ci: Add PR review enforcement GitHub Action#473
Conversation
Adds the review-enforcement workflow from the API repo to enforce that PRs have at least one approval from a non-bot reviewer, and to auto-request reviews from the product team when Dependabot CI fails. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![baz-reviewer[bot]](https://avatars.githubusercontent.com/in/933528?s=60&v=4){kind=small}
| const pr = context.payload.pull_request; | ||
| const event = context.eventName; | ||
| const isDependabot = pr.user?.login === 'dependabot[bot]'; | ||
|
|
||
| // Skip for Dependabot on all events | ||
| if (isDependabot) { | ||
| core.info('Dependabot PR detected - skipping review enforcement.'); | ||
| return; | ||
| } |
There was a problem hiding this comment.
context.payload.pull_request is undefined on workflow_run events, but the script immediately runs const isDependabot = pr.user?.login === 'dependabot[bot]', which throws before the job can exit; can we guard for workflow_run (or restrict the job to pull_request* events) before accessing pr.user?
Finding type: Logical Bugs
Prompt for AI Agents:
In .github/workflows/review-enforcement.yml around lines 22 to 30, the script reads
const pr = context.payload.pull_request and immediately uses pr.user, which throws when
the job runs on workflow_run events where pull_request is undefined. Update the logic to
first check the event type (e.g., if context.eventName === 'workflow_run' or if
context.payload.pull_request is falsy) and return early before accessing pr.user;
alternatively, add a guard like if (!pr) { core.info('No pull request in payload -
skipping.'); return; } so the script never dereferences pr.user when pr is undefined.
| const reviews = await github.rest.pulls.listReviews({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| pull_number: pr.number | ||
| }); | ||
|
|
||
| const approvals = reviews.data.filter(r => r.state === 'APPROVED'); | ||
| const hasNonBazApproval = approvals.some( | ||
| r => r.user?.login && | ||
| r.user.login !== 'baz-reviewer' && | ||
| r.user.type === 'User' | ||
| ); | ||
|
|
||
| if (!hasNonBazApproval) { | ||
| core.setFailed('At least one approval from a non-baz-reviewer is required.'); | ||
| } |
There was a problem hiding this comment.
pulls.listReviews returns every historical review event, including approvals that were later dismissed/changed, but this code just filters for any state === 'APPROVED'; a reviewer can undo their approval (change request/dismissal) and the workflow still sees the old approval and passes. Can we reduce to each reviewer's latest review (e.g. sort submitted_at and drop older events) so only current approvals keep the run green?
Finding type: Logical Bugs
Prompt for AI Agents:
In .github/workflows/review-enforcement.yml around lines 41 to 56, the logic that
computes approvals uses reviews.data.filter(r => r.state === 'APPROVED') which can count
historical approvals that were later dismissed or changed. Refactor this block to first
group reviews.data by r.user.login (skip reviews with no user), for each reviewer keep
only their latest review event (compare submitted_at timestamps), then compute approvals
by checking latestReview.state === 'APPROVED' and hasNonBazApproval from those latest
reviews only. Ensure this handles missing submitted_at gracefully and continues to
ignore the 'baz-reviewer' user as before.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
john-weiler
changed the title
john-weiler
requested review from
ShuaiShao93 and
sdhar-galileo
and removed request for
dmcwhorter
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #473 +/- ##
==========================================
+ Coverage 82.19% 82.57% +0.37%
==========================================
Files 92 96 +4
Lines 8509 9140 +631
==========================================
+ Hits 6994 7547 +553
- Misses 1515 1593 +78 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
1 participant
User description
Summary
review-enforcement.ymlworkflow from the API repoTest plan
🤖 Generated with Claude Code
Generated description
Below is a concise technical summary of the changes proposed in this PR:
Implements a new GitHub Action workflow to enforce manual review approvals and automate reviewer assignment for failed Dependabot builds. Removes the global product team ownership from the
CODEOWNERSfile to transition towards this automated enforcement model.review-enforcement.ymlworkflow to ensure PRs receive at least one approval from a non-bot user and to auto-assign reviewers when Dependabot CI fails.Modified files (1)
Latest Contributors(0)
@rungalileo/productteam assignment from the.github/CODEOWNERSfile.Modified files (1)
Latest Contributors(0)