve: make cascade-action body composition and escalation more explicit - Fix variable expansion in escalation comment by using COMMENT_END instead of 'COMMENT' - Make step 4 explicit with bash code that extracts JSON fields and builds body - Handle findings array iteration and formatting with jq - Support cross-engine agreement section only when tier is deep+duck - Use temp file for comment composition to handle variables correctly * refactor: move review posting logic from agent prompts to bash script This addresses the critical issue where the agent was posting comments instead of approval reviews. Instead of relying on the agent to execute bash commands correctly, we now: 1. Have the agent generate only the verdict JSON with the review body 2. Use a new post-pr-review.sh script to handle all GitHub interactions 3. This removes the ambiguity about whether to post as review or comment Changes: - New scripts/post-pr-review.sh: handles review posting, rebasing, auto-merge, labels - Simplify cascade-action.md: agent just outputs verdict JSON, doesn't post - Simplify single-review.md: agent just outputs verdict JSON, doesn't post - Update review-one-pr.sh: capture verdict JSON and call post-pr-review.sh The verdict JSON includes the complete review body, so the agent can still compose the full markdown review. The bash script handles all GitHub interactions (posting reviews, enabling auto-merge, managing labels). This is more reliable because bash + gh CLI is deterministic, while agent behavior is less predictable. * add: cleanup script to fix PRs with comment approvals instead of review approvals Script identifies PRs that have the agent's marker comment but no actual approval reviews (symptom of the original bug), and posts proper approval reviews + enables auto-merge. Usage: bash scripts/fix-stuck-prs.sh [dry_run=true|false] * fix: cleanup script now requires bot account token GitHub blocks self-approvals, so cleanup must run with the bot account's GH_TOKEN (petry-review-bot), not the PR author's token. * add: workflow to fix stuck PRs using bot account token Allows running the cleanup script via workflow_dispatch with access to GH_PAT (bot account token) from repo secrets. * fix: pass GH_PAT to checkout action so workflow uses bot account * debug: simplify account check, add authentication debug output * docs: add comprehensive petry-review-bot setup instructions * docs: add GitHub App setup guide (recommended approach) GitHub App is the secure, recommended way to automate PR reviews: - Fine-grained permissions - JWT tokens that auto-expire - No human account needed - Better audit trail - GitHub's recommended approach Replaces the bot user account approach with a more secure alternative. * docs: add comprehensive GitHub App setup documentation - SETUP.md: Quick reference guide with configuration and troubleshooting - IMPLEMENTATION.md: Technical deep dive on architecture and design decisions - DOCUMENTATION.md: Index of all documentation files - Updated README.md with status and quick links - Updated GITHUB_APP_SETUP.md with implementation notes and actual app ID - Workflows use GitHub App token generation instead of static PATs Covers the transition from bot user account to GitHub App authentication for improved security and maintainability. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: silence auth check in fix-stuck-prs when using GitHub App token GitHub App tokens don't have user scope, so 'gh api user' returns 403. This is fine - the script still works for PR operations. Suppress the error so the script completes successfully with app-token fallback label. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: use explicit author instead of @me in stuck PR search GitHub App tokens don't have user identity, so @me search doesn't work. Use explicit 'don-petry' author instead to find PRs to fix. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: avoid subshell in while loop to preserve variable state Using pipe in while loop created subshell where PROBLEM_PRS and FIXED_PRS counters were incremented but changes didn't persist to parent shell. Fixed by using process substitution for input instead of pipe. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * docs: add comprehensive status report for GitHub App setup - Overview of completed work - GitHub App authentication details - 24 stuck PRs successfully fixed with approval reviews - Architectural decisions and rationale - Configuration guide and usage examples - Known limitations and troubleshooting System is now fully operational with GitHub App token authentication, comprehensive documentation, and all infrastructure in place. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * docs: document stuck PR cleanup status and script fixes Added documentation for: - GitHub App token compatibility fixes in fix-stuck-prs.sh * Changed @me to explicit author (app tokens have no identity) * Fixed subshell variable scope (process substitution vs pipe) * Silenced expected 403 auth check error - Current status: 24 PRs have approvals but remain OPEN * Auto-merge failed due to missing GitHub App permission * Approvals satisfy branch protection requirement * Next: expand permissions or manually merge Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: update list-prs.sh to search all repos by owner instead of @me GitHub App tokens don't have user identity, so @me/@review-requested searches fail. Changed to enumerate all repos in don-petry and petry-projects, then search for open PRs within each repo. This covers the full scope: - All open PRs in personal don-petry repos - All open PRs in petry-projects org repos Resolves 6 consecutive workflow failures due to zero PRs being enumerated. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * docs: add investigation report for PR review agent workflow failures * fix: move env section before steps in workflow to fix YAML structure GitHub Actions requires env section to come before steps in job definition. Moving env definition up and setting GH_TOKEN only in steps that need it. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * script: add backfill-approvals to retroactively apply real approvals Converts PRs with agent approval comments (but no real GitHub approvals) to have actual APPROVED reviews. Needed for PRs reviewed before the gh pr review --approve fix was applied. Usage: scripts/backfill-approvals.sh # dry-run (preview changes) scripts/backfill-approvals.sh false # apply real approvals Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * feat: add backfill-approvals workflow to run as GitHub App bot Runs backfill-approvals.sh via GitHub Actions so the approvals are posted by the bot identity, not the PR author — GitHub rejects self-approvals. Also fixes subshell counter bug in the script (piped while loop lost variable state; switched to process substitution). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: convert inner while loop to process substitution to preserve counters Both the outer repo loop and inner PR loop were piped subshells, causing all counter increments (approved/skipped/failed) to be lost. The summary always showed 0. Fixed by using < <(...) process substitution for both loops. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * car-hunt: add VIN-deep-dive flow, printable checklists, location-tier ranking - Step 5.5 pre-test-drive flow: NHTSA VIN decode + per-VIN unrepaired-recall automation via Chrome MCP (Honda LWC owner portal documented as not automatable; NHTSA web form works). - §F printable test-drive checklist generator (reportlab/Platypus PDF) with cold-start, model-specific red flags, negotiation table, walk-away rules. - §G fraud / paperwork verification checklist (vehicle-agnostic, reusable): walk-away triggers, VIN three-location match, curbstoning, odometer fraud, bill of sale, title transfer, payment protection, stolen-vehicle, title- jumping, after-purchase steps. - Step 5.25 head-to-head comparison template with information-asymmetry rule. - Step 3 Location Quality Tier scoring (Birmingham AL metro table A/B/C/D) with adj-CPM modifier; sheet schema gains Adj.CPM + Tier columns. - Hard-disqualification rules added: non-running engine keywords, mileage inconsistency, mandatory description scrape. - Drive MCP overwrite limitation documented; sheet ID now read from memory rather than hardcoded. - FB Marketplace operational facts: Birmingham AL city ID 107739635926718, /search? vs /vehicles? query handling, React-controlled inline composer, send-button selector, seller-name extraction regex. - scheduled-tasks/used-car-search-{morning,afternoon}: tier A/B priority flag, sheet ID read from memory. - Reference PDF generator scripts checked in for reuse. * fix: re-approve PRs where approval predates last commit (stale approval) Instead of skipping PRs that already have any APPROVED review, skip only those where reviewDecision is not REVIEW_REQUIRED. This handles PRs where a bot approval was posted before a new commit was pushed — GitHub's ruleset engine treats those approvals as stale even with dismiss_stale_reviews=false. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: robustly extract JSON verdict from mixed claude --print output (#17) Claude's --print mode can prefix the JSON verdict with conversational preamble text, causing jq to fail with parse errors. Add extract_verdict_json to engine.sh and wire all three cascade action call sites in review-one-pr.sh to use it. Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * fix: extract_verdict_json — check dest file first (agent Bash-write style) The cascade-action agent writes its verdict JSON to \$OUTPUT_FILE via a Bash tool call, then prints a text summary to stdout. The previous fix only scanned stdout (the .raw file), which contained no JSON. The agent- written file at \$dest (= \$OUTPUT_FILE) was already correct — just not checked. Now check \$dest first before falling back to stdout scan. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Enforce MAX_REVIEW_CYCLES cap before running the cascade (#18) * fix: enforce MAX_REVIEW_CYCLES cap with human-escalation marker Previously MAX_REVIEW_CYCLES only gated AI delegation in post-pr-review.sh — the cascade itself ran on every cron tick regardless of how many cycles had accumulated. Real-world result: a PR could rack up 9+ review cycles (we observed exactly that on ContentTwin#100) before any cap took effect. Add a pre-cascade check in review-one-pr.sh: when the count of existing `` markers is at or above MAX_REVIEW_CYCLES (default 3), post one escalation comment marked ``, label needs-human-review, request don-petry, and exit 100 (skip sentinel — doesn't burn the MAX_PRS budget). The escalation marker doubles as the no-spam guard: subsequent runs detect it and exit 100 immediately. Also reuse a single `gh pr view` for both the cycle count and the escalation-marker check. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * review feedback: surface escalation-comment failures, drop dead unset - Drop `2>/dev/null || true` on `gh pr comment` so a failed escalation post is visible in the workflow log instead of silently leaving the PR with no marker (which would re-trigger the cap path next tick). - Reword the cycle-count comment from "AI delegation loops" to "review loops" — the cap also catches cascade-only loops where every cycle approves and a new commit lands before merge. - Remove the redundant `unset PR_BODIES` — never exported, no leakage. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * Reliability hardening: session circuit breaker, timeouts, retry, dedup (#20) * feat: session circuit breaker, per-tier timeouts, retry, and triage hard-fail Reliability hardening for the PR review agent. 1. Session circuit breaker (.github/workflows/pr-review.yml): on any non-zero, non-100 exit from review-one-pr.sh (general failure or rate limit on the fallback engine), break the per-PR loop, log a clear error annotation naming the failing PR and reason, and exit the step with code 1 so the run shows red. Prevents one systemic problem from silently burning the entire candidate pool. 2. Per-tier timeouts (scripts/engine.sh): triage/deep/audit/action/duck each get their own bounded timeout (180/600/600/300/300s defaults, env-overridable). Previously only the duck had a timeout — a hung tier could burn the whole 60min job budget. 3. Retry-with-backoff on transient errors (scripts/engine.sh): triage retries once on 124/137/143 (timeout / signal kill) since its caller captures stdout via $(...) so retries are safe. Deliberately NOT applied to run_agentic/run_duck where stdout is redirected to a file — a retry there would corrupt the partial first-attempt output. 4. Triage non-JSON now hard-fails (scripts/review-one-pr.sh): replaces the silent fallback that synthesized a fake "escalate=MEDIUM" verdict and proceeded to deep review. With the new circuit breaker, loud failure is the right call — masking a broken triage was burning tokens on every PR while the workflow looked healthy. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: stop stacking duplicate agent reviews on the same PR Two bugs were causing the agent to leave multiple comments on the same PR. Together they produced 10 stacked APPROVED reviews on petry-projects/ContentTwin#100. Bug A — idempotency check is order-dependent (review-one-pr.sh): The previous marker-discovery code did: ((.reviews // []) + (.comments // [])) | .[].body | grep marker | tail -1 This relies on the array concatenation order, not chronological order. When old agent comments existed alongside newer agent reviews, tail -1 picked the comment-array marker (older) over the review-array marker (newer), causing the script to think the head SHA hadn't been reviewed and re-run. Replaced with a single jq pipeline that tags each item with submittedAt / createdAt, sorts by timestamp, and takes the actual most-recent marker. Bug B — no cleanup of prior agent items (post-pr-review.sh): After successfully posting a new review/comment, prior agent items were left in place, accumulating forever. Added mark_prior_agent_items_obsolete which, after a successful post: - dismisses prior APPROVED/COMMENTED/CHANGES_REQUESTED agent reviews via the GitHub dismissal API (UI shows them struck-through as Dismissed) - edits prior agent comments to wrap their body in a collapsed <details> block with a "Superseded by re-review at <SHA>" summary, plus a `` sentinel for idempotency All cleanup API calls are best-effort — failures don't break the workflow. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(cleanup): warn on API failures, preserve global newest, file-stage JSON Three fixes to mark_prior_agent_items_obsolete from the review of PR #20: 1. ::warning:: annotations on every cleanup API failure (review/comment list-fetch, individual review dismissal, individual comment fetch+edit). Previously these were silenced with `|| true`, so a permissions change on the dismissal endpoint would let duplicates stack indefinitely with no signal in the Actions UI. Cleanup is still non-fatal — the new post has already landed — but failures are now visible. 2. Preserve the globally-latest agent item across BOTH categories, not the newest of each category separately. The earlier code split reviews and comments and applied `[:-1]` to each, which left a stale fix-request comment in place when the new post was a review (or vice versa). The one-off cleanup of ContentTwin#100 hit exactly this case: 12 stacked reviews collapsed to 1, but a stale comment from 2026-04-25 (SHA cd9132d6) was preserved as "newest comment" even though the latest review at SHA 3af8c8ee was newer overall. Now: compute the max timestamp across both feeds, exclude items at that timestamp. 3. Stage API responses to disk (`mktemp` + `jq <file>`) instead of routing through `--argjson "$var"`. The old approach broke on rare unescaped control chars in user-authored comment bodies (jq refused to parse the resulting shell-vared JSON). File-based input sidesteps the shell pipeline entirely. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * Remove car-hunt skill and scheduled tasks (moved to don-petry/don-petry) (#21) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: apply Copilot fallback hardening and reuse GH_PAT for Copilot auth - Use secrets.GH_PAT (existing personal account token with Copilot subscription) instead of a separate COPILOT_GITHUB_TOKEN secret - Pin actions/create-github-app-token to SHA (v3.1.1) for supply chain safety - Add post-install verification for gh-copilot extension with warning on failure - Guard Copilot fallback path: skip PR gracefully if extension is not installed Addresses issue #24 workflow fixes (1-3) that could not land via PR #25 due to GitHub App lacking workflows permission. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: switch Copilot engine to gh built-in and fix app-id deprecation - Remove gh extension install (github/gh-copilot conflicts with built-in alias) - Replace with gh copilot --version check using COPILOT_GITHUB_TOKEN (GH_PAT) - Update all engine.sh copilot invocations from bare `copilot` binary to `gh copilot suggest --target shell` with GH_TOKEN overridden to GH_PAT so the user token (with Copilot subscription) is used, not the App token - Fix actions/create-github-app-token: app-id → client-id (same secret value, just the renamed input in v3.x) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: harden Copilot fallback path and remove stale worktrees (#25) - gh-copilot install: add --force flag and post-install verification warning so silent failures due to built-in alias conflict are visible in workflow logs instead of being silently swallowed by `|| true` - fallback pre-flight check: verify `gh extension list | grep copilot` before switching to Copilot engine; if unavailable, skip the PR and continue the batch rather than session-aborting and dropping all remaining candidates (fixes the 27-PR drop on run #503) - pin actions/create-github-app-token to SHA for v3.1.1 (Node.js 24 compatible) to prevent hard break on 2026-06-02 when GitHub forces Node.js 24 as default runtime - remove 6 stale Claude Code worktrees from git tracking; add .gitignore entry to prevent future worktrees from being committed (eliminates exit-128 warning on every actions/checkout post-job sweep) Closes #24 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: petry-projects-pr-review-agent[bot] <petry-projects-pr-review-agent[bot]@users.noreply.github.com> * ci: add pre-flight dedup check to prevent duplicate claude-issue PRs (#26) Before invoking Claude on a labeled issue, a new shell step queries for any open PR with a branch matching claude/issue-NNN-* (or a body containing "Closes #NNN"). If one is found it posts a comment on the issue pointing to the existing PR and skips the Claude step entirely. A secondary prompt instruction tells Claude to check first and push to the existing branch rather than opening a new PR. Motivated by issue petry-projects/google-app-scripts#171, where the claude label was re-applied three times and each run created a fresh PR unaware of the prior attempts. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor: migrate to machine user PAT auth (closes #27) (#28) * refactor: migrate from GitHub App to machine user PAT auth Closes #27 GitHub Apps cannot be listed in CODEOWNERS, blocking PRs in repos with require_code_owner_review: true. Switch all workflows to use a machine user account's fine-grained PAT (DON_PETRY_BOT_GH_PAT secret), which can join an org team listed in CODEOWNERS. Workflows: removed actions/create-github-app-token steps in pr-review, fix-stuck-prs, backfill-approvals, and daily-pr-review-health. All now use secrets.DON_PETRY_BOT_GH_PAT directly. Docs: renamed GITHUB_APP_SETUP.md to MACHINE_USER_SETUP.md with full rewrite covering account creation, CODEOWNERS config, PAT generation, and rotation. Updated auth sections in IMPLEMENTATION.md, SETUP.md, STATUS.md, DOCUMENTATION.md, README.md. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor: switch to org-scoped PAT secret DON_PETRY_BOT_PETRY_PROJECT_PAT Replace DON_PETRY_BOT_GH_PAT with DON_PETRY_BOT_PETRY_PROJECT_PAT — the new fine-grained PAT scoped to the petry-projects org (resource owner = petry-projects). The previous PAT was scoped to the donpetry-bot personal namespace and had no repository access. The old DON_PETRY_BOT_GH_PAT secret is retained for any future use against don-petry's personal repos. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore: ignore .claude/scheduled_tasks.lock state file --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * refactor: merge approval repair scripts into single automation - Consolidate backfill-approvals.sh and fix-stuck-prs.sh into repair-pr-approvals.sh - Iterate all repos in both orgs instead of assuming author - Verify no existing APPROVED review before posting - Copy original agent comment as review body - Enable auto-merge when posting approval if needed - Single workflow with 30-min timeout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add @mention trigger for on-demand PR reviews (#30) Adds repository_dispatch support so commenting @petry-review-bot on any PR fires an immediate review without waiting for the hourly schedule. - pr-review.yml: new `repository_dispatch` trigger (type: pr-review-mention), per-PR concurrency group for mention runs, FORCE_REVIEW and DRY_RUN env vars that handle both workflow_dispatch and repository_dispatch paths - review-one-pr.sh: FORCE_REVIEW=true bypasses idempotency so a mention always runs a fresh cascade even if the head SHA hasn't changed - templates/mention-listener.yml: deploy to petry-projects/.github; listens for @petry-review-bot, validates commenter trust, posts ack, sends repository_dispatch (requires Contents:write, not Actions:write) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: harden rebase, review dismissal, and health log diagnostics (#40) Addresses 4 code-actionable recommendations from health check report #33: - [CRITICAL] Make rebase/branch-update non-fatal — 403/504 during rebase emits ::warning:: instead of aborting the batch session (#34) - [MEDIUM] Add retry with exponential backoff (3 attempts) for transient 5xx on update-branch API; break immediately on 4xx (#37) - [MEDIUM] Guard review dismissal with state re-check before calling dismiss API, preventing 422s from race conditions (#38) - [LOW] Surface missing log warnings in health check script (#39) - Fix: skip auto-merge when branch is still BEHIND after failed rebase Closes #34, closes #37, closes #38, closes #39 * refactor: migrate to org-wide .github-private convention (#41) * refactor: parametrize hardcoded identity values for org migration Replace all hardcoded references to don-petry, petry-review-bot, and don-petry/pr-review-agent with environment variables that default to the current values. This allows the agent to be configured for different orgs/users via repo variables. Changes: - Scripts use $REVIEWER_USER, $TARGET_ORG, $BOT_USER, $AGENT_REPO - Prompts no longer reference specific GitHub usernames - Workflows use org-level GH_PAT_WORKFLOWS secret instead of repo-level DON_PETRY_BOT_PETRY_PROJECT_PAT - Health check uses context.repo.owner/repo for issue creation - Variables are set in workflow env block with defaults Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: add Copilot custom agent profiles for org-wide use Create /agents/ directory with three agent profiles: - pr-reviewer: Multi-tier cascading PR review - feature-ideator: Feature idea generation and prioritization - compliance-auditor: Org standards compliance checking These are Copilot custom agent profiles that become available org-wide in the .github-private repo convention. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Squashed 'frameworks/bmad-method/' content from commit e36f219c git-subtree-dir: frameworks/bmad-method git-subtree-split: e36f219c81b6010d4aae423ba12f49edb5b6e31a * Squashed 'frameworks/spec-kit/' content from commit 11f49ebf git-subtree-dir: frameworks/spec-kit git-subtree-split: 11f49ebfb2f6af55345cb4bd9a7906acd211e56f * Squashed 'frameworks/gsd/' content from commit 304c1a13 git-subtree-dir: frameworks/gsd git-subtree-split: 304c1a1302564c45af252bbba4bcc5350e7dac3a * docs: update README for .github-private org infrastructure role Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * ci: add dependabot-automerge.yml workflow (#73) Adds the required dependabot-automerge.yml workflow from the org standard template (petry-projects/.github/standards/workflows/). This is a thin caller stub that delegates to the org-level reusable workflow. Closes #48 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * fix(pr-review): unblock queue starvation from self-authored PRs (#96) (#97) * fix(pr-review): unblock queue starvation from self-authored PRs (#96) A self-authored PR sorted first in the candidate list and triggered "Can not approve your own pull request" — which the session-fatal abort treated like an engine error, skipping all 28 remaining PRs on every run. - list-prs.sh: filter out PRs authored by REVIEWER_USER at enumeration - post-pr-review.sh: catch the GraphQL self-approval error and exit 100 (no-op) instead of 1, so a stray self-PR can no longer abort the batch - engine.sh: gh copilot renamed --target to --agent; fix the rubber-duck invocations so tier-2 cross-engine review works again - review-one-pr.sh: stop appending a duplicate "0" to REVIEW_CYCLE when grep -c finds no markers under set -o pipefail (was breaking the cycle-cap integer comparison) https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * fix(pr-review): authenticate as bot, harden enumeration, address review - Workflow now runs as AGENT_USER (default don-petry-bot), distinct from REVIEWER_USER (the human, don-petry). The self-approval rejection that caused #96 came from the agent and the human sharing one identity. - list-prs.sh filters self-authored PRs against AGENT_USER, and validates AGENT_USER against the GitHub username charset before interpolating into the jq filter (Copilot review feedback). - review-one-pr.sh uses printf '%s\n' instead of echo for PR_BODIES, since PR body content is user-authored and could begin with -n/-e or contain backslash escapes (Copilot review feedback). - AGENT.md guideline updated to reflect that self-authored PRs are intentionally excluded (CodeRabbit review feedback). Operator note: rotate the GH_PAT_WORKFLOWS secret to a token owned by don-petry-bot (with read:org added) for the bot-account behavior to take effect at runtime. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * refactor(pr-review): collapse to single BOT_USER, route escalations via CODEOWNERS Drop AGENT_USER and REVIEWER_USER. The workflow now has one identity: BOT_USER (default don-petry-bot), which both owns the repos to scan and gets filtered out as the self-approval blocker. Human escalation no longer hard-codes a single reviewer; instead, scripts/request-codeowners- review.sh parses CODEOWNERS in the PR's repo and requests review from every @user / @org/team mention. - list-prs.sh: BOT_USER for both gh-repo-list and self-author filter - review-one-pr.sh, post-pr-review.sh: replace --user "$REVIEWER_USER" with the CODEOWNERS helper - repair-pr-approvals.sh: same gh-repo-list switch - pr-review.yml: drop AGENT_USER/REVIEWER_USER, set BOT_USER default to don-petry-bot - AGENT.md: updated guideline to describe single-identity model https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * refactor(pr-review): extract batch loop, hoist env, drop redundant step Workflow YAML drops from 231 to 111 lines by moving the per-PR review loop into scripts/review-batch.sh. The script can be syntax-checked and exercised locally; the workflow now just wires env vars and dispatches. - Hoist GH_TOKEN, MAX_PRS, CANDIDATE_LIMIT to job-level env (were repeated on individual steps). - Inline `gh auth status` into the install step; remove the standalone Verify auth step (its only output was a one-line auth dump). - Drop the `if: steps.list.outputs.count != '0'` guard and the step's `id`/output: review-batch.sh handles empty input as a no-op. - Collapse the duplicated summary-string branch in the review loop into a single template with a conditional fragment. No behavior change. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * perf(pr-review): cache claude-code CLI install across runs `npm install -g @anthropic-ai/claude-code` ran on every workflow start (~30s). Switch to a per-user npm prefix (~/.npm-global) and cache that directory via actions/cache, keyed on CLAUDE_CODE_VERSION + runner OS. A `command -v claude` guard makes the install a no-op on cache hit, so the only cost on subsequent runs is the cache restore. CLAUDE_CODE_VERSION defaults to 'latest' (cache persists until manually flushed); set the repo variable to pin a specific version for fully reproducible caching. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig --------- Co-authored-by: Claude <noreply@anthropic.com> * chore: rename GH_PAT_WORKFLOWS secret to DON_PETRY_BOT_GH_PAT (#99) The previous name was generic and didn't tell you which account the PAT belonged to. The new name makes the binding explicit: this secret is the PAT owned by don-petry-bot, used as BOT_USER throughout the PR-review workflows. Operator follow-up before this can be merged: - Add a new repo secret DON_PETRY_BOT_GH_PAT containing the bot's PAT (with repo, workflow, and read:org scopes). - After merge, the old GH_PAT_WORKFLOWS secret can be deleted. Affected workflows: - pr-review.yml (1 use) - claude.yml (4 uses, with || github.token fallback) - daily-pr-review-health.yml (1 use) - repair-pr-approvals.yml (1 use) scripts/pr_review_health.sh's error message is updated to point at the new name as well. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig Co-authored-by: Claude <noreply@anthropic.com> * chore: remove frameworks directory (#101) Co-authored-by: Gemini CLI <gemini-cli@example.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore all erroneously deleted files (items 4-34) (#104) * revert: restore .github/workflows/daily-pr-review-health.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore .github/workflows/repair-pr-approvals.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore agents/pr-reviewer.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/cascade-action.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/deep-review.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/rubber-duck.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/security-audit.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/shared.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/single-review.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/synthesize-duck.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/synthesize.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/triage.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/engine.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/list-prs.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/post-pr-review.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/pr_review_health.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/repair-pr-approvals.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/request-codeowners-review.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/review-batch.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/review-one-pr.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore templates/mention-listener.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore AGENT.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore BOT_SETUP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore DOCUMENTATION.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore IMPLEMENTATION.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore MACHINE_USER_SETUP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore PR_REVIEW_AGENT_FAILURE_REPORT.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore PR_REVIEW_FAILURE_INVESTIGATION.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore SETUP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore STATUS.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore README.md to pre-change state Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore .github/workflows/daily-pr-review-health.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat: add Gemini Pro support and optimize PR review fallback chain (#102) * Merge main and resolve conflicts * Enhance pr-review workflow: add Gemini support and refactor fallback logic * Address Copilot review comments: tighten regex, fix fallback summary, and align docs * docs: move agent documentation to docs/ folder and rename files * docs: align secret names and fix casing in index * docs: organize pr-review-agent documentation under dedicated folder * Address final PR comments: tighten regex, add preflight checks, fix bot names, and cleanup docs --------- Co-authored-by: Gemini CLI <gemini-cli@example.com> * fix(pr-review): gate rate-limit detection on non-zero exit code Broad patterns like `plan.*limit` and `claude.*usage` could match content in a successful triage summary, triggering a false-positive engine fallback. Guard the check with TRIAGE_RC != 0 so it only fires when the provider command actually failed. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix(claude): sync inlined workflow with org standard (#109) * fix(claude): sync inlined workflow with org standard Brings the inlined claude.yml up to parity with petry-projects/.github/.github/workflows/claude-code-reusable.yml. Changes: 1. Bot allow list for pull_request_review_comment Add coderabbitai[bot], Copilot, copilot-pull-request-reviewer[bot], and gemini-code-assist[bot] alongside the existing OWNER/MEMBER/ COLLABORATOR check. These bots have author_association 'NONE' so their review comments were always skipped. 2. check_run trigger + claude-ci-fix job Port the CI failure auto-fix feature from the reusable. When a check fails on a PR, Claude diagnoses and fixes it automatically. Adapted to use DON_PETRY_BOT_GH_PAT (this repo's secret name). 3. claude-code-action SHA bump: v1.0.89 → v1.0.119 Update both the claude and claude-issue jobs. 4. paths-ignore on pull_request trigger Prevents the workflow from firing on PRs that only change claude.yml itself, avoiding the Anthropic OIDC validation failure (workflow file must match default branch at token exchange). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(claude): guard bot allow list against fork PRs Same fix as petry-projects/.github PR #238 — add same-repo guard for bot-triggered pull_request_review_comment runs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(claude): address ci-fix self-loop and fork PR security - Replace Claude Code name prefix check with explicit job name list to correctly prevent self-loops (check_run names for inlined workflows are bare job names, not workflow-prefixed) - Add fork PR trust gate in Resolve PR number step: verify head repo matches target repo before running Claude with privileged credentials Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: replace inlined claude.yml with standard thin-caller stub The inlined version embedded all three jobs (claude, claude-ci-fix, claude-issue) directly and threaded DON_PETRY_BOT_GH_PAT through checkout tokens and github_token, causing the bot's PAT to author PRs and comments instead of github-actions[bot]. Replace with the standard thin caller that delegates to the org-level reusable workflow (claude-code-reusable.yml@v1) via secrets: inherit, which is the correct pattern per: petry-projects/.github/standards/workflows/claude.yml * ci: pin dependabot-automerge reusable workflow to SHA (#130) Pin petry-projects/.github reusable workflow from @v1 to commit SHA 0cb4bba11d7563bf197ad805f12fb8639e4879e4 to satisfy the action-pinning compliance policy. Closes #116 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix: replace gh copilot suggest with GitHub Models REST API (#151) * fix: replace gh copilot suggest with GitHub Models REST API (#147) The `gh copilot suggest -p "$(cat <file>)"` invocation failed with "Invalid command format" because: 1. The `-p` flag is not valid syntax in modern `gh copilot` built-in versions. 2. `gh copilot suggest` is a shell-command suggestion tool; it does not accept large PR prompts or return structured JSON responses. 3. Passing a multi-thousand-line prompt via `$(cat ...)` can hit ARG_MAX. The non-zero exit was then misclassified by the rate-limit detector, which aborted the entire session and skipped all remaining PRs in the queue. Fix: replace all three copilot invocations (run_triage, run_agentic, run_duck) with a new `copilot_chat` helper that calls the GitHub Models REST API directly via curl. The API is OpenAI-compatible, versioned via `X-GitHub-Api-Version`, stable against gh CLI version changes, and accepts arbitrary prompt sizes using python3 for safe JSON encoding. Additional changes: - Add `COPILOT_API_MODEL` var (default `openai/o4-mini`) overrideable via env. - run_agentic/run_duck copilot cases now also write output to $OUTPUT_FILE so callers that check that path directly (deep review, audit) find the JSON. - Rate-limit responses (HTTP 429) are echoed to stdout so the existing `is_rate_limited()` detector fires correctly for engine fallback. - Add pre-flight smoke test in review-batch.sh: tests GitHub Models API connectivity with a one-liner prompt before processing any PRs, so auth or model errors surface immediately as a clear setup failure. - Add tests/test_copilot_chat.sh: unit tests for the JSON payload builder with edge-case prompts (quotes, newlines, # headings, large diffs, Unicode). Closes #147 Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * fix: scope COPILOT_API_MODEL export to copilot engine only Move the `export COPILOT_API_MODEL` from the common exports block into the `copilot)` case where the variable is set, so it is not exported as an empty/unset variable when the engine is `claude` or `gemini`. The `copilot_chat` fallback `${COPILOT_API_MODEL:-openai/o4-mini}` …

The review-one-pr.sh script already exits with code 100 for no-ops, but the workflow was counting them toward MAX_PRS budget. Now: - Review loop processes ALL candidates (not truncated to MAX_PRS) - Only non-no-op PRs count toward the MAX_PRS budget - Loop stops after MAX_PRS actual reviews are posted - This unblocks the backlog from being stuck on already-reviewed PRs Fixes #7 (completes PR #10)

… default `claude` engine — `COPILOT_API_MODEL: unbound variable` (#774) * Add scheduled PR review agent Hourly GitHub Action that enumerates open PRs (authored by or review-requested from @me), classifies risk via Claude Code, and auto-approves LOW/MEDIUM PRs that pass quality gates while escalating HIGH-risk or gated PRs for human review. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Use Claude Code OAuth token instead of API key Routes agent runs through the Max plan subscription rather than per-token API billing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Enforce single-PR scope and default to dry-run - Prompt now hard-forbids enumeration commands and acting on any PR other than $PR_URL. Earlier dry-run revealed the agent was reviewing the entire backlog in a single invocation, ignoring the per-PR loop. - DRY_RUN now defaults to true unless repo variable LIVE_MODE=true, so the hourly cron is safe by default until the operator opts in. - AGENT.md documents the LIVE_MODE switch and corrects PAT scopes (Issues needs write to create the needs-human-review label). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add 3-model council + commit-SHA-aware iterative review The single-prompt reviewer is replaced by a council of 3 Claude models, each with a focused lens, and a synthesizer that combines them: - Security (Opus 4.6) - auth, secrets, injection, supply chain - Correctness (Sonnet 4.6) - logic, issue alignment, tests, CI - Maintainability (Haiku 4.5) - standards, conventions, clarity - Synthesizer (Sonnet 4.6) - max risk, escalate-if-any, dedupe, post Council members run in parallel, write JSON verdicts to /tmp/council/, and never touch GitHub. The synthesizer is the only actor that posts. Every posted review embeds an HTML marker on line 1:  scripts/review-one-pr.sh checks for that marker before spending tokens: - Marker SHA == current head SHA -> skip (already reviewed). - Marker SHA != current head SHA -> re-review (handles iterative cycles). - No marker -> first review. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Upgrade maintainability lens from Haiku 4.5 to Sonnet 4.6 Haiku couldn't follow the agentic instructions — it asked for env vars instead of reading them and executing the gh commands. All three council members now use models capable of multi-step tool use. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Go-live improvements for PR review agent (#2) - Upgrade actions/checkout v4→v5 (Node.js 20 deprecation) - Add MAX_PRS cap (default 10) to stay within 60-min job timeout - Filter drafts at enumeration (--draft=false) - Fix jq operator-precedence bug in idempotency check - Add truncation notice log, inline jq comments, docs updates Council-reviewed: 2 rounds (escalated round 1 on jq bug, approved round 2) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude delegation, auto-merge, and rebase handling (#3) - Post structured fix-request comments on escalated PRs in Claude-enabled orgs - Claude's workflow trigger picks up the comment automatically (no @claude tag) - On approval: auto-merge (--auto --squash), rebase if behind, remove label - Cycle guard (MAX_REVIEW_CYCLES=3) prevents infinite delegation loops - New repo variables: CLAUDE_ORGS, MAX_REVIEW_CYCLES Council-reviewed: dispatch hit rate limit but architecture validated against petry-projects/.github claude-code-reusable.yml workflow — event flow confirmed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Optimize review: small-PR and incremental fast paths (#4) * Add review mode optimization: small-PR and incremental fast paths PRs are now routed to the cheapest review path: - Small PRs (<10 lines): single Opus call (1 invocation vs 4) - Re-reviews (prior marker at different SHA): single Opus call with prior review context, focused on what changed since last review - First review of non-small PRs: full 3-member council (unchanged) New files: - prompts/single-review.md: combined council+synth prompt for single reviewer mode, handles both small and incremental paths New config: - SMALL_PR_THRESHOLD repo variable (default 10) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Replace parallel council with cascading review tiers Haiku triage → Sonnet deep review → Opus security audit, where each tier only fires if the previous one escalated. This replaces the 3-parallel-members + synthesizer architecture. Cost impact: - ~80% of PRs: Haiku + Opus confirm (2 calls, ~30s vs 4 calls, ~5 min) - ~15%: + Sonnet (3 calls, ~2.5 min) - ~5%: full cascade (4 calls, ~5.5 min) Haiku works by receiving pre-fetched context (no tool use needed), which sidesteps the agentic limitations found earlier. New files: - prompts/triage.md — Tier 1: Haiku fast classification - prompts/deep-review.md — Tier 2: Sonnet full review - prompts/security-audit.md — Tier 3: Opus security audit - prompts/cascade-action.md — posts review from any resolving tier Re-reviews (prior marker at different SHA) pass prior review context to the triage, enabling faster incremental checks. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix review council findings: 4 major + 3 minor issues Major fixes: - Replace invalid 'repository' gh field with 'headRepository'/'headRepositoryOwner' across script and all prompts - Add 'triage-approved' as valid REVIEW_MODE in single-review.md with dedicated mode description - Fix PRIOR_REVIEW_BODY selector: head -1 → tail -1 to match most-recent SHA - Update dangling 'synthesize.md step 9a' reference to cascade-action.md Minor fixes: - Validate PRIOR_REVIEW_BODY contains marker before exporting (anti-injection) - Write prior review body to temp file to avoid E2BIG on large reviews - Remove dead SONNET_RC=$? variable; add || true for set -e safety - Delete orphaned prompts/council/ files (no longer referenced by cascade) - Fix incremental-mode compare command: document how to derive owner/repo from headRepository metadata Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add Claude Code workflow (#8) Implement the org-level reusable workflow caller pattern from petry-projects/.github. This thin caller delegates all logic to claude-code-reusable.yml and triggers on PR events, issue comments, and labeled issues. Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * feat: add Copilot engine support via REVIEW_ENGINE toggle (#5) * feat: add Copilot engine support via REVIEW_ENGINE toggle Abstract LLM invocation into scripts/engine.sh so both Claude and Copilot engines use the same cascade logic, prompts, and actions — just different CLIs and model families. Key changes: - scripts/engine.sh: new LLM abstraction layer with run_triage/run_agentic dispatching to claude or copilot CLI based on REVIEW_ENGINE variable - scripts/review-one-pr.sh: refactored to source engine.sh, engine-agnostic variable names (DELEGATION_ORGS, AI_DELEGATION_ENABLED, DEEP/AUDIT tiers) - All prompts updated: engine-agnostic tier names, ENGINE_LABEL footers, removed hardcoded model names from prose - Workflow: conditional CLI install, REVIEW_ENGINE/COPILOT_GITHUB_TOKEN vars, DELEGATION_ORGS with CLAUDE_ORGS backward compat fallback - AGENT.md/README.md: documented both engine options and setup Model mapping: Triage: Haiku 4.5 / GPT-5-mini Deep: Sonnet 4.6 / GPT-5.2 Audit: Opus 4.6 / GPT-5.4 Action: Sonnet/Opus / GPT-5.2/5.4 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update prompts/cascade-action.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update prompts/cascade-action.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: address PR review comments - Fix Copilot CLI install to use gh extension instead of npm - Replace speculative GPT-5 models with verified identifiers (gpt-4o-mini, o1, o1-pro) - Fix cascade-action.md deprecated alias to reference CLAUDE_ENABLED - Change 'Claude delegation' to 'AI delegation' in synthesize.md - Add triage-approved to mode schema in single-review.md - Align log label with JSON field in review-one-pr.sh - Remove unused SMALL_PR_THRESHOLD from workflow - Add $OUTPUT_FILE to inputs in deep-review.md and security-audit.md Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * feat: update to latest GPT-5 models for Copilot engine - Use gpt-5-mini for triage (lightweight, faster) - Use gpt-5.2 for deep review and action (improved reasoning) - Use gpt-5.4 for security audit and single reviewer (most advanced) Based on latest GitHub Copilot model support in 2025-2026. Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> * feat: inline Claude Code workflow to access repo secrets directly (#9) Replaces the thin org-level reusable workflow caller with the full inlined workflow so CLAUDE_CODE_OAUTH_TOKEN and GH_PAT_WORKFLOWS can be accessed from this repo's own secrets. Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: cross-engine adversarial rubber duck review (#11) * feat: add cross-engine adversarial "rubber duck" review to PR cascade At tier 2, the deep review now runs in parallel with an adversarial "rubber duck" reviewer from the opposite engine (Claude↔Copilot). A synthesis step merges both verdicts before deciding to approve or escalate. Different model families catch different blind spots — this approach closes ~75% of the performance gap between tiers. Graceful degradation: if the rubber duck fails (missing creds, CLI unavailable), the cascade continues with the primary review only. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address rubber duck review findings and Copilot comments - Strip opposing engine credentials in run_duck to prevent cross-engine secret leakage (CLAUDE_CODE_OAUTH_TOKEN/COPILOT_GITHUB_TOKEN) - Add timeout 300 to both duck CLI paths to prevent hangs - Add $OUTPUT_FILE to rubber-duck.md inputs section - Add TIER2_RESULT alias at tier 3 handoff (documents combined vs deep) - Fail fast on primary CLI install; || true only for duck engine - Add default/error branch to run_duck case statement - Fix final_risk → risk terminology in synthesize-duck.md - Add explicit severity bump mapping (info→minor, minor→major) - Set DUCK_VALID=false on synthesis fallback for accurate FINAL_TIER - Kill duck process early if deep review fails to avoid wasted latency Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: filter already-reviewed PRs from backlog to unblock queue * docs: clarify PR review batching issue * fix: complete PR #10 fix - don't count no-ops toward MAX_PRS budget The review-one-pr.sh script already exits with code 100 for no-ops, but the workflow was counting them toward MAX_PRS budget. Now: - Review loop processes ALL candidates (not truncated to MAX_PRS) - Only non-no-op PRs count toward the MAX_PRS budget - Loop stops after MAX_PRS actual reviews are posted - This unblocks the backlog from being stuck on already-reviewed PRs Fixes #7 (completes PR #10) * feat: CI gate + poll-loop rebase wait across all review prompts (#14) * feat: CI gate + poll-loop rebase wait across all review prompts 1. CI gate (review-one-pr.sh step 1b): skip PRs with failing or in-progress checks before spending any LLM tokens. Exits with code 100 (no-op sentinel) so skipped PRs don't count against the MAX_PRS budget. Empty statusCheckRollup (no CI) is treated as passing. 2. Poll loop (cascade-action, single-review, synthesize): replace the fixed sleep with a bounded poll (6×5 s) that exits as soon as mergeStateStatus is no longer BEHIND, eliminating the race between update-branch and the subsequent auto-merge call. 3. Triage cleanup: remove the now-redundant "no failing CI" criterion since failing-CI PRs are blocked by the shell gate before triage runs. Renumber remaining criteria. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address Copilot review comments + document bot account setup review-one-pr.sh: - Combine headRefOid + statusCheckRollup into a single gh pr view call to reduce API calls and rate-limit exposure - Tighten CI classification to strict-success: pending check first, then require ALL items to be SUCCESS/passing — any other conclusion (NEUTRAL, SKIPPED, STALE, STARTUP_FAILURE, etc.) now counts as failing rather than silently passing through - Clarify exit-code 100 comment to reflect its broader "skip sentinel" meaning (already-reviewed, ci-failing, ci-pending) prompts (cascade-action, single-review, synthesize): - Initialise REBASE_STATUS="BEHIND" before the poll loop so the variable is always set; add explicit post-loop guard — if still BEHIND after 30s, skip auto-merge entirely and let the next cycle retry AGENT.md: - Document the reviewer identity constraint (self-approval is blocked) - Add step-by-step bot account creation and classic PAT setup instructions - Renumber existing setup steps 2→3, 3→4, 4→5 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: filter failing/pending CI PRs at enumeration stage in list-prs.sh Add --checks passing to both gh search prs queries so PRs with failing or in-progress CI never enter the candidate pool. Previously they were fetched, consumed a CANDIDATE_LIMIT slot, and only skipped once review-one-pr.sh ran the per-PR CI gate. Two-layer defence now: 1. list-prs.sh — --checks passing excludes them from the candidate list 2. review-one-pr.sh — strict jq CI gate catches anything that slips through (e.g. PRs passed via PR_URL_OVERRIDE) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: treat SKIPPED/NEUTRAL CI conclusions as passing; drop admin:org scope review-one-pr.sh: - Extend is_success to include SKIPPED and NEUTRAL conclusions alongside SUCCESS. SKIPPED covers path-filtered workflow jobs (e.g. claude-issue skips on non-issue events); NEUTRAL covers informational checks that don't gate merging. Both were previously falling through to "failing", permanently blocking review of any PR with a skipped check. AGENT.md: - Remove admin:org from the bot PAT scope recommendation. The scope is not needed for PR approval or auto-merge — repo scope is sufficient. admin:org grants full org administration (member management, billing, team settings) which is excessive blast radius for a review bot token. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: replace --checks passing with --checks success in list-prs.sh (#15) GitHub CLI changed the valid values for `gh search prs --checks` from accepting "passing" to only allowing {pending|success|failure}. All workflow runs have been failing since this change with: invalid argument "passing" for "--checks" flag: valid values are {pending|success|failure} "success" is semantically identical to the old "passing" — it filters to PRs where all CI checks have completed with a passing status. Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: update repo references from self to pr-review-agent * feat: add car-hunt skill for used vehicle research and ranking CPM-based (cost per remaining mile) ranking of Honda/Toyota listings across AutoTrader, CarGurus, and Facebook Marketplace. Includes live reliability research step (Consumer Reports, JD Power, RepairPal, CarComplaints) before searching, NHTSA recall/complaint API deep-dive, and optional Google Sheet write-back. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: fix FB Marketplace links, improve AutoTrader fetch, add Sheets export step - AutoTrader: stop trying to WebFetch JS-rendered search pages; use WebSearch site:autotrader.com to find individual listing URLs, then WebFetch those (they have real HTML data) - FB Marketplace: never output generic placeholder links; use real item URLs if Google indexes them, otherwise surface a manual search URL and one placeholder row explaining why - Step 6: document CSV→Sheets export via Drive MCP create_file, including base64 encoding, column format, and share URL construction Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: add Craigslist as explicit source, enforce real-URL-only link rule - Add Craigslist section with regional sites (bham, huntsville, chattanooga, atlanta), correct search URL pattern with sort/filter params, and WebFetch approach (CL uses plain HTML, works reliably) - Link integrity rule: every Link column value must be a real listing URL from WebFetch/WebSearch or a manual search URL clearly labeled — never a homepage, never a constructed/guessed URL - Update WebSearch fallback section to cover all sources uniformly Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: split zip/radius questions, rename MAX_MILES to MAX_ODOMETER Question 4 was ambiguous — users confused "Max miles?" (meant odometer) with search radius. Now asks zip and radius as separate questions (#4 and #5) and renames the variable to MAX_ODOMETER with explicit "(highest mileage on the car itself)" clarification. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: include self-authored PRs awaiting review in agent enumeration (#16) * fix: fix Craigslist link approach, add date_posted with 21-day staleness filter Craigslist search pages are JS-gated so WebFetch fails; switch to WebSearch (site:craigslist.org) as primary approach, with direct URL as fallback. Add date_posted field to every listing and drop any listing posted more than 21 days ago as likely-sold. Also fix MAX_MILES → MAX_ODOMETER in the Craigslist search URL template. Add Posted column to ranked table and Step 6 sheet schema. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: include self-authored PRs awaiting review in agent enumeration Remove --checks success filter from authored PR search to include PRs that require code review (e.g., compliance fixes). CI validation still occurs per-PR in review-one-pr.sh as a second layer of defence. This enables the review agent to detect and approve self-authored PRs that are blocked by review requirements but have passing CI checks. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add doors/transmission fields, update-mode sheet, fix CarGurus/Craigslist approach - Fix CarGurus URL section: direct URL pattern 404s, switch to WebSearch-first approach - Fix Craigslist primary: regional page WebFetch with pagination (was site: WebSearch which returns category pages) - Add doors (2/4) and transmission (Auto/Manual) to data extraction, output table, and sheet schema - Add exhaustive coverage mandate: paginate all sources, never stop early, report coverage in output - Add AutoTrader outage handling: note 503 in summary, fall back to WebSearch cache - Add update mode for Step 6: single persistent sheet, deduplicate by URL, mark stale listings - Update sheet columns to include Doors/Trans; fix MIME type note (text/csv only, not xlsx) - Update scheduling defaults: ZIP=35243, RADIUS=200, MAX_PRICE=6000, YEAR_MIN=2002, MAX_ODOMETER=250000 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add hard disqualification filters for finance-speak, title issues, and scam signals Skip any listing mentioning down/monthly payments, no title/lien/salvage, or scam contact redirects (broken messenger, email-only, urgency pricing). Log disqualified listings separately rather than silently dropping them. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add Distance to Car field using Nominatim geocoding + Haversine formula Geocode user ZIP and each listing city via free Nominatim API (no key needed), compute straight-line distance × 1.3 road correction factor, display as "~X mi" in output table (Dist column) and sheet schema. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address low result count — batch URL extraction, preview-filter before fetch, target 50+ raw Score candidates from search-page preview data first to avoid fetching every listing page; only deep-fetch those passing price/mileage preview. Clarifies why ~15 results was happening and mandates 50+ raw candidates. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: make cascade-action prompt explicit about gh pr review --approve The agent was posting comments instead of approval reviews because the prompt was too high-level. Rewritten step 5 to contain explicit bash code blocks that the agent can directly execute, with clear use of: - gh pr review --approve (not gh pr comment) - Proper body passing via temp file to handle newlines/special chars - Explicit variable extraction and idempotency checks This ensures the review posts as an APPROVED review, not a COMMENTED review, so GitHub branch protection recognizes it and auto-merge triggers. * improve: make cascade-action body composition and escalation more explicit - Fix variable expansion in escalation comment by using COMMENT_END instead of 'COMMENT' - Make step 4 explicit with bash code that extracts JSON fields and builds body - Handle findings array iteration and formatting with jq - Support cross-engine agreement section only when tier is deep+duck - Use temp file for comment composition to handle variables correctly * refactor: move review posting logic from agent prompts to bash script This addresses the critical issue where the agent was posting comments instead of approval reviews. Instead of relying on the agent to execute bash commands correctly, we now: 1. Have the agent generate only the verdict JSON with the review body 2. Use a new post-pr-review.sh script to handle all GitHub interactions 3. This removes the ambiguity about whether to post as review or comment Changes: - New scripts/post-pr-review.sh: handles review posting, rebasing, auto-merge, labels - Simplify cascade-action.md: agent just outputs verdict JSON, doesn't post - Simplify single-review.md: agent just outputs verdict JSON, doesn't post - Update review-one-pr.sh: capture verdict JSON and call post-pr-review.sh The verdict JSON includes the complete review body, so the agent can still compose the full markdown review. The bash script handles all GitHub interactions (posting reviews, enabling auto-merge, managing labels). This is more reliable because bash + gh CLI is deterministic, while agent behavior is less predictable. * add: cleanup script to fix PRs with comment approvals instead of review approvals Script identifies PRs that have the agent's marker comment but no actual approval reviews (symptom of the original bug), and posts proper approval reviews + enables auto-merge. Usage: bash scripts/fix-stuck-prs.sh [dry_run=true|false] * fix: cleanup script now requires bot account token GitHub blocks self-approvals, so cleanup must run with the bot account's GH_TOKEN (petry-review-bot), not the PR author's token. * add: workflow to fix stuck PRs using bot account token Allows running the cleanup script via workflow_dispatch with access to GH_PAT (bot account token) from repo secrets. * fix: pass GH_PAT to checkout action so workflow uses bot account * debug: simplify account check, add authentication debug output * docs: add comprehensive petry-review-bot setup instructions * docs: add GitHub App setup guide (recommended approach) GitHub App is the secure, recommended way to automate PR reviews: - Fine-grained permissions - JWT tokens that auto-expire - No human account needed - Better audit trail - GitHub's recommended approach Replaces the bot user account approach with a more secure alternative. * docs: add comprehensive GitHub App setup documentation - SETUP.md: Quick reference guide with configuration and troubleshooting - IMPLEMENTATION.md: Technical deep dive on architecture and design decisions - DOCUMENTATION.md: Index of all documentation files - Updated README.md with status and quick links - Updated GITHUB_APP_SETUP.md with implementation notes and actual app ID - Workflows use GitHub App token generation instead of static PATs Covers the transition from bot user account to GitHub App authentication for improved security and maintainability. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: silence auth check in fix-stuck-prs when using GitHub App token GitHub App tokens don't have user scope, so 'gh api user' returns 403. This is fine - the script still works for PR operations. Suppress the error so the script completes successfully with app-token fallback label. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: use explicit author instead of @me in stuck PR search GitHub App tokens don't have user identity, so @me search doesn't work. Use explicit 'don-petry' author instead to find PRs to fix. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: avoid subshell in while loop to preserve variable state Using pipe in while loop created subshell where PROBLEM_PRS and FIXED_PRS counters were incremented but changes didn't persist to parent shell. Fixed by using process substitution for input instead of pipe. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * docs: add comprehensive status report for GitHub App setup - Overview of completed work - GitHub App authentication details - 24 stuck PRs successfully fixed with approval reviews - Architectural decisions and rationale - Configuration guide and usage examples - Known limitations and troubleshooting System is now fully operational with GitHub App token authentication, comprehensive documentation, and all infrastructure in place. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * docs: document stuck PR cleanup status and script fixes Added documentation for: - GitHub App token compatibility fixes in fix-stuck-prs.sh * Changed @me to explicit author (app tokens have no identity) * Fixed subshell variable scope (process substitution vs pipe) * Silenced expected 403 auth check error - Current status: 24 PRs have approvals but remain OPEN * Auto-merge failed due to missing GitHub App permission * Approvals satisfy branch protection requirement * Next: expand permissions or manually merge Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: update list-prs.sh to search all repos by owner instead of @me GitHub App tokens don't have user identity, so @me/@review-requested searches fail. Changed to enumerate all repos in don-petry and petry-projects, then search for open PRs within each repo. This covers the full scope: - All open PRs in personal don-petry repos - All open PRs in petry-projects org repos Resolves 6 consecutive workflow failures due to zero PRs being enumerated. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * docs: add investigation report for PR review agent workflow failures * fix: move env section before steps in workflow to fix YAML structure GitHub Actions requires env section to come before steps in job definition. Moving env definition up and setting GH_TOKEN only in steps that need it. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * script: add backfill-approvals to retroactively apply real approvals Converts PRs with agent approval comments (but no real GitHub approvals) to have actual APPROVED reviews. Needed for PRs reviewed before the gh pr review --approve fix was applied. Usage: scripts/backfill-approvals.sh # dry-run (preview changes) scripts/backfill-approvals.sh false # apply real approvals Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * feat: add backfill-approvals workflow to run as GitHub App bot Runs backfill-approvals.sh via GitHub Actions so the approvals are posted by the bot identity, not the PR author — GitHub rejects self-approvals. Also fixes subshell counter bug in the script (piped while loop lost variable state; switched to process substitution). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: convert inner while loop to process substitution to preserve counters Both the outer repo loop and inner PR loop were piped subshells, causing all counter increments (approved/skipped/failed) to be lost. The summary always showed 0. Fixed by using < <(...) process substitution for both loops. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * car-hunt: add VIN-deep-dive flow, printable checklists, location-tier ranking - Step 5.5 pre-test-drive flow: NHTSA VIN decode + per-VIN unrepaired-recall automation via Chrome MCP (Honda LWC owner portal documented as not automatable; NHTSA web form works). - §F printable test-drive checklist generator (reportlab/Platypus PDF) with cold-start, model-specific red flags, negotiation table, walk-away rules. - §G fraud / paperwork verification checklist (vehicle-agnostic, reusable): walk-away triggers, VIN three-location match, curbstoning, odometer fraud, bill of sale, title transfer, payment protection, stolen-vehicle, title- jumping, after-purchase steps. - Step 5.25 head-to-head comparison template with information-asymmetry rule. - Step 3 Location Quality Tier scoring (Birmingham AL metro table A/B/C/D) with adj-CPM modifier; sheet schema gains Adj.CPM + Tier columns. - Hard-disqualification rules added: non-running engine keywords, mileage inconsistency, mandatory description scrape. - Drive MCP overwrite limitation documented; sheet ID now read from memory rather than hardcoded. - FB Marketplace operational facts: Birmingham AL city ID 107739635926718, /search? vs /vehicles? query handling, React-controlled inline composer, send-button selector, seller-name extraction regex. - scheduled-tasks/used-car-search-{morning,afternoon}: tier A/B priority flag, sheet ID read from memory. - Reference PDF generator scripts checked in for reuse. * fix: re-approve PRs where approval predates last commit (stale approval) Instead of skipping PRs that already have any APPROVED review, skip only those where reviewDecision is not REVIEW_REQUIRED. This handles PRs where a bot approval was posted before a new commit was pushed — GitHub's ruleset engine treats those approvals as stale even with dismiss_stale_reviews=false. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: robustly extract JSON verdict from mixed claude --print output (#17) Claude's --print mode can prefix the JSON verdict with conversational preamble text, causing jq to fail with parse errors. Add extract_verdict_json to engine.sh and wire all three cascade action call sites in review-one-pr.sh to use it. Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * fix: extract_verdict_json — check dest file first (agent Bash-write style) The cascade-action agent writes its verdict JSON to \$OUTPUT_FILE via a Bash tool call, then prints a text summary to stdout. The previous fix only scanned stdout (the .raw file), which contained no JSON. The agent- written file at \$dest (= \$OUTPUT_FILE) was already correct — just not checked. Now check \$dest first before falling back to stdout scan. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Enforce MAX_REVIEW_CYCLES cap before running the cascade (#18) * fix: enforce MAX_REVIEW_CYCLES cap with human-escalation marker Previously MAX_REVIEW_CYCLES only gated AI delegation in post-pr-review.sh — the cascade itself ran on every cron tick regardless of how many cycles had accumulated. Real-world result: a PR could rack up 9+ review cycles (we observed exactly that on ContentTwin#100) before any cap took effect. Add a pre-cascade check in review-one-pr.sh: when the count of existing `` markers is at or above MAX_REVIEW_CYCLES (default 3), post one escalation comment marked ``, label needs-human-review, request don-petry, and exit 100 (skip sentinel — doesn't burn the MAX_PRS budget). The escalation marker doubles as the no-spam guard: subsequent runs detect it and exit 100 immediately. Also reuse a single `gh pr view` for both the cycle count and the escalation-marker check. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * review feedback: surface escalation-comment failures, drop dead unset - Drop `2>/dev/null || true` on `gh pr comment` so a failed escalation post is visible in the workflow log instead of silently leaving the PR with no marker (which would re-trigger the cap path next tick). - Reword the cycle-count comment from "AI delegation loops" to "review loops" — the cap also catches cascade-only loops where every cycle approves and a new commit lands before merge. - Remove the redundant `unset PR_BODIES` — never exported, no leakage. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * Reliability hardening: session circuit breaker, timeouts, retry, dedup (#20) * feat: session circuit breaker, per-tier timeouts, retry, and triage hard-fail Reliability hardening for the PR review agent. 1. Session circuit breaker (.github/workflows/pr-review.yml): on any non-zero, non-100 exit from review-one-pr.sh (general failure or rate limit on the fallback engine), break the per-PR loop, log a clear error annotation naming the failing PR and reason, and exit the step with code 1 so the run shows red. Prevents one systemic problem from silently burning the entire candidate pool. 2. Per-tier timeouts (scripts/engine.sh): triage/deep/audit/action/duck each get their own bounded timeout (180/600/600/300/300s defaults, env-overridable). Previously only the duck had a timeout — a hung tier could burn the whole 60min job budget. 3. Retry-with-backoff on transient errors (scripts/engine.sh): triage retries once on 124/137/143 (timeout / signal kill) since its caller captures stdout via $(...) so retries are safe. Deliberately NOT applied to run_agentic/run_duck where stdout is redirected to a file — a retry there would corrupt the partial first-attempt output. 4. Triage non-JSON now hard-fails (scripts/review-one-pr.sh): replaces the silent fallback that synthesized a fake "escalate=MEDIUM" verdict and proceeded to deep review. With the new circuit breaker, loud failure is the right call — masking a broken triage was burning tokens on every PR while the workflow looked healthy. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: stop stacking duplicate agent reviews on the same PR Two bugs were causing the agent to leave multiple comments on the same PR. Together they produced 10 stacked APPROVED reviews on petry-projects/ContentTwin#100. Bug A — idempotency check is order-dependent (review-one-pr.sh): The previous marker-discovery code did: ((.reviews // []) + (.comments // [])) | .[].body | grep marker | tail -1 This relies on the array concatenation order, not chronological order. When old agent comments existed alongside newer agent reviews, tail -1 picked the comment-array marker (older) over the review-array marker (newer), causing the script to think the head SHA hadn't been reviewed and re-run. Replaced with a single jq pipeline that tags each item with submittedAt / createdAt, sorts by timestamp, and takes the actual most-recent marker. Bug B — no cleanup of prior agent items (post-pr-review.sh): After successfully posting a new review/comment, prior agent items were left in place, accumulating forever. Added mark_prior_agent_items_obsolete which, after a successful post: - dismisses prior APPROVED/COMMENTED/CHANGES_REQUESTED agent reviews via the GitHub dismissal API (UI shows them struck-through as Dismissed) - edits prior agent comments to wrap their body in a collapsed <details> block with a "Superseded by re-review at <SHA>" summary, plus a `` sentinel for idempotency All cleanup API calls are best-effort — failures don't break the workflow. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(cleanup): warn on API failures, preserve global newest, file-stage JSON Three fixes to mark_prior_agent_items_obsolete from the review of PR #20: 1. ::warning:: annotations on every cleanup API failure (review/comment list-fetch, individual review dismissal, individual comment fetch+edit). Previously these were silenced with `|| true`, so a permissions change on the dismissal endpoint would let duplicates stack indefinitely with no signal in the Actions UI. Cleanup is still non-fatal — the new post has already landed — but failures are now visible. 2. Preserve the globally-latest agent item across BOTH categories, not the newest of each category separately. The earlier code split reviews and comments and applied `[:-1]` to each, which left a stale fix-request comment in place when the new post was a review (or vice versa). The one-off cleanup of ContentTwin#100 hit exactly this case: 12 stacked reviews collapsed to 1, but a stale comment from 2026-04-25 (SHA cd9132d6) was preserved as "newest comment" even though the latest review at SHA 3af8c8ee was newer overall. Now: compute the max timestamp across both feeds, exclude items at that timestamp. 3. Stage API responses to disk (`mktemp` + `jq <file>`) instead of routing through `--argjson "$var"`. The old approach broke on rare unescaped control chars in user-authored comment bodies (jq refused to parse the resulting shell-vared JSON). File-based input sidesteps the shell pipeline entirely. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * Remove car-hunt skill and scheduled tasks (moved to don-petry/don-petry) (#21) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: apply Copilot fallback hardening and reuse GH_PAT for Copilot auth - Use secrets.GH_PAT (existing personal account token with Copilot subscription) instead of a separate COPILOT_GITHUB_TOKEN secret - Pin actions/create-github-app-token to SHA (v3.1.1) for supply chain safety - Add post-install verification for gh-copilot extension with warning on failure - Guard Copilot fallback path: skip PR gracefully if extension is not installed Addresses issue #24 workflow fixes (1-3) that could not land via PR #25 due to GitHub App lacking workflows permission. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: switch Copilot engine to gh built-in and fix app-id deprecation - Remove gh extension install (github/gh-copilot conflicts with built-in alias) - Replace with gh copilot --version check using COPILOT_GITHUB_TOKEN (GH_PAT) - Update all engine.sh copilot invocations from bare `copilot` binary to `gh copilot suggest --target shell` with GH_TOKEN overridden to GH_PAT so the user token (with Copilot subscription) is used, not the App token - Fix actions/create-github-app-token: app-id → client-id (same secret value, just the renamed input in v3.x) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: harden Copilot fallback path and remove stale worktrees (#25) - gh-copilot install: add --force flag and post-install verification warning so silent failures due to built-in alias conflict are visible in workflow logs instead of being silently swallowed by `|| true` - fallback pre-flight check: verify `gh extension list | grep copilot` before switching to Copilot engine; if unavailable, skip the PR and continue the batch rather than session-aborting and dropping all remaining candidates (fixes the 27-PR drop on run #503) - pin actions/create-github-app-token to SHA for v3.1.1 (Node.js 24 compatible) to prevent hard break on 2026-06-02 when GitHub forces Node.js 24 as default runtime - remove 6 stale Claude Code worktrees from git tracking; add .gitignore entry to prevent future worktrees from being committed (eliminates exit-128 warning on every actions/checkout post-job sweep) Closes #24 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: petry-projects-pr-review-agent[bot] <petry-projects-pr-review-agent[bot]@users.noreply.github.com> * ci: add pre-flight dedup check to prevent duplicate claude-issue PRs (#26) Before invoking Claude on a labeled issue, a new shell step queries for any open PR with a branch matching claude/issue-NNN-* (or a body containing "Closes #NNN"). If one is found it posts a comment on the issue pointing to the existing PR and skips the Claude step entirely. A secondary prompt instruction tells Claude to check first and push to the existing branch rather than opening a new PR. Motivated by issue petry-projects/google-app-scripts#171, where the claude label was re-applied three times and each run created a fresh PR unaware of the prior attempts. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor: migrate to machine user PAT auth (closes #27) (#28) * refactor: migrate from GitHub App to machine user PAT auth Closes #27 GitHub Apps cannot be listed in CODEOWNERS, blocking PRs in repos with require_code_owner_review: true. Switch all workflows to use a machine user account's fine-grained PAT (DON_PETRY_BOT_GH_PAT secret), which can join an org team listed in CODEOWNERS. Workflows: removed actions/create-github-app-token steps in pr-review, fix-stuck-prs, backfill-approvals, and daily-pr-review-health. All now use secrets.DON_PETRY_BOT_GH_PAT directly. Docs: renamed GITHUB_APP_SETUP.md to MACHINE_USER_SETUP.md with full rewrite covering account creation, CODEOWNERS config, PAT generation, and rotation. Updated auth sections in IMPLEMENTATION.md, SETUP.md, STATUS.md, DOCUMENTATION.md, README.md. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor: switch to org-scoped PAT secret DON_PETRY_BOT_PETRY_PROJECT_PAT Replace DON_PETRY_BOT_GH_PAT with DON_PETRY_BOT_PETRY_PROJECT_PAT — the new fine-grained PAT scoped to the petry-projects org (resource owner = petry-projects). The previous PAT was scoped to the donpetry-bot personal namespace and had no repository access. The old DON_PETRY_BOT_GH_PAT secret is retained for any future use against don-petry's personal repos. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore: ignore .claude/scheduled_tasks.lock state file --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * refactor: merge approval repair scripts into single automation - Consolidate backfill-approvals.sh and fix-stuck-prs.sh into repair-pr-approvals.sh - Iterate all repos in both orgs instead of assuming author - Verify no existing APPROVED review before posting - Copy original agent comment as review body - Enable auto-merge when posting approval if needed - Single workflow with 30-min timeout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add @mention trigger for on-demand PR reviews (#30) Adds repository_dispatch support so commenting @petry-review-bot on any PR fires an immediate review without waiting for the hourly schedule. - pr-review.yml: new `repository_dispatch` trigger (type: pr-review-mention), per-PR concurrency group for mention runs, FORCE_REVIEW and DRY_RUN env vars that handle both workflow_dispatch and repository_dispatch paths - review-one-pr.sh: FORCE_REVIEW=true bypasses idempotency so a mention always runs a fresh cascade even if the head SHA hasn't changed - templates/mention-listener.yml: deploy to petry-projects/.github; listens for @petry-review-bot, validates commenter trust, posts ack, sends repository_dispatch (requires Contents:write, not Actions:write) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: harden rebase, review dismissal, and health log diagnostics (#40) Addresses 4 code-actionable recommendations from health check report #33: - [CRITICAL] Make rebase/branch-update non-fatal — 403/504 during rebase emits ::warning:: instead of aborting the batch session (#34) - [MEDIUM] Add retry with exponential backoff (3 attempts) for transient 5xx on update-branch API; break immediately on 4xx (#37) - [MEDIUM] Guard review dismissal with state re-check before calling dismiss API, preventing 422s from race conditions (#38) - [LOW] Surface missing log warnings in health check script (#39) - Fix: skip auto-merge when branch is still BEHIND after failed rebase Closes #34, closes #37, closes #38, closes #39 * refactor: migrate to org-wide .github-private convention (#41) * refactor: parametrize hardcoded identity values for org migration Replace all hardcoded references to don-petry, petry-review-bot, and don-petry/pr-review-agent with environment variables that default to the current values. This allows the agent to be configured for different orgs/users via repo variables. Changes: - Scripts use $REVIEWER_USER, $TARGET_ORG, $BOT_USER, $AGENT_REPO - Prompts no longer reference specific GitHub usernames - Workflows use org-level GH_PAT_WORKFLOWS secret instead of repo-level DON_PETRY_BOT_PETRY_PROJECT_PAT - Health check uses context.repo.owner/repo for issue creation - Variables are set in workflow env block with defaults Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: add Copilot custom agent profiles for org-wide use Create /agents/ directory with three agent profiles: - pr-reviewer: Multi-tier cascading PR review - feature-ideator: Feature idea generation and prioritization - compliance-auditor: Org standards compliance checking These are Copilot custom agent profiles that become available org-wide in the .github-private repo convention. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Squashed 'frameworks/bmad-method/' content from commit e36f219c git-subtree-dir: frameworks/bmad-method git-subtree-split: e36f219c81b6010d4aae423ba12f49edb5b6e31a * Squashed 'frameworks/spec-kit/' content from commit 11f49ebf git-subtree-dir: frameworks/spec-kit git-subtree-split: 11f49ebfb2f6af55345cb4bd9a7906acd211e56f * Squashed 'frameworks/gsd/' content from commit 304c1a13 git-subtree-dir: frameworks/gsd git-subtree-split: 304c1a1302564c45af252bbba4bcc5350e7dac3a * docs: update README for .github-private org infrastructure role Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * ci: add dependabot-automerge.yml workflow (#73) Adds the required dependabot-automerge.yml workflow from the org standard template (petry-projects/.github/standards/workflows/). This is a thin caller stub that delegates to the org-level reusable workflow. Closes #48 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * fix(pr-review): unblock queue starvation from self-authored PRs (#96) (#97) * fix(pr-review): unblock queue starvation from self-authored PRs (#96) A self-authored PR sorted first in the candidate list and triggered "Can not approve your own pull request" — which the session-fatal abort treated like an engine error, skipping all 28 remaining PRs on every run. - list-prs.sh: filter out PRs authored by REVIEWER_USER at enumeration - post-pr-review.sh: catch the GraphQL self-approval error and exit 100 (no-op) instead of 1, so a stray self-PR can no longer abort the batch - engine.sh: gh copilot renamed --target to --agent; fix the rubber-duck invocations so tier-2 cross-engine review works again - review-one-pr.sh: stop appending a duplicate "0" to REVIEW_CYCLE when grep -c finds no markers under set -o pipefail (was breaking the cycle-cap integer comparison) https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * fix(pr-review): authenticate as bot, harden enumeration, address review - Workflow now runs as AGENT_USER (default don-petry-bot), distinct from REVIEWER_USER (the human, don-petry). The self-approval rejection that caused #96 came from the agent and the human sharing one identity. - list-prs.sh filters self-authored PRs against AGENT_USER, and validates AGENT_USER against the GitHub username charset before interpolating into the jq filter (Copilot review feedback). - review-one-pr.sh uses printf '%s\n' instead of echo for PR_BODIES, since PR body content is user-authored and could begin with -n/-e or contain backslash escapes (Copilot review feedback). - AGENT.md guideline updated to reflect that self-authored PRs are intentionally excluded (CodeRabbit review feedback). Operator note: rotate the GH_PAT_WORKFLOWS secret to a token owned by don-petry-bot (with read:org added) for the bot-account behavior to take effect at runtime. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * refactor(pr-review): collapse to single BOT_USER, route escalations via CODEOWNERS Drop AGENT_USER and REVIEWER_USER. The workflow now has one identity: BOT_USER (default don-petry-bot), which both owns the repos to scan and gets filtered out as the self-approval blocker. Human escalation no longer hard-codes a single reviewer; instead, scripts/request-codeowners- review.sh parses CODEOWNERS in the PR's repo and requests review from every @user / @org/team mention. - list-prs.sh: BOT_USER for both gh-repo-list and self-author filter - review-one-pr.sh, post-pr-review.sh: replace --user "$REVIEWER_USER" with the CODEOWNERS helper - repair-pr-approvals.sh: same gh-repo-list switch - pr-review.yml: drop AGENT_USER/REVIEWER_USER, set BOT_USER default to don-petry-bot - AGENT.md: updated guideline to describe single-identity model https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * refactor(pr-review): extract batch loop, hoist env, drop redundant step Workflow YAML drops from 231 to 111 lines by moving the per-PR review loop into scripts/review-batch.sh. The script can be syntax-checked and exercised locally; the workflow now just wires env vars and dispatches. - Hoist GH_TOKEN, MAX_PRS, CANDIDATE_LIMIT to job-level env (were repeated on individual steps). - Inline `gh auth status` into the install step; remove the standalone Verify auth step (its only output was a one-line auth dump). - Drop the `if: steps.list.outputs.count != '0'` guard and the step's `id`/output: review-batch.sh handles empty input as a no-op. - Collapse the duplicated summary-string branch in the review loop into a single template with a conditional fragment. No behavior change. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * perf(pr-review): cache claude-code CLI install across runs `npm install -g @anthropic-ai/claude-code` ran on every workflow start (~30s). Switch to a per-user npm prefix (~/.npm-global) and cache that directory via actions/cache, keyed on CLAUDE_CODE_VERSION + runner OS. A `command -v claude` guard makes the install a no-op on cache hit, so the only cost on subsequent runs is the cache restore. CLAUDE_CODE_VERSION defaults to 'latest' (cache persists until manually flushed); set the repo variable to pin a specific version for fully reproducible caching. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig --------- Co-authored-by: Claude <noreply@anthropic.com> * chore: rename GH_PAT_WORKFLOWS secret to DON_PETRY_BOT_GH_PAT (#99) The previous name was generic and didn't tell you which account the PAT belonged to. The new name makes the binding explicit: this secret is the PAT owned by don-petry-bot, used as BOT_USER throughout the PR-review workflows. Operator follow-up before this can be merged: - Add a new repo secret DON_PETRY_BOT_GH_PAT containing the bot's PAT (with repo, workflow, and read:org scopes). - After merge, the old GH_PAT_WORKFLOWS secret can be deleted. Affected workflows: - pr-review.yml (1 use) - claude.yml (4 uses, with || github.token fallback) - daily-pr-review-health.yml (1 use) - repair-pr-approvals.yml (1 use) scripts/pr_review_health.sh's error message is updated to point at the new name as well. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig Co-authored-by: Claude <noreply@anthropic.com> * chore: remove frameworks directory (#101) Co-authored-by: Gemini CLI <gemini-cli@example.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore all erroneously deleted files (items 4-34) (#104) * revert: restore .github/workflows/daily-pr-review-health.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore .github/workflows/repair-pr-approvals.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore agents/pr-reviewer.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/cascade-action.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/deep-review.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/rubber-duck.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/security-audit.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/shared.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/single-review.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/synthesize-duck.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/synthesize.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/triage.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/engine.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/list-prs.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/post-pr-review.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/pr_review_health.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/repair-pr-approvals.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/request-codeowners-review.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/review-batch.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/review-one-pr.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore templates/mention-listener.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore AGENT.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore BOT_SETUP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore DOCUMENTATION.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore IMPLEMENTATION.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore MACHINE_USER_SETUP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore PR_REVIEW_AGENT_FAILURE_REPORT.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore PR_REVIEW_FAILURE_INVESTIGATION.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore SETUP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore STATUS.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore README.md to pre-change state Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore .github/workflows/daily-pr-review-health.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat: add Gemini Pro support and optimize PR review fallback chain (#102) * Merge main and resolve conflicts * Enhance pr-review workflow: add Gemini support and refactor fallback logic * Address Copilot review comments: tighten regex, fix fallback summary, and align docs * docs: move agent documentation to docs/ folder and rename files * docs: align secret names and fix casing in index * docs: organize pr-review-agent documentation under dedicated folder * Address final PR comments: tighten regex, add preflight checks, fix bot names, and cleanup docs --------- Co-authored-by: Gemini CLI <gemini-cli@example.com> * fix(pr-review): gate rate-limit detection on non-zero exit code Broad patterns like `plan.*limit` and `claude.*usage` could match content in a successful triage summary, triggering a false-positive engine fallback. Guard the check with TRIAGE_RC != 0 so it only fires when the provider command actually failed. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix(claude): sync inlined workflow with org standard (#109) * fix(claude): sync inlined workflow with org standard Brings the inlined claude.yml up to parity with petry-projects/.github/.github/workflows/claude-code-reusable.yml. Changes: 1. Bot allow list for pull_request_review_comment Add coderabbitai[bot], Copilot, copilot-pull-request-reviewer[bot], and gemini-code-assist[bot] alongside the existing OWNER/MEMBER/ COLLABORATOR check. These bots have author_association 'NONE' so their review comments were always skipped. 2. check_run trigger + claude-ci-fix job Port the CI failure auto-fix feature from the reusable. When a check fails on a PR, Claude diagnoses and fixes it automatically. Adapted to use DON_PETRY_BOT_GH_PAT (this repo's secret name). 3. claude-code-action SHA bump: v1.0.89 → v1.0.119 Update both the claude and claude-issue jobs. 4. paths-ignore on pull_request trigger Prevents the workflow from firing on PRs that only change claude.yml itself, avoiding the Anthropic OIDC validation failure (workflow file must match default branch at token exchange). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(claude): guard bot allow list against fork PRs Same fix as petry-projects/.github PR #238 — add same-repo guard for bot-triggered pull_request_review_comment runs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(claude): address ci-fix self-loop and fork PR security - Replace Claude Code name prefix check with explicit job name list to correctly prevent self-loops (check_run names for inlined workflows are bare job names, not workflow-prefixed) - Add fork PR trust gate in Resolve PR number step: verify head repo matches target repo before running Claude with privileged credentials Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: replace inlined claude.yml with standard thin-caller stub The inlined version embedded all three jobs (claude, claude-ci-fix, claude-issue) directly and threaded DON_PETRY_BOT_GH_PAT through checkout tokens and github_token, causing the bot's PAT to author PRs and comments instead of github-actions[bot]. Replace with the standard thin caller that delegates to the org-level reusable workflow (claude-code-reusable.yml@v1) via secrets: inherit, which is the correct pattern per: petry-projects/.github/standards/workflows/claude.yml * ci: pin dependabot-automerge reusable workflow to SHA (#130) Pin petry-projects/.github reusable workflow from @v1 to commit SHA 0cb4bba11d7563bf197ad805f12fb8639e4879e4 to satisfy the action-pinning compliance policy. Closes #116 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix: replace gh copilot suggest with GitHub Models REST API (#151) * fix: replace gh copilot suggest with GitHub Models REST API (#147) The `gh copilot suggest -p "$(cat <file>)"` invocation failed with "Invalid command format" because: 1. The `-p` flag is not valid syntax in modern `gh copilot` built-in versions. 2. `gh copilot suggest` is a shell-command suggestion tool; it does not accept large PR prompts or return structured JSON responses. 3. Passing a multi-thousand-line prompt via `$(cat ...)` can hit ARG_MAX. The non-zero exit was then misclassified by the rate-limit detector, which aborted the entire session and skipped all remaining PRs in the queue. Fix: replace all three copilot invocations (run_triage, run_agentic, run_duck) with a new `copilot_chat` helper that calls the GitHub Models REST API directly via curl. The API is OpenAI-compatible, versioned via `X-GitHub-Api-Version`, stable against gh CLI version changes, and accepts arbitrary prompt sizes using python3 for safe JSON encoding. Additional changes: - Add `COPILOT_API_MODEL` var (default `openai/o4-mini`) overrideable via env. - run_agentic/run_duck copilot cases now also write output to $OUTPUT_FILE so callers that check that path directly (deep review, audit) find the JSON. - Rate-limit responses (HTTP 429) are echoed to stdout so the existing `is_rate_limited()` detector fires correctly for engine fallback. - Add pre-flight smoke test in review-batch.sh: tests GitHub Models API connectivity with a one-liner prompt before processing any PRs, so auth or model errors surface immediately as a clear setup failure. - Add tests/test_copilot_chat.sh: unit tests for the JSON payload builder with edge-case prompts (quotes, newlines, # headings, large diffs, Unicode). Closes #147 Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * fix: scope COPILOT_API_MODEL export to copilot engine only Move the `export COPILOT_API_MODEL` from the common exports block into the `copilot)` case where the variable is set, so it is not exported as an empty/unset variable when the engine is `claude` or `gemini`. The `copilot_chat` fallback `${COPILOT_API_MODEL:-openai/o4-mini}` …

The review-one-pr.sh script already exits with code 100 for no-ops, but the workflow was counting them toward MAX_PRS budget. Now: - Review loop processes ALL candidates (not truncated to MAX_PRS) - Only non-no-op PRs count toward the MAX_PRS budget - Loop stops after MAX_PRS actual reviews are posted - This unblocks the backlog from being stuck on already-reviewed PRs Fixes #7 (completes PR #10)

… default `claude` engine — `COPILOT_API_MODEL: unbound variable` (#774) * Add scheduled PR review agent Hourly GitHub Action that enumerates open PRs (authored by or review-requested from @me), classifies risk via Claude Code, and auto-approves LOW/MEDIUM PRs that pass quality gates while escalating HIGH-risk or gated PRs for human review. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Use Claude Code OAuth token instead of API key Routes agent runs through the Max plan subscription rather than per-token API billing. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Enforce single-PR scope and default to dry-run - Prompt now hard-forbids enumeration commands and acting on any PR other than $PR_URL. Earlier dry-run revealed the agent was reviewing the entire backlog in a single invocation, ignoring the per-PR loop. - DRY_RUN now defaults to true unless repo variable LIVE_MODE=true, so the hourly cron is safe by default until the operator opts in. - AGENT.md documents the LIVE_MODE switch and corrects PAT scopes (Issues needs write to create the needs-human-review label). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add 3-model council + commit-SHA-aware iterative review The single-prompt reviewer is replaced by a council of 3 Claude models, each with a focused lens, and a synthesizer that combines them: - Security (Opus 4.6) - auth, secrets, injection, supply chain - Correctness (Sonnet 4.6) - logic, issue alignment, tests, CI - Maintainability (Haiku 4.5) - standards, conventions, clarity - Synthesizer (Sonnet 4.6) - max risk, escalate-if-any, dedupe, post Council members run in parallel, write JSON verdicts to /tmp/council/, and never touch GitHub. The synthesizer is the only actor that posts. Every posted review embeds an HTML marker on line 1:  scripts/review-one-pr.sh checks for that marker before spending tokens: - Marker SHA == current head SHA -> skip (already reviewed). - Marker SHA != current head SHA -> re-review (handles iterative cycles). - No marker -> first review. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Upgrade maintainability lens from Haiku 4.5 to Sonnet 4.6 Haiku couldn't follow the agentic instructions — it asked for env vars instead of reading them and executing the gh commands. All three council members now use models capable of multi-step tool use. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Go-live improvements for PR review agent (#2) - Upgrade actions/checkout v4→v5 (Node.js 20 deprecation) - Add MAX_PRS cap (default 10) to stay within 60-min job timeout - Filter drafts at enumeration (--draft=false) - Fix jq operator-precedence bug in idempotency check - Add truncation notice log, inline jq comments, docs updates Council-reviewed: 2 rounds (escalated round 1 on jq bug, approved round 2) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add Claude delegation, auto-merge, and rebase handling (#3) - Post structured fix-request comments on escalated PRs in Claude-enabled orgs - Claude's workflow trigger picks up the comment automatically (no @claude tag) - On approval: auto-merge (--auto --squash), rebase if behind, remove label - Cycle guard (MAX_REVIEW_CYCLES=3) prevents infinite delegation loops - New repo variables: CLAUDE_ORGS, MAX_REVIEW_CYCLES Council-reviewed: dispatch hit rate limit but architecture validated against petry-projects/.github claude-code-reusable.yml workflow — event flow confirmed. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Optimize review: small-PR and incremental fast paths (#4) * Add review mode optimization: small-PR and incremental fast paths PRs are now routed to the cheapest review path: - Small PRs (<10 lines): single Opus call (1 invocation vs 4) - Re-reviews (prior marker at different SHA): single Opus call with prior review context, focused on what changed since last review - First review of non-small PRs: full 3-member council (unchanged) New files: - prompts/single-review.md: combined council+synth prompt for single reviewer mode, handles both small and incremental paths New config: - SMALL_PR_THRESHOLD repo variable (default 10) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Replace parallel council with cascading review tiers Haiku triage → Sonnet deep review → Opus security audit, where each tier only fires if the previous one escalated. This replaces the 3-parallel-members + synthesizer architecture. Cost impact: - ~80% of PRs: Haiku + Opus confirm (2 calls, ~30s vs 4 calls, ~5 min) - ~15%: + Sonnet (3 calls, ~2.5 min) - ~5%: full cascade (4 calls, ~5.5 min) Haiku works by receiving pre-fetched context (no tool use needed), which sidesteps the agentic limitations found earlier. New files: - prompts/triage.md — Tier 1: Haiku fast classification - prompts/deep-review.md — Tier 2: Sonnet full review - prompts/security-audit.md — Tier 3: Opus security audit - prompts/cascade-action.md — posts review from any resolving tier Re-reviews (prior marker at different SHA) pass prior review context to the triage, enabling faster incremental checks. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Fix review council findings: 4 major + 3 minor issues Major fixes: - Replace invalid 'repository' gh field with 'headRepository'/'headRepositoryOwner' across script and all prompts - Add 'triage-approved' as valid REVIEW_MODE in single-review.md with dedicated mode description - Fix PRIOR_REVIEW_BODY selector: head -1 → tail -1 to match most-recent SHA - Update dangling 'synthesize.md step 9a' reference to cascade-action.md Minor fixes: - Validate PRIOR_REVIEW_BODY contains marker before exporting (anti-injection) - Write prior review body to temp file to avoid E2BIG on large reviews - Remove dead SONNET_RC=$? variable; add || true for set -e safety - Delete orphaned prompts/council/ files (no longer referenced by cascade) - Fix incremental-mode compare command: document how to derive owner/repo from headRepository metadata Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add Claude Code workflow (#8) Implement the org-level reusable workflow caller pattern from petry-projects/.github. This thin caller delegates all logic to claude-code-reusable.yml and triggers on PR events, issue comments, and labeled issues. Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * feat: add Copilot engine support via REVIEW_ENGINE toggle (#5) * feat: add Copilot engine support via REVIEW_ENGINE toggle Abstract LLM invocation into scripts/engine.sh so both Claude and Copilot engines use the same cascade logic, prompts, and actions — just different CLIs and model families. Key changes: - scripts/engine.sh: new LLM abstraction layer with run_triage/run_agentic dispatching to claude or copilot CLI based on REVIEW_ENGINE variable - scripts/review-one-pr.sh: refactored to source engine.sh, engine-agnostic variable names (DELEGATION_ORGS, AI_DELEGATION_ENABLED, DEEP/AUDIT tiers) - All prompts updated: engine-agnostic tier names, ENGINE_LABEL footers, removed hardcoded model names from prose - Workflow: conditional CLI install, REVIEW_ENGINE/COPILOT_GITHUB_TOKEN vars, DELEGATION_ORGS with CLAUDE_ORGS backward compat fallback - AGENT.md/README.md: documented both engine options and setup Model mapping: Triage: Haiku 4.5 / GPT-5-mini Deep: Sonnet 4.6 / GPT-5.2 Audit: Opus 4.6 / GPT-5.4 Action: Sonnet/Opus / GPT-5.2/5.4 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Update prompts/cascade-action.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update prompts/cascade-action.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * fix: address PR review comments - Fix Copilot CLI install to use gh extension instead of npm - Replace speculative GPT-5 models with verified identifiers (gpt-4o-mini, o1, o1-pro) - Fix cascade-action.md deprecated alias to reference CLAUDE_ENABLED - Change 'Claude delegation' to 'AI delegation' in synthesize.md - Add triage-approved to mode schema in single-review.md - Align log label with JSON field in review-one-pr.sh - Remove unused SMALL_PR_THRESHOLD from workflow - Add $OUTPUT_FILE to inputs in deep-review.md and security-audit.md Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> * feat: update to latest GPT-5 models for Copilot engine - Use gpt-5-mini for triage (lightweight, faster) - Use gpt-5.2 for deep review and action (improved reasoning) - Use gpt-5.4 for security audit and single reviewer (most advanced) Based on latest GitHub Copilot model support in 2025-2026. Co-authored-by: don-petry <36422719+don-petry@users.noreply.github.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com> * feat: inline Claude Code workflow to access repo secrets directly (#9) Replaces the thin org-level reusable workflow caller with the full inlined workflow so CLAUDE_CODE_OAUTH_TOKEN and GH_PAT_WORKFLOWS can be accessed from this repo's own secrets. Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: cross-engine adversarial rubber duck review (#11) * feat: add cross-engine adversarial "rubber duck" review to PR cascade At tier 2, the deep review now runs in parallel with an adversarial "rubber duck" reviewer from the opposite engine (Claude↔Copilot). A synthesis step merges both verdicts before deciding to approve or escalate. Different model families catch different blind spots — this approach closes ~75% of the performance gap between tiers. Graceful degradation: if the rubber duck fails (missing creds, CLI unavailable), the cascade continues with the primary review only. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address rubber duck review findings and Copilot comments - Strip opposing engine credentials in run_duck to prevent cross-engine secret leakage (CLAUDE_CODE_OAUTH_TOKEN/COPILOT_GITHUB_TOKEN) - Add timeout 300 to both duck CLI paths to prevent hangs - Add $OUTPUT_FILE to rubber-duck.md inputs section - Add TIER2_RESULT alias at tier 3 handoff (documents combined vs deep) - Fail fast on primary CLI install; || true only for duck engine - Add default/error branch to run_duck case statement - Fix final_risk → risk terminology in synthesize-duck.md - Add explicit severity bump mapping (info→minor, minor→major) - Set DUCK_VALID=false on synthesis fallback for accurate FINAL_TIER - Kill duck process early if deep review fails to avoid wasted latency Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: filter already-reviewed PRs from backlog to unblock queue * docs: clarify PR review batching issue * fix: complete PR #10 fix - don't count no-ops toward MAX_PRS budget The review-one-pr.sh script already exits with code 100 for no-ops, but the workflow was counting them toward MAX_PRS budget. Now: - Review loop processes ALL candidates (not truncated to MAX_PRS) - Only non-no-op PRs count toward the MAX_PRS budget - Loop stops after MAX_PRS actual reviews are posted - This unblocks the backlog from being stuck on already-reviewed PRs Fixes #7 (completes PR #10) * feat: CI gate + poll-loop rebase wait across all review prompts (#14) * feat: CI gate + poll-loop rebase wait across all review prompts 1. CI gate (review-one-pr.sh step 1b): skip PRs with failing or in-progress checks before spending any LLM tokens. Exits with code 100 (no-op sentinel) so skipped PRs don't count against the MAX_PRS budget. Empty statusCheckRollup (no CI) is treated as passing. 2. Poll loop (cascade-action, single-review, synthesize): replace the fixed sleep with a bounded poll (6×5 s) that exits as soon as mergeStateStatus is no longer BEHIND, eliminating the race between update-branch and the subsequent auto-merge call. 3. Triage cleanup: remove the now-redundant "no failing CI" criterion since failing-CI PRs are blocked by the shell gate before triage runs. Renumber remaining criteria. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address Copilot review comments + document bot account setup review-one-pr.sh: - Combine headRefOid + statusCheckRollup into a single gh pr view call to reduce API calls and rate-limit exposure - Tighten CI classification to strict-success: pending check first, then require ALL items to be SUCCESS/passing — any other conclusion (NEUTRAL, SKIPPED, STALE, STARTUP_FAILURE, etc.) now counts as failing rather than silently passing through - Clarify exit-code 100 comment to reflect its broader "skip sentinel" meaning (already-reviewed, ci-failing, ci-pending) prompts (cascade-action, single-review, synthesize): - Initialise REBASE_STATUS="BEHIND" before the poll loop so the variable is always set; add explicit post-loop guard — if still BEHIND after 30s, skip auto-merge entirely and let the next cycle retry AGENT.md: - Document the reviewer identity constraint (self-approval is blocked) - Add step-by-step bot account creation and classic PAT setup instructions - Renumber existing setup steps 2→3, 3→4, 4→5 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: filter failing/pending CI PRs at enumeration stage in list-prs.sh Add --checks passing to both gh search prs queries so PRs with failing or in-progress CI never enter the candidate pool. Previously they were fetched, consumed a CANDIDATE_LIMIT slot, and only skipped once review-one-pr.sh ran the per-PR CI gate. Two-layer defence now: 1. list-prs.sh — --checks passing excludes them from the candidate list 2. review-one-pr.sh — strict jq CI gate catches anything that slips through (e.g. PRs passed via PR_URL_OVERRIDE) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: treat SKIPPED/NEUTRAL CI conclusions as passing; drop admin:org scope review-one-pr.sh: - Extend is_success to include SKIPPED and NEUTRAL conclusions alongside SUCCESS. SKIPPED covers path-filtered workflow jobs (e.g. claude-issue skips on non-issue events); NEUTRAL covers informational checks that don't gate merging. Both were previously falling through to "failing", permanently blocking review of any PR with a skipped check. AGENT.md: - Remove admin:org from the bot PAT scope recommendation. The scope is not needed for PR approval or auto-merge — repo scope is sufficient. admin:org grants full org administration (member management, billing, team settings) which is excessive blast radius for a review bot token. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: DJ <dj@Rachels-MacBook-Air.local> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: replace --checks passing with --checks success in list-prs.sh (#15) GitHub CLI changed the valid values for `gh search prs --checks` from accepting "passing" to only allowing {pending|success|failure}. All workflow runs have been failing since this change with: invalid argument "passing" for "--checks" flag: valid values are {pending|success|failure} "success" is semantically identical to the old "passing" — it filters to PRs where all CI checks have completed with a passing status. Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * docs: update repo references from self to pr-review-agent * feat: add car-hunt skill for used vehicle research and ranking CPM-based (cost per remaining mile) ranking of Honda/Toyota listings across AutoTrader, CarGurus, and Facebook Marketplace. Includes live reliability research step (Consumer Reports, JD Power, RepairPal, CarComplaints) before searching, NHTSA recall/complaint API deep-dive, and optional Google Sheet write-back. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: fix FB Marketplace links, improve AutoTrader fetch, add Sheets export step - AutoTrader: stop trying to WebFetch JS-rendered search pages; use WebSearch site:autotrader.com to find individual listing URLs, then WebFetch those (they have real HTML data) - FB Marketplace: never output generic placeholder links; use real item URLs if Google indexes them, otherwise surface a manual search URL and one placeholder row explaining why - Step 6: document CSV→Sheets export via Drive MCP create_file, including base64 encoding, column format, and share URL construction Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: add Craigslist as explicit source, enforce real-URL-only link rule - Add Craigslist section with regional sites (bham, huntsville, chattanooga, atlanta), correct search URL pattern with sort/filter params, and WebFetch approach (CL uses plain HTML, works reliably) - Link integrity rule: every Link column value must be a real listing URL from WebFetch/WebSearch or a manual search URL clearly labeled — never a homepage, never a constructed/guessed URL - Update WebSearch fallback section to cover all sources uniformly Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: split zip/radius questions, rename MAX_MILES to MAX_ODOMETER Question 4 was ambiguous — users confused "Max miles?" (meant odometer) with search radius. Now asks zip and radius as separate questions (#4 and mileage on the car itself)" clarification. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: include self-authored PRs awaiting review in agent enumeration (#16) * fix: fix Craigslist link approach, add date_posted with 21-day staleness filter Craigslist search pages are JS-gated so WebFetch fails; switch to WebSearch (site:craigslist.org) as primary approach, with direct URL as fallback. Add date_posted field to every listing and drop any listing posted more than 21 days ago as likely-sold. Also fix MAX_MILES → MAX_ODOMETER in the Craigslist search URL template. Add Posted column to ranked table and Step 6 sheet schema. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: include self-authored PRs awaiting review in agent enumeration Remove --checks success filter from authored PR search to include PRs that require code review (e.g., compliance fixes). CI validation still occurs per-PR in review-one-pr.sh as a second layer of defence. This enables the review agent to detect and approve self-authored PRs that are blocked by review requirements but have passing CI checks. --------- Co-authored-by: DJ <dj@Rachels-Air.localdomain> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add doors/transmission fields, update-mode sheet, fix CarGurus/Craigslist approach - Fix CarGurus URL section: direct URL pattern 404s, switch to WebSearch-first approach - Fix Craigslist primary: regional page WebFetch with pagination (was site: WebSearch which returns category pages) - Add doors (2/4) and transmission (Auto/Manual) to data extraction, output table, and sheet schema - Add exhaustive coverage mandate: paginate all sources, never stop early, report coverage in output - Add AutoTrader outage handling: note 503 in summary, fall back to WebSearch cache - Add update mode for Step 6: single persistent sheet, deduplicate by URL, mark stale listings - Update sheet columns to include Doors/Trans; fix MIME type note (text/csv only, not xlsx) - Update scheduling defaults: ZIP=35243, RADIUS=200, MAX_PRICE=6000, YEAR_MIN=2002, MAX_ODOMETER=250000 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add hard disqualification filters for finance-speak, title issues, and scam signals Skip any listing mentioning down/monthly payments, no title/lien/salvage, or scam contact redirects (broken messenger, email-only, urgency pricing). Log disqualified listings separately rather than silently dropping them. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add Distance to Car field using Nominatim geocoding + Haversine formula Geocode user ZIP and each listing city via free Nominatim API (no key needed), compute straight-line distance × 1.3 road correction factor, display as "~X mi" in output table (Dist column) and sheet schema. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: address low result count — batch URL extraction, preview-filter before fetch, target 50+ raw Score candidates from search-page preview data first to avoid fetching every listing page; only deep-fetch those passing price/mileage preview. Clarifies why ~15 results was happening and mandates 50+ raw candidates. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: make cascade-action prompt explicit about gh pr review --approve The agent was posting comments instead of approval reviews because the prompt was too high-level. Rewritten step 5 to contain explicit bash code blocks that the agent can directly execute, with clear use of: - gh pr review --approve (not gh pr comment) - Proper body passing via temp file to handle newlines/special chars - Explicit variable extraction and idempotency checks This ensures the review posts as an APPROVED review, not a COMMENTED review, so GitHub branch protection recognizes it and auto-merge triggers. * improve: make cascade-action body composition and escalation more explicit - Fix variable expansion in escalation comment by using COMMENT_END instead of 'COMMENT' - Make step 4 explicit with bash code that extracts JSON fields and builds body - Handle findings array iteration and formatting with jq - Support cross-engine agreement section only when tier is deep+duck - Use temp file for comment composition to handle variables correctly * refactor: move review posting logic from agent prompts to bash script This addresses the critical issue where the agent was posting comments instead of approval reviews. Instead of relying on the agent to execute bash commands correctly, we now: 1. Have the agent generate only the verdict JSON with the review body 2. Use a new post-pr-review.sh script to handle all GitHub interactions 3. This removes the ambiguity about whether to post as review or comment Changes: - New scripts/post-pr-review.sh: handles review posting, rebasing, auto-merge, labels - Simplify cascade-action.md: agent just outputs verdict JSON, doesn't post - Simplify single-review.md: agent just outputs verdict JSON, doesn't post - Update review-one-pr.sh: capture verdict JSON and call post-pr-review.sh The verdict JSON includes the complete review body, so the agent can still compose the full markdown review. The bash script handles all GitHub interactions (posting reviews, enabling auto-merge, managing labels). This is more reliable because bash + gh CLI is deterministic, while agent behavior is less predictable. * add: cleanup script to fix PRs with comment approvals instead of review approvals Script identifies PRs that have the agent's marker comment but no actual approval reviews (symptom of the original bug), and posts proper approval reviews + enables auto-merge. Usage: bash scripts/fix-stuck-prs.sh [dry_run=true|false] * fix: cleanup script now requires bot account token GitHub blocks self-approvals, so cleanup must run with the bot account's GH_TOKEN (petry-review-bot), not the PR author's token. * add: workflow to fix stuck PRs using bot account token Allows running the cleanup script via workflow_dispatch with access to GH_PAT (bot account token) from repo secrets. * fix: pass GH_PAT to checkout action so workflow uses bot account * debug: simplify account check, add authentication debug output * docs: add comprehensive petry-review-bot setup instructions * docs: add GitHub App setup guide (recommended approach) GitHub App is the secure, recommended way to automate PR reviews: - Fine-grained permissions - JWT tokens that auto-expire - No human account needed - Better audit trail - GitHub's recommended approach Replaces the bot user account approach with a more secure alternative. * docs: add comprehensive GitHub App setup documentation - SETUP.md: Quick reference guide with configuration and troubleshooting - IMPLEMENTATION.md: Technical deep dive on architecture and design decisions - DOCUMENTATION.md: Index of all documentation files - Updated README.md with status and quick links - Updated GITHUB_APP_SETUP.md with implementation notes and actual app ID - Workflows use GitHub App token generation instead of static PATs Covers the transition from bot user account to GitHub App authentication for improved security and maintainability. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: silence auth check in fix-stuck-prs when using GitHub App token GitHub App tokens don't have user scope, so 'gh api user' returns 403. This is fine - the script still works for PR operations. Suppress the error so the script completes successfully with app-token fallback label. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: use explicit author instead of @me in stuck PR search GitHub App tokens don't have user identity, so @me search doesn't work. Use explicit 'don-petry' author instead to find PRs to fix. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: avoid subshell in while loop to preserve variable state Using pipe in while loop created subshell where PROBLEM_PRS and FIXED_PRS counters were incremented but changes didn't persist to parent shell. Fixed by using process substitution for input instead of pipe. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * docs: add comprehensive status report for GitHub App setup - Overview of completed work - GitHub App authentication details - 24 stuck PRs successfully fixed with approval reviews - Architectural decisions and rationale - Configuration guide and usage examples - Known limitations and troubleshooting System is now fully operational with GitHub App token authentication, comprehensive documentation, and all infrastructure in place. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * docs: document stuck PR cleanup status and script fixes Added documentation for: - GitHub App token compatibility fixes in fix-stuck-prs.sh * Changed @me to explicit author (app tokens have no identity) * Fixed subshell variable scope (process substitution vs pipe) * Silenced expected 403 auth check error - Current status: 24 PRs have approvals but remain OPEN * Auto-merge failed due to missing GitHub App permission * Approvals satisfy branch protection requirement * Next: expand permissions or manually merge Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix: update list-prs.sh to search all repos by owner instead of @me GitHub App tokens don't have user identity, so @me/@review-requested searches fail. Changed to enumerate all repos in don-petry and petry-projects, then search for open PRs within each repo. This covers the full scope: - All open PRs in personal don-petry repos - All open PRs in petry-projects org repos Resolves 6 consecutive workflow failures due to zero PRs being enumerated. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * docs: add investigation report for PR review agent workflow failures * fix: move env section before steps in workflow to fix YAML structure GitHub Actions requires env section to come before steps in job definition. Moving env definition up and setting GH_TOKEN only in steps that need it. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * script: add backfill-approvals to retroactively apply real approvals Converts PRs with agent approval comments (but no real GitHub approvals) to have actual APPROVED reviews. Needed for PRs reviewed before the gh pr review --approve fix was applied. Usage: scripts/backfill-approvals.sh # dry-run (preview changes) scripts/backfill-approvals.sh false # apply real approvals Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * feat: add backfill-approvals workflow to run as GitHub App bot Runs backfill-approvals.sh via GitHub Actions so the approvals are posted by the bot identity, not the PR author — GitHub rejects self-approvals. Also fixes subshell counter bug in the script (piped while loop lost variable state; switched to process substitution). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: convert inner while loop to process substitution to preserve counters Both the outer repo loop and inner PR loop were piped subshells, causing all counter increments (approved/skipped/failed) to be lost. The summary always showed 0. Fixed by using < <(...) process substitution for both loops. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * car-hunt: add VIN-deep-dive flow, printable checklists, location-tier ranking - Step 5.5 pre-test-drive flow: NHTSA VIN decode + per-VIN unrepaired-recall automation via Chrome MCP (Honda LWC owner portal documented as not automatable; NHTSA web form works). - §F printable test-drive checklist generator (reportlab/Platypus PDF) with cold-start, model-specific red flags, negotiation table, walk-away rules. - §G fraud / paperwork verification checklist (vehicle-agnostic, reusable): walk-away triggers, VIN three-location match, curbstoning, odometer fraud, bill of sale, title transfer, payment protection, stolen-vehicle, title- jumping, after-purchase steps. - Step 5.25 head-to-head comparison template with information-asymmetry rule. - Step 3 Location Quality Tier scoring (Birmingham AL metro table A/B/C/D) with adj-CPM modifier; sheet schema gains Adj.CPM + Tier columns. - Hard-disqualification rules added: non-running engine keywords, mileage inconsistency, mandatory description scrape. - Drive MCP overwrite limitation documented; sheet ID now read from memory rather than hardcoded. - FB Marketplace operational facts: Birmingham AL city ID 107739635926718, /search? vs /vehicles? query handling, React-controlled inline composer, send-button selector, seller-name extraction regex. - scheduled-tasks/used-car-search-{morning,afternoon}: tier A/B priority flag, sheet ID read from memory. - Reference PDF generator scripts checked in for reuse. * fix: re-approve PRs where approval predates last commit (stale approval) Instead of skipping PRs that already have any APPROVED review, skip only those where reviewDecision is not REVIEW_REQUIRED. This handles PRs where a bot approval was posted before a new commit was pushed — GitHub's ruleset engine treats those approvals as stale even with dismiss_stale_reviews=false. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: robustly extract JSON verdict from mixed claude --print output (#17) Claude's --print mode can prefix the JSON verdict with conversational preamble text, causing jq to fail with parse errors. Add extract_verdict_json to engine.sh and wire all three cascade action call sites in review-one-pr.sh to use it. Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> * fix: extract_verdict_json — check dest file first (agent Bash-write style) The cascade-action agent writes its verdict JSON to \$OUTPUT_FILE via a Bash tool call, then prints a text summary to stdout. The previous fix only scanned stdout (the .raw file), which contained no JSON. The agent- written file at \$dest (= \$OUTPUT_FILE) was already correct — just not checked. Now check \$dest first before falling back to stdout scan. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Enforce MAX_REVIEW_CYCLES cap before running the cascade (#18) * fix: enforce MAX_REVIEW_CYCLES cap with human-escalation marker Previously MAX_REVIEW_CYCLES only gated AI delegation in post-pr-review.sh — the cascade itself ran on every cron tick regardless of how many cycles had accumulated. Real-world result: a PR could rack up 9+ review cycles (we observed exactly that on ContentTwin#100) before any cap took effect. Add a pre-cascade check in review-one-pr.sh: when the count of existing `` markers is at or above MAX_REVIEW_CYCLES (default 3), post one escalation comment marked ``, label needs-human-review, request don-petry, and exit 100 (skip sentinel — doesn't burn the MAX_PRS budget). The escalation marker doubles as the no-spam guard: subsequent runs detect it and exit 100 immediately. Also reuse a single `gh pr view` for both the cycle count and the escalation-marker check. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * review feedback: surface escalation-comment failures, drop dead unset - Drop `2>/dev/null || true` on `gh pr comment` so a failed escalation post is visible in the workflow log instead of silently leaving the PR with no marker (which would re-trigger the cap path next tick). - Reword the cycle-count comment from "AI delegation loops" to "review loops" — the cap also catches cascade-only loops where every cycle approves and a new commit lands before merge. - Remove the redundant `unset PR_BODIES` — never exported, no leakage. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * Reliability hardening: session circuit breaker, timeouts, retry, dedup (#20) * feat: session circuit breaker, per-tier timeouts, retry, and triage hard-fail Reliability hardening for the PR review agent. 1. Session circuit breaker (.github/workflows/pr-review.yml): on any non-zero, non-100 exit from review-one-pr.sh (general failure or rate limit on the fallback engine), break the per-PR loop, log a clear error annotation naming the failing PR and reason, and exit the step with code 1 so the run shows red. Prevents one systemic problem from silently burning the entire candidate pool. 2. Per-tier timeouts (scripts/engine.sh): triage/deep/audit/action/duck each get their own bounded timeout (180/600/600/300/300s defaults, env-overridable). Previously only the duck had a timeout — a hung tier could burn the whole 60min job budget. 3. Retry-with-backoff on transient errors (scripts/engine.sh): triage retries once on 124/137/143 (timeout / signal kill) since its caller captures stdout via $(...) so retries are safe. Deliberately NOT applied to run_agentic/run_duck where stdout is redirected to a file — a retry there would corrupt the partial first-attempt output. 4. Triage non-JSON now hard-fails (scripts/review-one-pr.sh): replaces the silent fallback that synthesized a fake "escalate=MEDIUM" verdict and proceeded to deep review. With the new circuit breaker, loud failure is the right call — masking a broken triage was burning tokens on every PR while the workflow looked healthy. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix: stop stacking duplicate agent reviews on the same PR Two bugs were causing the agent to leave multiple comments on the same PR. Together they produced 10 stacked APPROVED reviews on petry-projects/ContentTwin#100. Bug A — idempotency check is order-dependent (review-one-pr.sh): The previous marker-discovery code did: ((.reviews // []) + (.comments // [])) | .[].body | grep marker | tail -1 This relies on the array concatenation order, not chronological order. When old agent comments existed alongside newer agent reviews, tail -1 picked the comment-array marker (older) over the review-array marker (newer), causing the script to think the head SHA hadn't been reviewed and re-run. Replaced with a single jq pipeline that tags each item with submittedAt / createdAt, sorts by timestamp, and takes the actual most-recent marker. Bug B — no cleanup of prior agent items (post-pr-review.sh): After successfully posting a new review/comment, prior agent items were left in place, accumulating forever. Added mark_prior_agent_items_obsolete which, after a successful post: - dismisses prior APPROVED/COMMENTED/CHANGES_REQUESTED agent reviews via the GitHub dismissal API (UI shows them struck-through as Dismissed) - edits prior agent comments to wrap their body in a collapsed <details> block with a "Superseded by re-review at <SHA>" summary, plus a `` sentinel for idempotency All cleanup API calls are best-effort — failures don't break the workflow. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * fix(cleanup): warn on API failures, preserve global newest, file-stage JSON Three fixes to mark_prior_agent_items_obsolete from the review of PR #20: 1. ::warning:: annotations on every cleanup API failure (review/comment list-fetch, individual review dismissal, individual comment fetch+edit). Previously these were silenced with `|| true`, so a permissions change on the dismissal endpoint would let duplicates stack indefinitely with no signal in the Actions UI. Cleanup is still non-fatal — the new post has already landed — but failures are now visible. 2. Preserve the globally-latest agent item across BOTH categories, not the newest of each category separately. The earlier code split reviews and comments and applied `[:-1]` to each, which left a stale fix-request comment in place when the new post was a review (or vice versa). The one-off cleanup of ContentTwin#100 hit exactly this case: 12 stacked reviews collapsed to 1, but a stale comment from 2026-04-25 (SHA cd9132d6) was preserved as "newest comment" even though the latest review at SHA 3af8c8ee was newer overall. Now: compute the max timestamp across both feeds, exclude items at that timestamp. 3. Stage API responses to disk (`mktemp` + `jq <file>`) instead of routing through `--argjson "$var"`. The old approach broke on rare unescaped control chars in user-authored comment bodies (jq refused to parse the resulting shell-vared JSON). File-based input sidesteps the shell pipeline entirely. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * Remove car-hunt skill and scheduled tasks (moved to don-petry/don-petry) (#21) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: apply Copilot fallback hardening and reuse GH_PAT for Copilot auth - Use secrets.GH_PAT (existing personal account token with Copilot subscription) instead of a separate COPILOT_GITHUB_TOKEN secret - Pin actions/create-github-app-token to SHA (v3.1.1) for supply chain safety - Add post-install verification for gh-copilot extension with warning on failure - Guard Copilot fallback path: skip PR gracefully if extension is not installed Addresses issue #24 workflow fixes (1-3) that could not land via PR #25 due to GitHub App lacking workflows permission. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: switch Copilot engine to gh built-in and fix app-id deprecation - Remove gh extension install (github/gh-copilot conflicts with built-in alias) - Replace with gh copilot --version check using COPILOT_GITHUB_TOKEN (GH_PAT) - Update all engine.sh copilot invocations from bare `copilot` binary to `gh copilot suggest --target shell` with GH_TOKEN overridden to GH_PAT so the user token (with Copilot subscription) is used, not the App token - Fix actions/create-github-app-token: app-id → client-id (same secret value, just the renamed input in v3.x) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: harden Copilot fallback path and remove stale worktrees (#25) - gh-copilot install: add --force flag and post-install verification warning so silent failures due to built-in alias conflict are visible in workflow logs instead of being silently swallowed by `|| true` - fallback pre-flight check: verify `gh extension list | grep copilot` before switching to Copilot engine; if unavailable, skip the PR and continue the batch rather than session-aborting and dropping all remaining candidates (fixes the 27-PR drop on run #503) - pin actions/create-github-app-token to SHA for v3.1.1 (Node.js 24 compatible) to prevent hard break on 2026-06-02 when GitHub forces Node.js 24 as default runtime - remove 6 stale Claude Code worktrees from git tracking; add .gitignore entry to prevent future worktrees from being committed (eliminates exit-128 warning on every actions/checkout post-job sweep) Closes #24 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: petry-projects-pr-review-agent[bot] <petry-projects-pr-review-agent[bot]@users.noreply.github.com> * ci: add pre-flight dedup check to prevent duplicate claude-issue PRs (#26) Before invoking Claude on a labeled issue, a new shell step queries for any open PR with a branch matching claude/issue-NNN-* (or a body containing "Closes #NNN"). If one is found it posts a comment on the issue pointing to the existing PR and skips the Claude step entirely. A secondary prompt instruction tells Claude to check first and push to the existing branch rather than opening a new PR. Motivated by issue petry-projects/google-app-scripts#171, where the claude label was re-applied three times and each run created a fresh PR unaware of the prior attempts. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * refactor: migrate to machine user PAT auth (closes #27) (#28) * refactor: migrate from GitHub App to machine user PAT auth Closes #27 GitHub Apps cannot be listed in CODEOWNERS, blocking PRs in repos with require_code_owner_review: true. Switch all workflows to use a machine user account's fine-grained PAT (DON_PETRY_BOT_GH_PAT secret), which can join an org team listed in CODEOWNERS. Workflows: removed actions/create-github-app-token steps in pr-review, fix-stuck-prs, backfill-approvals, and daily-pr-review-health. All now use secrets.DON_PETRY_BOT_GH_PAT directly. Docs: renamed GITHUB_APP_SETUP.md to MACHINE_USER_SETUP.md with full rewrite covering account creation, CODEOWNERS config, PAT generation, and rotation. Updated auth sections in IMPLEMENTATION.md, SETUP.md, STATUS.md, DOCUMENTATION.md, README.md. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * refactor: switch to org-scoped PAT secret DON_PETRY_BOT_PETRY_PROJECT_PAT Replace DON_PETRY_BOT_GH_PAT with DON_PETRY_BOT_PETRY_PROJECT_PAT — the new fine-grained PAT scoped to the petry-projects org (resource owner = petry-projects). The previous PAT was scoped to the donpetry-bot personal namespace and had no repository access. The old DON_PETRY_BOT_GH_PAT secret is retained for any future use against don-petry's personal repos. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore: ignore .claude/scheduled_tasks.lock state file --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com> * refactor: merge approval repair scripts into single automation - Consolidate backfill-approvals.sh and fix-stuck-prs.sh into repair-pr-approvals.sh - Iterate all repos in both orgs instead of assuming author - Verify no existing APPROVED review before posting - Copy original agent comment as review body - Enable auto-merge when posting approval if needed - Single workflow with 30-min timeout Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * feat: add @mention trigger for on-demand PR reviews (#30) Adds repository_dispatch support so commenting @petry-review-bot on any PR fires an immediate review without waiting for the hourly schedule. - pr-review.yml: new `repository_dispatch` trigger (type: pr-review-mention), per-PR concurrency group for mention runs, FORCE_REVIEW and DRY_RUN env vars that handle both workflow_dispatch and repository_dispatch paths - review-one-pr.sh: FORCE_REVIEW=true bypasses idempotency so a mention always runs a fresh cascade even if the head SHA hasn't changed - templates/mention-listener.yml: deploy to petry-projects/.github; listens for @petry-review-bot, validates commenter trust, posts ack, sends repository_dispatch (requires Contents:write, not Actions:write) Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> * fix: harden rebase, review dismissal, and health log diagnostics (#40) Addresses 4 code-actionable recommendations from health check report #33: - [CRITICAL] Make rebase/branch-update non-fatal — 403/504 during rebase emits ::warning:: instead of aborting the batch session (#34) - [MEDIUM] Add retry with exponential backoff (3 attempts) for transient 5xx on update-branch API; break immediately on 4xx (#37) - [MEDIUM] Guard review dismissal with state re-check before calling dismiss API, preventing 422s from race conditions (#38) - [LOW] Surface missing log warnings in health check script (#39) - Fix: skip auto-merge when branch is still BEHIND after failed rebase Closes #34, closes #37, closes #38, closes #39 * refactor: migrate to org-wide .github-private convention (#41) * refactor: parametrize hardcoded identity values for org migration Replace all hardcoded references to don-petry, petry-review-bot, and don-petry/pr-review-agent with environment variables that default to the current values. This allows the agent to be configured for different orgs/users via repo variables. Changes: - Scripts use $REVIEWER_USER, $TARGET_ORG, $BOT_USER, $AGENT_REPO - Prompts no longer reference specific GitHub usernames - Workflows use org-level GH_PAT_WORKFLOWS secret instead of repo-level DON_PETRY_BOT_PETRY_PROJECT_PAT - Health check uses context.repo.owner/repo for issue creation - Variables are set in workflow env block with defaults Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: add Copilot custom agent profiles for org-wide use Create /agents/ directory with three agent profiles: - pr-reviewer: Multi-tier cascading PR review - feature-ideator: Feature idea generation and prioritization - compliance-auditor: Org standards compliance checking These are Copilot custom agent profiles that become available org-wide in the .github-private repo convention. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Squashed 'frameworks/bmad-method/' content from commit e36f219c git-subtree-dir: frameworks/bmad-method git-subtree-split: e36f219c81b6010d4aae423ba12f49edb5b6e31a * Squashed 'frameworks/spec-kit/' content from commit 11f49ebf git-subtree-dir: frameworks/spec-kit git-subtree-split: 11f49ebfb2f6af55345cb4bd9a7906acd211e56f * Squashed 'frameworks/gsd/' content from commit 304c1a13 git-subtree-dir: frameworks/gsd git-subtree-split: 304c1a1302564c45af252bbba4bcc5350e7dac3a * docs: update README for .github-private org infrastructure role Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> * ci: add dependabot-automerge.yml workflow (#73) Adds the required dependabot-automerge.yml workflow from the org standard template (petry-projects/.github/standards/workflows/). This is a thin caller stub that delegates to the org-level reusable workflow. Closes #48 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * fix(pr-review): unblock queue starvation from self-authored PRs (#96) (#97) * fix(pr-review): unblock queue starvation from self-authored PRs (#96) A self-authored PR sorted first in the candidate list and triggered "Can not approve your own pull request" — which the session-fatal abort treated like an engine error, skipping all 28 remaining PRs on every run. - list-prs.sh: filter out PRs authored by REVIEWER_USER at enumeration - post-pr-review.sh: catch the GraphQL self-approval error and exit 100 (no-op) instead of 1, so a stray self-PR can no longer abort the batch - engine.sh: gh copilot renamed --target to --agent; fix the rubber-duck invocations so tier-2 cross-engine review works again - review-one-pr.sh: stop appending a duplicate "0" to REVIEW_CYCLE when grep -c finds no markers under set -o pipefail (was breaking the cycle-cap integer comparison) https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * fix(pr-review): authenticate as bot, harden enumeration, address review - Workflow now runs as AGENT_USER (default don-petry-bot), distinct from REVIEWER_USER (the human, don-petry). The self-approval rejection that caused #96 came from the agent and the human sharing one identity. - list-prs.sh filters self-authored PRs against AGENT_USER, and validates AGENT_USER against the GitHub username charset before interpolating into the jq filter (Copilot review feedback). - review-one-pr.sh uses printf '%s\n' instead of echo for PR_BODIES, since PR body content is user-authored and could begin with -n/-e or contain backslash escapes (Copilot review feedback). - AGENT.md guideline updated to reflect that self-authored PRs are intentionally excluded (CodeRabbit review feedback). Operator note: rotate the GH_PAT_WORKFLOWS secret to a token owned by don-petry-bot (with read:org added) for the bot-account behavior to take effect at runtime. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * refactor(pr-review): collapse to single BOT_USER, route escalations via CODEOWNERS Drop AGENT_USER and REVIEWER_USER. The workflow now has one identity: BOT_USER (default don-petry-bot), which both owns the repos to scan and gets filtered out as the self-approval blocker. Human escalation no longer hard-codes a single reviewer; instead, scripts/request-codeowners- review.sh parses CODEOWNERS in the PR's repo and requests review from every @user / @org/team mention. - list-prs.sh: BOT_USER for both gh-repo-list and self-author filter - review-one-pr.sh, post-pr-review.sh: replace --user "$REVIEWER_USER" with the CODEOWNERS helper - repair-pr-approvals.sh: same gh-repo-list switch - pr-review.yml: drop AGENT_USER/REVIEWER_USER, set BOT_USER default to don-petry-bot - AGENT.md: updated guideline to describe single-identity model https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * refactor(pr-review): extract batch loop, hoist env, drop redundant step Workflow YAML drops from 231 to 111 lines by moving the per-PR review loop into scripts/review-batch.sh. The script can be syntax-checked and exercised locally; the workflow now just wires env vars and dispatches. - Hoist GH_TOKEN, MAX_PRS, CANDIDATE_LIMIT to job-level env (were repeated on individual steps). - Inline `gh auth status` into the install step; remove the standalone Verify auth step (its only output was a one-line auth dump). - Drop the `if: steps.list.outputs.count != '0'` guard and the step's `id`/output: review-batch.sh handles empty input as a no-op. - Collapse the duplicated summary-string branch in the review loop into a single template with a conditional fragment. No behavior change. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig * perf(pr-review): cache claude-code CLI install across runs `npm install -g @anthropic-ai/claude-code` ran on every workflow start (~30s). Switch to a per-user npm prefix (~/.npm-global) and cache that directory via actions/cache, keyed on CLAUDE_CODE_VERSION + runner OS. A `command -v claude` guard makes the install a no-op on cache hit, so the only cost on subsequent runs is the cache restore. CLAUDE_CODE_VERSION defaults to 'latest' (cache persists until manually flushed); set the repo variable to pin a specific version for fully reproducible caching. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig --------- Co-authored-by: Claude <noreply@anthropic.com> * chore: rename GH_PAT_WORKFLOWS secret to DON_PETRY_BOT_GH_PAT (#99) The previous name was generic and didn't tell you which account the PAT belonged to. The new name makes the binding explicit: this secret is the PAT owned by don-petry-bot, used as BOT_USER throughout the PR-review workflows. Operator follow-up before this can be merged: - Add a new repo secret DON_PETRY_BOT_GH_PAT containing the bot's PAT (with repo, workflow, and read:org scopes). - After merge, the old GH_PAT_WORKFLOWS secret can be deleted. Affected workflows: - pr-review.yml (1 use) - claude.yml (4 uses, with || github.token fallback) - daily-pr-review-health.yml (1 use) - repair-pr-approvals.yml (1 use) scripts/pr_review_health.sh's error message is updated to point at the new name as well. https://claude.ai/code/session_01EacTxiHSUhR6kxppXpmxig Co-authored-by: Claude <noreply@anthropic.com> * chore: remove frameworks directory (#101) Co-authored-by: Gemini CLI <gemini-cli@example.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: deprecate pr-review-agent — remove all traces Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore all erroneously deleted files (items 4-34) (#104) * revert: restore .github/workflows/daily-pr-review-health.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore .github/workflows/repair-pr-approvals.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore agents/pr-reviewer.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/cascade-action.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/deep-review.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/rubber-duck.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/security-audit.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/shared.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/single-review.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/synthesize-duck.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/synthesize.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore prompts/triage.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/engine.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/list-prs.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/post-pr-review.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/pr_review_health.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/repair-pr-approvals.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/request-codeowners-review.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/review-batch.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore scripts/review-one-pr.sh Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore templates/mention-listener.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore AGENT.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore BOT_SETUP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore DOCUMENTATION.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore IMPLEMENTATION.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore MACHINE_USER_SETUP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore PR_REVIEW_AGENT_FAILURE_REPORT.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore PR_REVIEW_FAILURE_INVESTIGATION.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore SETUP.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore STATUS.md Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore README.md to pre-change state Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * revert: restore .github/workflows/daily-pr-review-health.yml Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat: add Gemini Pro support and optimize PR review fallback chain (#102) * Merge main and resolve conflicts * Enhance pr-review workflow: add Gemini support and refactor fallback logic * Address Copilot review comments: tighten regex, fix fallback summary, and align docs * docs: move agent documentation to docs/ folder and rename files * docs: align secret names and fix casing in index * docs: organize pr-review-agent documentation under dedicated folder * Address final PR comments: tighten regex, add preflight checks, fix bot names, and cleanup docs --------- Co-authored-by: Gemini CLI <gemini-cli@example.com> * fix(pr-review): gate rate-limit detection on non-zero exit code Broad patterns like `plan.*limit` and `claude.*usage` could match content in a successful triage summary, triggering a false-positive engine fallback. Guard the check with TRIAGE_RC != 0 so it only fires when the provider command actually failed. Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com> * fix(claude): sync inlined workflow with org standard (#109) * fix(claude): sync inlined workflow with org standard Brings the inlined claude.yml up to parity with petry-projects/.github/.github/workflows/claude-code-reusable.yml. Changes: 1. Bot allow list for pull_request_review_comment Add coderabbitai[bot], Copilot, copilot-pull-request-reviewer[bot], and gemini-code-assist[bot] alongside the existing OWNER/MEMBER/ COLLABORATOR check. These bots have author_association 'NONE' so their review comments were always skipped. 2. check_run trigger + claude-ci-fix job Port the CI failure auto-fix feature from the reusable. When a check fails on a PR, Claude diagnoses and fixes it automatically. Adapted to use DON_PETRY_BOT_GH_PAT (this repo's secret name). 3. claude-code-action SHA bump: v1.0.89 → v1.0.119 Update both the claude and claude-issue jobs. 4. paths-ignore on pull_request trigger Prevents the workflow from firing on PRs that only change claude.yml itself, avoiding the Anthropic OIDC validation failure (workflow file must match default branch at token exchange). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(claude): guard bot allow list against fork PRs Same fix as petry-projects/.github PR #238 — add same-repo guard for bot-triggered pull_request_review_comment runs. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(claude): address ci-fix self-loop and fork PR security - Replace Claude Code name prefix check with explicit job name list to correctly prevent self-loops (check_run names for inlined workflows are bare job names, not workflow-prefixed) - Add fork PR trust gate in Resolve PR number step: verify head repo matches target repo before running Claude with privileged credentials Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci: replace inlined claude.yml with standard thin-caller stub The inlined version embedded all three jobs (claude, claude-ci-fix, claude-issue) directly and threaded DON_PETRY_BOT_GH_PAT through checkout tokens and github_token, causing the bot's PAT to author PRs and comments instead of github-actions[bot]. Replace with the standard thin caller that delegates to the org-level reusable workflow (claude-code-reusable.yml@v1) via secrets: inherit, which is the correct pattern per: petry-projects/.github/standards/workflows/claude.yml * ci: pin dependabot-automerge reusable workflow to SHA (#130) Pin petry-projects/.github reusable workflow from @v1 to commit SHA 0cb4bba11d7563bf197ad805f12fb8639e4879e4 to satisfy the action-pinning compliance policy. Closes #116 Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: Don Petry <don-petry@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * fix: replace gh copilot suggest with GitHub Models REST API (#151) * fix: replace gh copilot suggest with GitHub Models REST API (#147) The `gh copilot suggest -p "$(cat <file>)"` invocation failed with "Invalid command format" because: 1. The `-p` flag is not valid syntax in modern `gh copilot` built-in versions. 2. `gh copilot suggest` is a shell-command suggestion tool; it does not accept large PR prompts or return structured JSON responses. 3. Passing a multi-thousand-line prompt via `$(cat ...)` can hit ARG_MAX. The non-zero exit was then misclassified by the rate-limit detector, which aborted the entire session and skipped all remaining PRs in the queue. Fix: replace all three copilot invocations (run_triage, run_agentic, run_duck) with a new `copilot_chat` helper that calls the GitHub Models REST API directly via curl. The API is OpenAI-compatible, versioned via `X-GitHub-Api-Version`, stable against gh CLI version changes, and accepts arbitrary prompt sizes using python3 for safe JSON encoding. Additional changes: - Add `COPILOT_API_MODEL` var (default `openai/o4-mini`) overrideable via env. - run_agentic/run_duck copilot cases now also write output to $OUTPUT_FILE so callers that check that path directly (deep review, audit) find the JSON. - Rate-limit responses (HTTP 429) are echoed to stdout so the existing `is_rate_limited()` detector fires correctly for engine fallback. - Add pre-flight smoke test in review-batch.sh: tests GitHub Models API connectivity with a one-liner prompt before processing any PRs, so auth or model errors surface immediately as a clear setup failure. - Add tests/test_copilot_chat.sh: unit tests for the JSON payload builder with edge-case prompts (quotes, newlines, # headings, large diffs, Unicode). Closes #147 Co-authored-by: Don Petry <don-petry@users.noreply.github.com> * fix: scope COPILOT_API_MODEL export to copilot engine only Move the `export COPILOT_API_MODEL` from the common exports block into the `copilot)` case where the variable is set, so it is not exported as an empty/unset variable when the engine is `claude` or `gemini`. The `copilot_chat` fallback `${COPILOT_API_MODEL:-openai/o4-mini}` still works correctly when `DUCK_ENGINE=copilot` under a non-copilot …