fix preserve Dependabot reviewer intent

[Pigbibi]

What changed

• model both review_requested and review_request_removed timeline events
• paginate the complete PR timeline
• re-check current reviewer state immediately before deletion
• preserve the latest human request/removal intent during concurrent updates
• restore a human request only when it is still the latest human action and currently absent
• handle concurrent DELETE races without hiding genuine API failures

Why

This closes the remaining reviewer-state races in Dependabot CODEOWNERS cleanup. A maintainer can request or withdraw review while cleanup is queued without having that intent overwritten.

Validation

• bash syntax check
• jq event-state fixture check
• git diff --check
• no checkout or execution of PR code

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: 1 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Race Condition in .github/workflows/dependabot_review_request_cleanup.yml

The restore path still has a race between the last current_review_requests check and the POST /requested_reviewers call. Reachable flow: after events_after shows the latest human intent is review_requested, the workflow checks whether Pigbibi is currently absent; if a maintainer then removes the review request before the subsequent POST, this code re-adds the reviewer and overwrites that newer human removal. That contradicts the PR's stated goal of preserving the latest human request/removal intent during concurrent updates. (line 76)

Suggestion: Before issuing the restore POST, re-read the timeline and current reviewer state and only restore if review_requested is still the latest human event for that reviewer and the reviewer is still absent. Alternatively, make the restore step loop with a compare-then-act revalidation so a later human removal cannot be overwritten.

---

Review by Codex PR Review bot • PR